Data Privacy Day: Know your rights, and the right tools to stay private

Not all data privacy rights are the same. There’s the flimsy, the firm, the enforceable, and the antiquated, and, unfortunately, much of what determines the quality of your own data privacy rights is little more than your home address. Those in Chile, for example, enjoy a globally rare...

Oracle Enterprise Session Border Controller has an unspecified vulnerability (CNVD-2022-17340)

Oracle Communications is a product of Oracle Corporation USA. A security vulnerability exists in Oracle Enterprise Session Border Controller that could be exploited by an attacker to cause unauthorized creation, deletion, or modification of critical data or all Oracle Enterprise Session Border...

The Facebook Pixel Hunt aims to unravel Facebook’s tracking methods. Will you join?

Browser developer Mozilla has announced a research project to provide insights into, and data about, a space that’s opaque to policymakers, researchers and users themselves. Tracking the trackers is the name of the game. Give up some of your data voluntarily to stop the involuntary collection by...

2021 in Review, Part 1: 5 Cybersecurity Topics that Made News

Its been another chaotic year in cybersecurity, as protecting web applications and stopping sensitive data breaches remain top-of-mind issues and continue to generate headline news. As 2021 comes to a close, cybersecurity and all the industries it serves is dealing with an unprecedented zero-day...

7 data privacy solution features your organization needs to have

The worldwide data privacy regulation landscape is changing National laws and state/provincial laws continue to be enacted and strengthened to ensure their citizens’ data is protected and give individuals more control over how personal data is collected, used, and shared. No matter what industry...

14 New XS-Leaks (Cross-Site Leaks) Attacks Affect All Modern Web Browsers

Researchers have discovered 14 new types of cross-site data leakage attacks against a number of modern web browsers, including Tor Browser, Mozilla Firefox, Google Chrome, Microsoft Edge, Apple Safari, and Opera, among others. Collectively known as "XS-Leaks," the browser bugs enable a malicious...

PUB-A-185591180

In getDeviceId of PhoneSubInfoController.java, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction ...

Is Microsoft Stealing People’s Bookmarks?

I received email from two people who told me that Microsoft Edge enabled synching without warning or consent, which means that Microsoft sucked up all of their bookmarks. Of course they can turn synching off, but its too late. Has this happened to anyone else, or was this user error of some sort?...

Ignore China’s New Data Privacy Law at Your Peril

The Personal Information Protection Law gives authorities the power to impose huge fines and blacklist companies. But the biggest impact may be felt outside the country...

GHSA-C7V4-M269-4995 Exposure of Sensitive Information to an Unauthorized Actor in Moodle

The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10...

Simplifying the complex: Introducing Privacy Management for Microsoft 365

The data privacy regulation landscape is more complex than ever. With new laws emerging in countries like China and India, shifts in Europe and the United Kingdom, and currently 26 different laws across the United States, staying ahead of regulations can feel impossible. But this work is...

Simplifying the complex: Introducing Privacy Management for Microsoft 365

The data privacy regulation landscape is more complex than ever. With new laws emerging in countries like China and India, shifts in Europe and the United Kingdom, and currently 26 different laws across the United States, staying ahead of regulations can feel impossible. But this work is...

Incident Response: 5 Principles to Boost the Infosec/Legal Relationship

As an information-security professional, would you feel ready to respond to a state attorney in the event of a cyber-incident? Around half 47 percent of organizations polled for Kroll’s The State of Incident Response 2021 report said that their teams lack clarity around when to engage legal couns...

Getting to Know Cybersecurity Awareness Month Champion: Imperva

As a cybersecurity industry leader, it is both our responsibility and our pleasure to work with the National Cyber Security Alliance NCSA and ​​the Cybersecurity and Infrastructure Agency CISA of the U.S. Department of Homeland Security as a 2021 Cybersecurity Awareness Month Champion and to join...

in zikula/core

Description Sensitive data on the application can be exposed after the user logs Proof of Concept // PoC 1 Login to the application 2 Goto page like My Account 3 Click logout 4 Click browser back button Impact When a user logs out without closing the browser someone can view the information insid...

InBody App vulnerable to information disclosure

Overview InBody App provided by InBody Japan Inc. works with the household body composition analyzer InBody Dial manufactured and sold by InBody Japan Inc., and as a part of its functions, it manages and stores data such as weight, BMI, skeletal muscle mass, and fat mass measured by InBody Dial...

IBM Cloud Pak for Data 信息泄露漏洞

Ibm Cloud Pak For Data is an open and scalable data platform from Ibm USA, Inc. provides a data structure that makes all data available for AI and analytics on any cloud.A security vulnerability exists in IBM Cloud Pak for Data that stems from the fact that IBM Cloud Pak for Data can allow a loca...

When data privacy and protection are rights, don’t get it wrong

Twenty-one years ago, Latanya Sweeney showed that it’s possible to uniquely identify 87% of Americans with just three pieces of personal data: gender, ZIP code and full date of birth. Long before anyone had heard the words ‘data lake’, ‘cloud storage’ or ‘big data’, nevermind ‘social media’, it w...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m keynoting CIISec Live—an all-online event—September 15-16, 2021. I’m speaking at the Infosecurity Magazine EMEA Autumn Online Summit on September 21, 2021. I’m speaking at the Cybersecurity and Data Privacy Law Conference in...

WhatsApp to Finally Let Users Encrypt Their Chat Backups in the Cloud

WhatsApp on Friday announced it will roll out support for end-to-end encrypted chat backups on the cloud for Android and iOS users, paving the way for storing information such as chat messages and photos in Apple iCloud or Google Drive in a cryptographically secure manner. The optional feature,...