Data Breach Lessons from the Trenches

In this webcast Threatpost editor Tom Spring examines the data breach epidemic with the help of noted breach hunter and cybersecurity expert Chris Vickery. He shares how companies can identify their own insecure data, remediate against a data breach and offers tips on protecting data against futu...

The vulnerability of the Dell EMC Avamar Server backup system and the DELL EMC Integrated Data Protection system arises from the failure to take measures to eliminate special elements used in the operating system command set, allowing attackers to execute arbitrary commands with root privileges.

The vulnerability of the Dell EMC Avamar Server backup system and the DELL EMC Integrated Data Protection system exists due to the lack of measures taken to neutralize special elements used in the operating system. Exploiting this vulnerability allows a malicious actor to execute arbitrary comman...

The vulnerability of the Dell EMC Avamar Server backup system and the DELL EMC Integrated Data Protection system lies in the lack of protection for operational data, allowing attackers to obtain the SSL/TLS connection private keys.

The vulnerability of the Dell EMC Avamar Server backup system and the DELL EMC Integrated Data Protection Appliance lies in the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor to obtain the SSL/TLS connection secrets...

The vulnerability of the Remote Logging component of the McAfee Agent antivirus software allows a hacker to disclose protected information.

The vulnerability of the Remote Logging component of the McAfee Agent antivirus software is related to the lack of protection for operational data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose the protected information...

IBM Security Guardium Code Issue Vulnerability

IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. A code issue vulnerability exists in IBM Security Guardium, which can ...

Spanish Soccer League App Spies on Fans

The Spanish Soccer League's smartphone app spies on fans in order to find bars that are illegally streaming its games. The app listens with the microphone for the broadcasts, and then uses geolocation to figure out where the phone is. The Spanish data protection agency has ordered the league to...

The vulnerability of the Windows Event Viewer component (eventvwr.msc) in the Windows operating system, which allows a malicious individual to read arbitrary files

The vulnerability of the Windows Event Viewer component eventvwr.msc in the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability allows an attacker to read arbitrary files using a specially created XML file...

The vulnerability of Intel microprogramming software relates to the lack of protection for system data, which allows attackers to disclose protected information.

The vulnerability of Intel microprogramming software is related to the lack of protection for system data. Exploiting this vulnerability can allow an attacker to disclose the protected information...

The vulnerability of the Windows GDI component of the Windows operating system, which allows a hacker to compromise sensitive information

The vulnerability of the Windows GDI component of the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information through a specially created document or web page...

The vulnerability of the Windows operating system’s kernel, which allows a hacker to disclose protected information

The vulnerability of the Windows operating system’s kernel is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information through a specially created file...

Facebook Faces Lawsuit Over Massive 2018 Data Breach

Facebook lost a key court ruling last week and now must face a lawsuit tied to a data breach of its platform disclosed in 2018, which impacted nearly 30 million of its users. The data breach, first disclosed by Facebook in September 2018, directly impacted the access tokens of 30 million accounts...

MongoDB 4.2 Introduces End-to-End Field Level Encryption for Databases

At its developer conference held earlier this week in New York, the MongoDB team announced the latest version of its database management software that includes a variety of advanced features, including Field Level Encryption, Distributed Transactions, and Wildcard Indexes. The newly introduced...

MongoDB 4.2 Introduces End-to-End Field Level Encryption for Databases

At its developer conference held earlier this week in New York, the MongoDB team announced the latest version of its database management software that includes a variety of advanced features, including Field Level Encryption, Distributed Transactions, and Wildcard Indexes. The newly introduced...

Design/Logic Flaw

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to access potentially sensitive system usage information. The vulnerability is due to a lack of proper data protection mechanisms. An attacker could...

CVE-2019-1631 Cisco Integrated Management Controller Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to access potentially sensitive system usage information. The vulnerability is due to a lack of proper data protection mechanisms. An attacker could...

Gain the Trust of Your Business Customers With SOC 2 Compliance

In today's business environment, data is what matters most. It matters to organizations that monetize it into operational insights and optimisations, and it matters the threat actors that relentlessly seek to achieve similar monetisation by compromising it. In the very common scenario in which...

Cisco Integrated Management Controller Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to access potentially sensitive system usage information. The vulnerability is due to a lack of proper data protection mechanisms. An attacker could...

Maciej Cegłowski on Privacy in the Information Age

Maciej Cegłowski has a really good essay explaining how to think about privacy today: For the purposes of this essay, I'll call it "ambient privacy" -- the understanding that there is value in having our everyday interactions with one another remain outside the reach of monitoring, and that the...

The vulnerability of the Windows GDI component of the Windows operating system, which allows a hacker to compromise sensitive information

The vulnerability of the Windows GDI component of the Windows operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information through a specially created document...

CVE-2019-4162

IBM Security Information Queue (ISIQ) versions 1.0.0–1.0.2 are affected by missing HTTP Strict Transport Security (HSTS) headers, enabling potential exposure where users may navigate to an unencrypted version of the web app or accept invalid TLS certificates. The issue stems from ISIQ not enforci...