CVE-2018-1372

CVE-2018-1372 affects IBM Security Guardium Big Data Intelligence (SonarG) 3.1. The vulnerability arises from a default weak password policy, permitting account compromise without strong passwords by default. IBM’s advisory references a remediation to version 3.2, indicating an updated password p...

CVE-2018-1425

CVE-2018-1425 affects IBM Security Guardium Big Data Intelligence (SonarG) 3.1, which uses weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The IBM Security Guardium Big Data Intelligence (SonarG) product is listed as affected wit...

IBM Security Guardium Big Data Intelligence (SonarG) Information Disclosure Vulnerability

IBM Security Guardium Big Data Intelligence SonarG is a suite of big data security intelligence solutions from IBM, USA. The solution features interactive data exploration, automated connectivity analysis, and user activity analysis. An information disclosure vulnerability exists in IBM Security...

IBM Security Guardium Big Data Intelligence Detection (HTTP)

HTTP based detection of IBM Security Guardium Big Data Intelligence. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-1774

IBM Security Guardium Big Data Intelligence SonarG 3.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 136818...

Information disclosure

IBM Security Guardium Big Data Intelligence SonarG 3.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 136818...

CVE-2017-1774

IBM Security Guardium Big Data Intelligence SonarG 3.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 136818...

CVE-2018-1377

IBM Security Guardium Big Data Intelligence SonarG 3.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 137778...

Excerpts from Moving Endpoint Security to the Predictive Cloud: Security Meets Big Data

Carbon Black recently published a whitepaper on the reasons and benefits of moving endpoint security to the cloud; this is the first excerpt from that guide, which you can find here. For more information about how the Cb Predictive Security Cloud, Carbon Black's comprehensive endpoint protection...

Cloud & Big Data: The Future of Security – Carbon Black & VMware’s 15-City Tour “Cloud Force Security” Kicks Off Feb. 20!

Endpoint Security is Broken Attackers are innovating faster than traditional defenses can keep up. In response, the security stack has become too complicated as more products that don’t work together are introduced to fill the gaps. There is a better way. Organizations are moving their endpoint a...

In Cybersecurity, the Fastest Decision Maker Wins Most Often

During the Korean War, John Boyd, an Air Force pilot and military strategist, studied why the F-86 Sabre was so successful in shooting down the Russian MiG-15 of that generation. Boyd discovered that the U.S. planes, while inferior to the Russian MiG in terms of speed, range, and altitude, were...

The Future of Endpoint Security is the Cloud, Part 1: Predictive Security

Security Meets Big Data Technology has certainly empowered the adversary, across far more attack surfaces than just endpoints alone. In fact, many other security disciplines have been forced to adapt to increasingly sophisticated attacks — and when they do, they all turn to the same foundation: b...

Carbon Black Selected as a Finalist in the Best Security Company and Best Emerging Technology Categories for the 2018 SC Awards

We are honored to be recognized as an Excellence Award finalist in the Best Emerging Technology category for Cb Defense and as a finalist in the Best Security Company category for the 2018 SC Awards. Now in its 21st year, SC Awards is recognized as the industry gold standard of accomplishment for...

What is the Cb Predictive Security Cloud (PSC)?

In today’s new reality, the device, and the people operating those devices, have taken center stage. Whether in your office or at a Starbucks, your endpoints now have access to some of your organization’s most sensitive data via cloud services, such as Salesforce.com, Office 365, and the Google...

Gartner: The Pursuit of Perfection Weakens InfoSec Effectiveness

While malicious hackers are the obvious enemies of InfoSec pros, there’s something else that puts IT environments in danger: Perfectionism. When applied to security, perfectionism becomes detrimental, creating a false certainty that all bases are covered and yielding a fundamentally flawed approa...

LexMark Perceptive Document Filters Bzip2 Convert Out of Bounds Write Vulnerability(CVE-2016-4336)

Description An exploitable out of bounds write exists in the Bzip2 parsing of the Perspective Document Filters conversion functionality. A crafted Bzip2 document can lead to a stack based buffer overflow causing an out of bounds write which under the right circumstance could potentially be...

Carbon Black’s Vision for the Predictive Security Cloud

Earlier today, during a keynote address at Cb Connect, I unveiled our vision for the Cb Predictive Security Cloud™️. The first of its kind, the Cb Predictive Security Cloud is an extensible, cloud-based cyber security platform that helps anticipate and prevent future and unknown cyberattacks. The...

Challenges of Big Data Security – Whiteboard Wednesday [Video]

Database security best practices are also applicable for big data environments. The question is how to achieve security and compliance for big data environments given the challenges they present. Issues of volume, scale, and multiple layers/technologies/instances make for a uniquely complex...

Deep dive in Lexmark Perceptive Document Filters Exploitation

This post authored by Marcin Noga with contributions from Nick BiasiniIntroductionTalos discovers and releases software vulnerabilities on a regular basis. We don't always publish a deep technical analysis of how the vulnerability was discovered or its potential impact. This blog will cover these...

Apache Log4j CVE-2017-5645 Remote Code Execution Vulnerability

Description Apache Log4j is prone to remote code-execution vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions. Apache Log4j 2.0-alpha1 through 2.8.1 ar...