945 matches found
CVE-2019-4686
CVE-2019-4686 affects IBM Security Guardium Data Encryption (GDE) 3.0.0.2. The root cause is failure to set the secure attribute on authorization tokens or session cookies, allowing an attacker to obtain cookie values by tricking a user into following an http link or via a link planted on a visit...
News Wrap: AWS Cryptojacking Worm, IBM Privacy Lawsuit and More
Threatpost editors Lindsey O’Donnell-Welch and Tara Seals discuss the top security news stories of the week ended Aug. 21, including: IBM, the owner of the Weather Channel mobile app, has reached a settlement with the Los Angeles city attorney’s office after a 2019 lawsuit alleged that the app wa...
IBM Settles Lawsuit Over Weather Channel App Data Privacy
IBM, the owner of the Weather Channel mobile app, has reached a settlement with the Los Angeles city attorney’s office after a 2019 lawsuit alleged that the app was deceiving its users in how it was using their geolocation data. The 2019 lawsuit claimed, the app’s permission prompt for users to...
Hyperledger: The “payload” Field of Transactions in a Block Reveals the Private Data to All Peers
To whom it may concern, We are a research group conducting research on Hyperledger Fabric 2.0. We find a design flaw about the “payload” field of transactions, which can reveal the Private Data to all peers in one channel. When a client invokes a function to read the private data, the is stored i...
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak: I'm giving a keynote address at the Cybersecurity and Data Privacy Law virtual conference on September 9, 2020. The list is maintained on this page...
TikTok Surreptitiously Collected Android User Data Using Google-Prohibited Tactic
TikTok has been collecting unique identifiers from millions of Android devices without their users’ knowledge using a tactic previously prohibited by Google because it violated people’s privacy, new research has found. Click to register! The app concealed the practice, which can track users onlin...
Data Accountability and Transparency Act of 2020 looks beyond consent
In the United States, data privacy is hard work—particularly for the American people. But one US Senator believes it shouldn’t have to be. In June, Democratic Senator Sherrod Brown of Ohio released a discussion draft of a new data privacy bill to improve Americans’ data privacy rights and their...
Out of the Grace Period: Trust and Communication Rises in a Post-CCPA World
Six months ago, the California Consumer Privacy Act CCPA was put into effect, granting California residents increased rights over how their personal data is gathered and shared by the companies they interact with. Leading up to its launch, organizations expressed concern over whether they were...
CVE-2020-14695
CVE-2020-14695 affects Oracle VM VirtualBox (Core) with affected releases: 5.2.x before 5.2.44, 6.0.x before 6.0.24, and 6.1.x before 6.1.12. The issue permits a high-privilege attacker with local logon to compromise VirtualBox and potentially access confidential data. Mitigation per linked advis...
CVE-2020-14700
CVE-2020-14700 affects Oracle VM VirtualBox Core (older VirtualBox). Affected: prior to 5.2.44, prior to 6.0.24, and prior to 6.1.12. The vulnerability is difficult to exploit but allows a high-privilege attacker with logon to the infrastructure where VirtualBox runs to compromise VirtualBox, pot...
State privacy laws: 2020 highs and lows
2020 is shaping up to be another interesting year for data privacy, especially given that public health agencies, private companies, and states are now working feverishly to create contact tracing apps and programs while still preserving privacy. Being thoughtful and accountable about data privac...
Introducing Imperva Cloud Data Security
We are excited to announce that our latest data security innovation is now available worldwide! Made for the cloud, Imperva Cloud Data Security CDS builds on our industry-leading application and data security solutions, providing an industry-first, complete cloud data SaaS security solution that...
Lock and Code S1Ep10: Pulling apart the Internet of Things with JP Taggart
This week on Lock and Code, we discuss the top security headlines generated right here on Labs and around the Internet. In addition, we talk to JP Taggart, senior security researcher at Malwarebytes, about the Internet of Things. For years, Internet capabilities have crept into modern consumer...
hbarros.com.br Cross Site Scripting vulnerability OBB-1213229
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Nationwide Facial Recognition Ban Proposed By Lawmakers
Lawmakers have proposed legislation that would indefinitely ban the use of facial recognition technology by law enforcement nationwide. The new bill comes after months of public concerns surrounding facial recognition’s implications for data privacy, government surveillance and racial bias. The...
New Bill Targeting ‘Warrant-Proof’ Encryption Draws Ire
Privacy advocates are decrying a new bill, which would force tech companies to unlock encrypted devices if ordered to do so by law enforcement with a court issued warrant. The Lawful Access to Encrypted Data Act was introduced on Tuesday by Senate Judiciary Committee Chairman Lindsey Graham R-SC,...
Facebook's FTC-Mandated Privacy Committee Now in Effect
Facebook on Thursday said it has started to report its privacy practices to a newly formed, independent Privacy Committee. The creation of the independent committee was part of the company’s settlement a year ago with the Federal Trade Commission FTC over data privacy violations, which came in...
Going dark: encryption and law enforcement
UPDATE, 05/22/2020: In the advent of the EARN IT Act, the debate on government subversion of encryption has reignited. Given that the material conditions of the technology have not changed, and the arguments given in favor of the bill are not novel, we've decided to republish the following blog...
Design/Logic Flaw
Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app also known as GlobalProtect Agent for MacOS and Windows. For this issue to occur all of these conditions must be true: 1 'Sav...
CVE-2020-2004 GlobalProtect App: Passwords may be logged in clear text while collecting troubleshooting logs
Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app also known as GlobalProtect Agent for MacOS and Windows. For this issue to occur all of these conditions must be true: 1 'Sav...