Security Bulletin: Denial of Service vulnerability affects IBM Spectrum Protect Client and IBM Spectrum Protect for Virtual Environments (CVE-2018-1786)

Summary IBM Spectrum Protect formerly Tivoli Storage Manager Client and IBM Spectrum Protect for Virtual Environments is vulnerable to a denial of service caused by incorrect accumulation of TCP/IP sockets in a CLOSEWAIT state. UPDATED: 8/21/2019 - Corrected Affected Product Versions Vulnerabilit...

Your Business is Compliant with Data Security Regulations. It’s Still not Safe.

There has been plenty of discussion about the impact of global data regulations on data security practices. Particularly with the implementation of the EU’s GDPR last year, organizations in every industry have been scrambling to develop new security practices to avoid fines and the associated bad...

Facebook Records User Audio, Sparking Privacy Questions

Facebook has admitted that it has been transcribing audio chats between its users on its Messenger platform. Sources said that it’s paying hundreds to third-party outside contractors to do so. The latter calls into question Facebook’s data-handling practices when it comes to being open with its...

Data and device security for domestic abuse survivors

For more than a month, Malwarebytes has worked with advocacy groups, law enforcement, and cybersecurity researchers to deliver helpful information in fighting stalkerware—the disturbing cyber threat that enables domestic abusers to spy on their partners’ digital and physical lives. While we’ve...

Dell EMC Integrated Data Protection Appliance Multiple Security Vulnerabilities

Description Dell EMC Integrated Data Protection Appliance is prone to multiple security vulnerabilities. Attackers can exploit these issues to steal cookie-based authentication credentials, control how the page is rendered to the user, obtain sensitive information or bypass certain security...

The vulnerability of the Cisco Unified Communications Manager web framework allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Cisco Unified Communications Manager web framework is related to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information through a specially created...

The vulnerability of the IBM QRadar SIEM system for event collection and analysis lies in the lack of protection for operational data, allowing attackers to disclose the protected information.

The vulnerability of the IBM QRadar SIEM event collection and analysis system is related to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

The vulnerability of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, and Kaspersky Small Office Security lies in the lack of protection for operational data, allowing attackers to exploit this weakness to compromise the protected information.

The vulnerability of Kaspersky Anti-Virus, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Free Anti-Virus, and Kaspersky Small Office Security lies in the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to...

The vulnerability of the PAN-OS operating system, related to the lack of protection for mission-critical data, allows attackers to enhance their privileges.

The vulnerability of the PAN-OS operating system is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to increase their privileges...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect for Enterprise Resource Planning (CVE-2018-1890, CVE-2018-12547)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ which is used by IBM Spectrum Protect formerly Tivoli Storage Manager for Enterprise Resource Planning. These issues were disclosed as part of the IBM Java SDK updates in January 2019. Vulnerability Details CVEID:...

Security Bulletin: Password disclosure via application trace affects IBM Spectrum Protect for Enterprise Resource Planning (CVE-2018-1987)

Summary If tracing is activated, IBM Spectrum Protect formerly Tivoli Storage Manager for Enterprise Resource Planning may display the IBM Spectrum Protect node password in plain text in the trace file. Vulnerability Details CVEID: CVE-2018-1987 DESCRIPTION: IBM Tivoli Storage Manager for...

Security Bulletin: Spoofing and denial of service vulnerabilities in WebSphere Application Server Liberty affect IBM Spectrum Protect Client web user interface and IBM Spectrum Protect for Virtual Environments (CVE-2018-1902, CVE-2019-4046)

Summary Potential spoofing and denial of service vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Spectrum Protect formerly Tivoli Storage Manager Backup-Archive Client web user interface and IBM Spectrum Protect formerly Tivoli Storage Manager for Virtual Environments...

The vulnerabilities of Microsoft Exchange Server, Microsoft Lync and Skype for Business messaging programs, Microsoft Outlook and Outlook for iOS email clients, as well as Microsoft Office and Office 365 software packages, are related to the lack of protection for mission-critical data. This makes it possible for attackers to disclose protected information.

The vulnerabilities of Microsoft Exchange Server, Microsoft Lync and Skype for Business messaging applications, Microsoft Outlook and Outlook for iOS email clients, as well as Microsoft Office and Office 365 software packages are related to the lack of data protection measures. Exploiting these...

How to cost-effectively manage and secure a mobile ecosystem

Today’s post was written by Roxane Suau, Vice President of Marketing for Pradeo. In the corporate environment, mobile devices and applications are at the center of communications, enhancing collaborators’ productivity with 24/7 access to information. But at the same time, they represent thousands...

The vulnerability of the Yubico pam-u2f PAM module lies in the lack of protection for service data, allowing attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the Yubico pam-u2f PAM module is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

The vulnerability of the `check_request_for_cacheability` function in server software like HAProxy allows attackers to disclose protected information.

The vulnerability of the checkrequestforcacheability function in the HAProxy network software is related to the lack of protection for service data. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information through a remote request without authentication...

Marriott Hit With $123M Fine For Massive 2018 Data Breach

The U.K.’s privacy watchdog is hitting Marriott International with a $123 million £99 million penalty stemming from its 2018 data breach of more than 383 million guest records. The Tuesday fine is issued by the Information Commissioner’s Office ICO and comes only a day after the organization...

British Airways Fined £183 Million Under GDPR Over 2018 Data Breach

Britain's Information Commissioner's Office ICO today hit British Airways with a record fine of £183 million for failing to protect the personal information of around half a million of its customers during last year's security breach. British Airways, who describes itself as "The World's Favorite...

The vulnerability of the IBM Spectrum Protect server and data protection agent, related to buffer overflows in the stack, allows attackers to execute arbitrary code or cause failures in the server or data protection agent’s functionality.

The vulnerability of the IBM Spectrum Protect server and data protection agent is related to buffer overflows in the stack. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause failures in the server or data protection agent...

The vulnerability of the Strife NT information protection system driver, related to deficiencies in access control, allows unauthorized access to information about file system objects.

The vulnerability of the Data Protection System’s driver for unauthorized access is related to deficiencies in access control for attributes of file system objects. Exploiting this vulnerability allows an intruder, operating locally, to gain unauthorized access to information about file system...