Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect for Enterprise Resource Planning (CVE-2018-1890, CVE-2018-12547)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ which is used by IBM Spectrum Protect formerly Tivoli Storage Manager for Enterprise Resource Planning. These issues were disclosed as part of the IBM Java SDK updates in January 2019. Vulnerability Details CVEID:...

Security Bulletin: Password disclosure via application trace affects IBM Spectrum Protect for Enterprise Resource Planning (CVE-2018-1987)

Summary If tracing is activated, IBM Spectrum Protect formerly Tivoli Storage Manager for Enterprise Resource Planning may display the IBM Spectrum Protect node password in plain text in the trace file. Vulnerability Details CVEID: CVE-2018-1987 DESCRIPTION: IBM Tivoli Storage Manager for...

Security Bulletin: Spoofing and denial of service vulnerabilities in WebSphere Application Server Liberty affect IBM Spectrum Protect Client web user interface and IBM Spectrum Protect for Virtual Environments (CVE-2018-1902, CVE-2019-4046)

Summary Potential spoofing and denial of service vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Spectrum Protect formerly Tivoli Storage Manager Backup-Archive Client web user interface and IBM Spectrum Protect formerly Tivoli Storage Manager for Virtual Environments...

Microsoft Exchange Server Information Disclosure

The vulnerabilities of Microsoft Exchange Server, Microsoft Lync and Skype for Business messaging applications, Microsoft Outlook and Outlook for iOS email clients, as well as Microsoft Office and Office 365 software packages are related to the lack of data protection measures. Exploiting these...

How to cost-effectively manage and secure a mobile ecosystem

Today’s post was written by Roxane Suau, Vice President of Marketing for Pradeo. In the corporate environment, mobile devices and applications are at the center of communications, enhancing collaborators’ productivity with 24/7 access to information. But at the same time, they represent thousands...

Yubico pam-u2f Service Data Protection

The vulnerability of the Yubico pam-u2f PAM module is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

HAProxy check_request_for_cacheability Disclosure

The vulnerability of the checkrequestforcacheability function in the HAProxy network software is related to the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information through a remote request without authentication...

Marriott Hit With $123M Fine For Massive 2018 Data Breach

The U.K.’s privacy watchdog is hitting Marriott International with a $123 million £99 million penalty stemming from its 2018 data breach of more than 383 million guest records. The Tuesday fine is issued by the Information Commissioner’s Office ICO and comes only a day after the organization...

British Airways Fined £183 Million Under GDPR Over 2018 Data Breach

Britain's Information Commissioner's Office ICO today hit British Airways with a record fine of £183 million for failing to protect the personal information of around half a million of its customers during last year's security breach. British Airways, who describes itself as "The World's Favorite...

Strife NT information protection system Unauthenticated Access Disclosure

The vulnerability of the Data Protection System’s driver for unauthorized access is related to deficiencies in access control for attributes of file system objects. Exploiting this vulnerability allows an intruder, operating locally, to gain unauthorized access to information about file system...

IBM Spectrum Protect Buffer Overflow

The vulnerability of the IBM Spectrum Protect server and data protection agent is related to buffer overflows in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause failures in the server or data protection agent...

How to Protect Our Kids' Data and Privacy

Opinion: Kids today have an online presence starting at birth, which raises a host of legal and ethical concerns. We desperately need a new data protection framework...

Data Breach Lessons from the Trenches

In this webcast Threatpost editor Tom Spring examines the data breach epidemic with the help of noted breach hunter and cybersecurity expert Chris Vickery. He shares how companies can identify their own insecure data, remediate against a data breach and offers tips on protecting data against futu...

Dell EMC Avamar Server Privilege Escalation

The vulnerability of the Dell EMC Avamar Server backup system and the DELL EMC Integrated Data Protection system exists due to the lack of measures taken to neutralize special elements used in the operating system. Exploiting this vulnerability allows a malicious actor to execute arbitrary comman...

Dell EMC Avamar Server Operational Data Private Key Exposure

The vulnerability of the Dell EMC Avamar Server backup system and the DELL EMC Integrated Data Protection Appliance lies in the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor to obtain the SSL/TLS connection secrets...

McAfee Agent Remote Logging Disclosure

The vulnerability of the Remote Logging component of the McAfee Agent antivirus software is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...

IBM Security Guardium Code Issue Vulnerability

IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. A code issue vulnerability exists in IBM Security Guardium, which can ...

Spanish Soccer League App Spies on Fans

The Spanish Soccer League's smartphone app spies on fans in order to find bars that are illegally streaming its games. The app listens with the microphone for the broadcasts, and then uses geolocation to figure out where the phone is. The Spanish data protection agency has ordered the league to...

Windows GDI Information Disclosure

The vulnerability of the Windows GDI component of the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information through a specially created document or web page...

Windows kernel Information Disclosure

The vulnerability of the Windows operating system’s kernel is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information through a specially created file...