1123 matches found
Ultimate GDPR & CCPA Compliance Toolkit < 2.5 - Unauthenticated Plugin Settings Export and Import
The plugin used the isadmin method as an authorisation check, which does not check if the user is a an administrator. This could allow unauthenticated attackers to import arbitrary plugin’s settings and redirect all traffic to an external malicious website for example. Even though proper capabili...
Automating and operationalizing data protection with Dataguise and Microsoft Information Protection
This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. In technical literature, the terms data discovery, classification, and tagging are sometimes used interchangeably, but there are real differences in what they actually mean—and each...
A week in security (January 25 – January 31)
January 28 was Data Privacy Day, but for Malwarebytes Labs, it was Data Privacy Week. As such, were packed with more privacy coverage than you can shake a stick at, starting with some practical steps on how to make your online life private and secure, and why privacy is core to a safer internet. ...
$12m Grindr fine shows GDPR’s got teeth
As thoughts turn to Data Privacy this week in a big way, GDPR illustrates it isnt an afterthought. Grindr, the popular social network and dating platform, will likely suffer a $12 million USD fine due to privacy related complaints. What happened here, and what are the implications for future case...
Why Data Security and Privacy in the digital age are crucial
Privacy is considered a basic human right but, with so much of our personal data now ‘out there’ in cyberspace, how private can it really be? Data is everywhere, and with rising internet usage, an increase in cloud technologies, and our growing reliance on IoT devices, it continues to grow...
VMware Carbon Black Champions Data Privacy Day 2021
Today is Data Privacy Day, an annual effort hosted by the National Cybersecurity Alliance NCSA to raise awareness about the importance of privacy and protection of personal information. VMware Carbon Black is proud to be an official Champion, supporting the principle that all organizations share...
Privacy breaches: Using Microsoft 365 Advanced Audit and Advanced eDiscovery to minimize impact
GDPR, HIPAA, GLBA, all 50 U.S. States, and many countries have privacy breach reporting requirements. If an organization experiences a breach of customer or employee personal information, they must report it within the required time frame. The size and scope of this reporting effort can be massiv...
Privacy breaches: Using Microsoft 365 Advanced Audit and Advanced eDiscovery to minimize impact
GDPR, HIPAA, GLBA, all 50 U.S. States, and many countries have privacy breach reporting requirements. If an organization experiences a breach of customer or employee personal information, they must report it within the required time frame. The size and scope of this reporting effort can be massiv...
Data Privacy – Now’s the Time for the US to Catch Up
The recent Netflix documentary, The Social Dilemma, may have highlighted to many Americans just what happens to the wealth of personal information they regularly - and willingly - share online. It may be especially concerning, then, to know that companies in the United States aren’t required by...
A week in security (December 14 – December 20)
Last week on Malwarebytes Labs we kept you updated on the SolarWinds attack, we warned about the special dangers that come with the Christmas season, published a threat profile for the Egregor ransomware, warned how a lead generation scam was targeting potential Malwarebytes MSP partners, and...
Ticketmaster Scores Hefty Fine Over 2018 Data Breach
Ticketmaster’s UK division has been slapped with a $1.65 million fine by the Information Commissioner’s Office ICO in the UK, over its 2018 data breach that impacted 9.4 million customers. The fine £1.25million has been levied after the ICO found that the company “failed to put appropriate securi...
Millions of Hotel Guests Worldwide Caught Up in Mass Data Leak
A widely used hotel reservation platform has exposed 10 million files related to guests at various hotels around the world, thanks to a misconfigured Amazon Web Services S3 bucket. The records include sensitive data, including credit-card details. Prestige Software’s “Cloud Hospitality” is used b...
dvogtimoveis.com.br Cross Site Scripting vulnerability OBB-1492680
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
tCell by Rapid7 Now Available for the European Region
Today, we are excited to announce tCell by Rapid7, our next-gen WAF and RASP solution, is now available in the Rapid7 Insight cloud’s European region. Multi-national or European organizations with data sovereignty requirements can now leverage tCell to reduce the risk of a breach via hacking of...
GDPR CCPA Compliance Support < 2.4 - Unauthenticated PHP Object Injection
The GDPR CCPA Compliance Support WordPress plugin was vulnerable to an Unauthenticated PHP Object Injection security vulnerability. PoC The vulnerability could triggered within the "njtgdprallowpermissions" Base64 encoded cookie value...
GDPR CCPA Compliance Support < 2.4 - Unauthenticated PHP Object Injection
The GDPR CCPA Compliance Support WordPress plugin was vulnerable to an Unauthenticated PHP Object Injection security vulnerability. The vulnerability could triggered within the "njtgdprallowpermissions" Base64 encoded cookie value...
WordPress GDPR CCPA Compliance Support plugin <= 2.3 - Insecure Deserialization / Unauthenticated PHP Object Injection vulnerability
Insecure Deserialization / Unauthenticated PHP Object Injection vulnerability found by NinTechNet in WordPress GDPR CCPA Compliance Support plugin versions = 2.3. Solution Update the WordPress GDPR CCPA Compliance Support plugin to the latest available version at least 2.4...
lka.spbgasu.ru GDPR PII Exposure vulnerability OBB-1470000
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
jira.globalprocessing.ae GDPR PII Exposure vulnerability OBB-1467826
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
jira.deiser.com GDPR PII Exposure vulnerability OBB-1467824
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...