2361 matches found
Wireless carriers fined $200 million after illegally sharing customer location data
After four years of investigation, the Federal Communications Commission FCC has concluded that four of the major wireless carriers in the US violated the law in sharing access to customers’ location data. The FCC fined AT&T, Sprint, T-Mobile, and Verizon a total of almost $200 million for...
SQL Injection Vulnerability in Data Leakage Protection (DLP) System of Beijing Yisaitong Technology Development Co.
Yisetong Data Leakage Protection DLP is a comprehensive data security product that integrates machine learning, big data analysis, document encryption, access control, correlation analysis, data identification and other technologies. Data Leakage Protection DLP system of Beijing Yisetong Technolo...
CVE-2023-51365
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions:...
TikTok comes one step closer to a US ban
The US Senate has approved a bill that would effectively ban TikTok from the US unless Chinese owner ByteDance gives up its share of the immensely popular app. Social video platform TikTok has experienced explosive growth since it first appeared in 2017, and is now said to have well over 1.5...
CISO Perspectives on Complying with Cybersecurity Regulations
Compliance requirements are meant to increase cybersecurity transparency and accountability. As cyber threats increase, so do the number of compliance frameworks and the specificity of the security controls, policies, and activities they include. For CISOs and their teams, that means compliance i...
Django Debug Mode Enabled
Django is a free and open-source Python web application framework which offers a debug mode which allows developers to get additional information to help troubleshooting their applications including stack traces on error pages, exposing variables defined in your Django settings. A remote...
Mental health company Cerebral failed to protect sensitive personal data, must pay $7 million
The Federal Trade Commission FTC has reached a settlement with online mental health services company Cerebral after the company was charged with failing to secure and protect sensitive health data. Cerebral has agreed to an order that will restrict how the company can use or disclose sensitive...
Data Matters — The Value of Visibility in API Security
...
Keycloak vulnerable to impersonation via logout token exchange
Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions...
Enforce and Report on PCI DSS v4 Compliance with Rapid7
The PCI Security Standards Council PCI SSC is a global forum that connects stakeholders from the payments and payment processing industries to craft and facilitate adoption of data security standards and relevant resources that enable safe payments worldwide. According to the PCI SSC website, “PC...
CVE-2024-21068
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22; Oracle GraalVM for JDK: 17.0.10, 21.0.2 and 22; Oracle...
CVE-2024-21108
CVE-2024-21108 (Oracle VM VirtualBox Core) affects Oracle VM VirtualBox prior to 7.0.16. The vulnerability allows a low-privilege attacker who can log on to the infrastructure where VirtualBox runs to compromise the VirtualBox instance, potentially leading to unauthorized read access to a subset ...
FTC Fines Mental Health Startup Cerebral $7 Million for Major Privacy Violations
The U.S. Federal Trade Commission FTC has ordered mental telehealth company Cerebral from using or disclosing personal medical data for advertising purposes. It has also been fined more than $7 million over charges that it revealed users' sensitive personal health information and other data to...
ProfileGrid – User Profiles, Memberships, Groups and Communities < 5.8.4 - Missing Authorization
Description The ProfileGrid – User Profiles, Memberships, Groups and Communities plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the pmuploadcoverimage function in all versions up to, and including, 5.8.3. This makes it possible for...
CVE-2024-28927
CVE-2024-28927 is a Microsoft OLE DB Driver for SQL Server Remote Code Execution vulnerability. Public docs identify the affected component as the Microsoft OLE DB Driver for SQL Server, with remediation provided via security updates KB5037572 (OLDB Driver 18.x, SQL Server 18.7.0002.0) and KB5037...
CVE-2023-6522
Incorrect Use of Privileged APIs vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users. This issue affects Extreme XDS: before 3914...
ROS-20240404-01
A vulnerability in the Grafana web-based data submission tool is related to authentication bypass via spoofing. Exploitation of the vulnerability could allow an attacker acting remotely to gain full access to a user's account A vulnerability in the Grafana monitoring and surveillance platform is...
CVE-2024-29432
Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas...
RosarioSIS cross site scripting vulnerability
DISPUTED A vulnerability was found in francoisjacquet RosarioSIS 11.5.1. It has been rated as problematic. This issue affects some unknown processing of the component Add Portal Note. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been...
