Why PCI DSS 4.0 Should Be on Your Radar in 2023

Protecting customer data is critical for any business accepting online payment information. The Payment Card Industry Data Security Standard PCI DSS, created by leading credit card companies, establishes best practices for protecting consumers' information. By adhering to these standards,...

Code injection

In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAPBW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 810, a transaction code reserved for the customer is used. By implementing such transaction code, a malicious user may execute unauthorized...

CVE-2022-29839

CVE-2022-29839 concerns Western Digital My Cloud devices with Linux, prior to version 5.25.124. The issue is an Insufficiently Protected Credentials vulnerability in the remote backups application; if an attacker gains access to a relevant endpoint, they may use exposed credentials to access prot...

2023 Predictions: The Data Security Shake-up

The move to the cloud continues to create complexity around data security. In 2023, Imperva believes the increasingly diverse data landscape will drive a fundamental shift in the people, processes, and technology in cybersecurity. Imperva’s data security leaders explain how IT environments will...

Understanding NIST CSF to assess your organization's Ransomware readiness

Ransomware attacks keep increasing in volume and impact largely due to organizations' weak security controls. Mid-market companies are targeted as they possess a significant amount of valuable data but lack the level of protective controls and staffing of larger organizations. According to a rece...

The vulnerability of the video driver of microprogramming software in Qualcomm’s embedded chips allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of video drivers in microprogramming software for embedded chips from Qualcomm relates to the pointer shifting beyond the allocated memory space. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of...

7 Cyber Security Tips for SMBs

When the headlines focus on breaches of large enterprises like the Optus breach, it's easy for smaller businesses to think they're not a target for hackers. Surely, they're not worth the time or effort? Unfortunately, when it comes to cyber security, size doesn't matter. Assuming you're not a...

Out Of Bound Reads

freerdp is vulnerable to out-of-bound reads. The vulnerability exists due to attempting integer addition on too narrow types leads which allows an attacker read out of bound data and send it back to the server...

NETGEAR R7000P wan_dns1_pri Buffer Overflow Vulnerability

The NETGEAR R7000P is a wireless router from NETGEAR. A buffer overflow vulnerability exists in NETGEAR R7000P version V1.3.1.64, which originates from a lack of length validation of data entered in /usr/sbin/httpd for the wandns1pri parameter, and can be exploited by an attacker to cause a denia...

Wiz becomes the first CNAPP to deliver integrated Data Security Posture Management

Wiz expands its platform to proactively eliminate attack paths to discovered critical data...

Authorization

An API Endpoint used by Miele's "AppWash" MobileApp in all versions was vulnerable to an authorization bypass. A low privileged, remote attacker would have been able to gain read and partial write access to other users data by modifying a small part of a HTTP request sent to the API. Reading or...

CVE-2022-42893

A vulnerability has been identified in syngo Dynamics All versions VA40G HF01. syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application...

What are Dating Apps Doing to Protect Their Users?

A very public affair When asked about the pitfalls and problems behind using dating apps, users cite data security as one of the most worrying elements of online dating. Since the Ashley Madison breach in July 2015, online dating sites have repeatedly been under media scrutiny for the poor...

Huawei EulerOS: Security Advisory for samba (EulerOS-SA-2022-2743)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-27286 · Prestashop · Eu Cookie Law Gdpr

Name of the Vulnerable Software and Affected Versions: EU Cookie Law GDPR Banner + Blocker module for PrestaShop version 2.1.3 and earlier Description: The issue allows SQL Injection via a cookie, specifically lgcookieslaw or lglaw. This can potentially lead to unauthorized access to sensitive...

PT-2025-18505

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been resolved in the Linux kernel, specifically in the vmci host do receive datagram function. The issue is related to an information leak, where the struct vmci even...

TikTok Admits Staff in China Can Access Europeans’ Data

Plus: Liz Truss’ phone-hacking trouble, Cash App’s sex-trafficking problem, and the rising cost of ransomware...

The importance of combined user and data behavior analysis in anomaly detection

Muqeet Khan, Head of Sales Engineering Australia and New Zealand For decades security teams have understood the importance of tracking user behavior to identify potential cybersecurity threats. Behavior analysis systems first appeared in the early 2000s, and in 2015 Gartner officially defined Use...

CVE-2022-3781

Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior versions which allows database users to read the data. This issue affects : Remote...

CVE-2022-41636

CVE-2022-41636 affects Haas Controller v100.20.000.1110. The issue is that traffic for the Ethernet Q Commands service is transmitted in cleartext, enabling an attacker with access to the same network segment to obtain sensitive information passed to and from the controller. The NVD entry notes c...