CVE-2019-4484

IBM Emptoris Sourcing (10.1.0–10.1.3), IBM Contract Management (10.1.0–10.1.3), and IBM Emptoris Spend Analysis (10.1.0–10.1.3) expose an information disclosure vulnerability where error messages reveal sensitive data. The issue arises from error handling that can be exploited to obtain confident...

What you — and your company — should know about cyber insurance

By Jon Munshaw and Joe Marshall. It’s no longer a question of “if” any given company or organization is going to be hit with a cyber attack — it’s when. And when that attack comes, who is willing to take on that risk? For some groups, it may be that they feel they are fully prepared to take on th...

The vulnerability of the `tokenUseGlobalStorage` function in the authentication system for web applications in LemonLDAP::NG allows a attacker to compromise data integrity, gain access to confidential data, and cause service interruptions.

The vulnerability of the tokenUseGlobalStorage function in the authentication system for web applications in LemonLDAP::NG is related to insufficient token session verification. Exploiting this vulnerability could allow a malicious actor to compromise data integrity, gain access to confidential...

Dodging bad passwords with Google’s new tool

By Sudais Google's new Password checkup extension checks for leaked credentials and informs whether they have been leaked before in a data breach. In 2019, more than 20 million unique passwords among other credentials were leaked and available online for sale. This fact represents only one year...

This Week in Security News: Phishing Campaigns and a Biometric Data Breach

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about ever-increasing amounts of phishing campaigns and how Trend Micro caught 2.4 million attacks of this type — a 59% increase from...

News Wrap: DejaBlue Bugs and Biometrics Data Breaches

On the heels of Black Hat USA 2019 and DEF CON, Threatpost editors break down the biggest news of this past week ended Aug. 16, from Patch Tuesday craziness to publicly-exposed databases. That includes: Microsoft’s August Patch Tuesday release featuring four BlueKeep-like critical remote...

European Central Bank Shuts Down 'BIRD Portal' After Getting Hacked

The European Central Bank ECB confirmed Thursday that it had been hit by a cyberattack that involved attackers injecting malware into one of its websites and potentially stealing contact information of its newsletter subscribers. Headquartered in Germany, the European Central Bank ECB is the...

Choice Hotels Breach Showcases Need for Shared Responsibility Model

Hospitality giant Choice Hotels fell victim to hackers this week, thanks to a MongoDB database that was left open to the internet containing 700,000 customer records. The situation highlights supply-chain data-security risk, given that the data was being held by a third-party vendor — and brings ...

Fingerprints of 1M Exposed in Public Biometrics Database

Researchers discovered the personal and biometrics data of more than a million people left publicly exposed on a database owned by Suprema, a biometric security company. Data includes facial recognition and fingerprint information collected by the UK metropolitan police, small local businesses an...

U.S. Dept Of Defense: Online training material disclosing username and password

Summary: A training document is revealing username and password details for what appears to be a DoD training system Description: Using the google dork site:.mil ext:ppt intext:password, I was able to find a number of powerpoint documents on .mil websites that include username and passwords. This...

Epic Games Hit With Class Action Lawsuit Over Hacked 'Fortnite' Accounts

Epic Games, the creator of the popular 'Fortnite' video game, is facing a class-action lawsuit from gamers over hacked Fortnite accounts, accusing the company of failing to maintain adequate security measures and notify users of the security breach in a timely manner. The lawsuit, filed by...

Cyberattack Lateral Movement Explained

Lightly edited transcript of the video above Hi there, Mark Nunnikhoven from Trend Micro Research, I want to talk to you about the concept of lateral movement. And the reason why I want to tackle this today is because I've had some conversations in the last few days that have really kind of hit...

State Farm Falls Victim to Credential-Stuffing Attack

State Farm Insurance is notifying customers that accounts have been compromised by hackers in a credential-stuffing attack. Credential-stuffing is accomplished by hackers who take advantage of users who often reuse the same passwords across multiple online accounts. The cyberattackers use stolen...

Group sex app leaks locations, pics and personal details. Identifies users in White House and Supreme Court

We’ve seen some pretty poor security in dating apps over recent years; breaches of personal data, leaking users locations and more. But this one really takes the biscuit: probably the worst security for any dating app we’ve ever seen And it’s used for arranging threesomes. It’s 3fun. It exposes t...

Clear Message Sent: Don’t Roll the Dice on Data Privacy Compliance

Last month, two leading companies each received what were then record-setting fines for data breach violations: £183 million for British Airways and then, just two weeks later, $5 billion for Facebook. Regulators sent a clear message to organizations around the world — if you don't treat your...

E3 Website Leaks Private Addresses for Thousands of Journalists

A YouTube content creator said that she has found a spreadsheet with the names and addresses – including private residences – of more than 2,000 journalists and content creators on the popular Electronic Entertainment Expo E3 trade show’s website. E3 2019, which took place this year June 11 to 13...

Security Fundamentals Are Key To Successful Cloud Migration

Earlier I wrote about the importance of patching, or more accurately the importance of transferring the need to patch & the associated risk to someone else by using their cloud security service. While patching definitely falls into the security fundamentals category it remains as relevant as ever...

Capital One breach exposes over 100 million credit card applications

Just as we were wrapping up the aftermath of the Equifax breach—how was that already two years ago?—we are confronted with yet another breach of about the same order of magnitude. Capital One was affected by a data breach in March. The hacker gained access to information related to credit card...

Threat Source newsletter (Aug. 1, 2019)

Newsletter compiled by Jon Munshaw. Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week. Are you heading to Vegas next week for Hacker Summer Camp? Talos will. We’ll be at Black Hat and DEFCON holding a series of talks, takin...

Cisco 'Knowingly' Sold Hackable Video Surveillance System to U.S. Government

Cisco Systems has agreed to pay $8.6 million to settle a lawsuit that accused the company of knowingly selling video surveillance system containing severe security vulnerabilities to the U.S. federal and state government agencies. It's believed to be the first payout on a 'False Claims Act' case...