CVE-2022-27549

CVE-2022-27549 affects HCL Launch. The vulnerability is an information-disclosure issue where data for recurring activities may be stored in plain text, exposing sensitive information and impacting confidentiality. Reported in multiple sources (NVD entry and CNVD/CNNVD references), with CVSS metr...

TikTok Assures U.S. Lawmakers it's Working to Safeguard User Data From Chinese Staff

Following heightened worries that U.S. users' data had been accessed by TikTok engineers in China between September 2021 and January 2022, the company sought to assuage U.S. lawmakers that it's taking steps to "strengthen data security." The admission that some China-based employees can access...

4 breakthrough ideas for compliance and data security

Compliance management will never be easy, but there are ways to make it simpler and more transparent. Every year, organizations confront a growing volume and diversity of data and ever-evolving industry and government regulations. But the answer to more data, more devices, and more regulations...

Determining “Need to share vs. Need to know” is a Cornerstone of a Data Protection Strategy

There is a paradox that lies at the heart of data security. Data itself only has real value if an organization can share it with stakeholders that need it to perform their roles. However, the more widely an organization shares data the greater the risks of the data being compromised. Data securit...

MAL-2022-2338 Malicious code in data-mil-thor-ww1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8053d089451ed8507fbeeb5bab186384aa4650ed7d7b11facc30681356ae26ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Internet Safety Month: 7 tips for staying safe online while on vacation

Going on vacation has never been more talked about and anticipated. I mean—for many of us, its been a while. But before you get lost in dreamy thoughts of sun, sea, and sand, you might want to set aside some time to plan on how to keep your devices, and your data, safe while you are relaxing Your...

How to Password Protect Any File

Put a digital lock on your most important data...

CVE-2022-29948

CVE-2022-29948 affects Lepin EP-KP001 (KP001_V19) USB flash drive. The root cause is insecure hardware design allowing an attacker to bypass password authentication by replacing the device’s microcontroller with one controlled by the attacker, whose passcode is known. This enables unlocking the e...

Connected Healthcare: A Cybersecurity Battlefield We Must Win

Connected Healthcare: A Cybersecurity Battlefield We Must Win By Charles McFarland · June 6, 2022 We are commonly taught to prioritize the most critical, severe, or impactful tasks when trying to conquer a list of intimidating problems. Yet, how is this possible when presented with two tasks of...

The Cybersecurity CIA Triad: What You Need to Know as a WordPress Site Owner

One of the core concepts of cybersecurity is known as the CIA Triad. There are three pillars to the triad, with each pillar being designed to address an aspect of securing data. These three pillars are Confidentiality, Integrity, and Availability. The Confidentiality pillar is intended to prevent...

Twitter Fined $150 Million for Misusing Users' Data for Advertising Without Consent

Twitter, which is in the process of being acquired by Tesla CEO Elon Musk, has agreed to pay $150 million to the U.S. Federal Trade Commission FTC to settle allegations that it abused non-public information collected for security purposes to serve targeted ads. In addition to the monetary penalty...

CVE-2022-22127

Tableau Server (Local Identity Store) is affected by a broken access control vulnerability (CVE-2022-22127). A malicious site administrator can change passwords for users across different sites hosted on the same Tableau Server, enabling unauthorized access to data. Affected versions include 2020...

IBM InfoSphere BigInsights Invalid Input Vulnerability

Certain APIs within BigInsights can take invalid input that might allow attackers unauthorized access to read, write, modify, or delete data...

380K Kubernetes API Servers Exposed to Public Internet

More than 380,000 Kubernetes API servers allow some kind of access to the public internet, making the popular open-source container-orchestration engine for managing cloud deployments an easy target and broad attack surface for threat actors, researchers have found. The Shadowserver Foundation...

PT-2022-3332 · Mariadb +9 · Mariadb +10

Name of the Vulnerable Software and Affected Versions: MariaDB versions v10.2 through v10.6.1 Description: The issue is related to a buffer overflow in the Item subselect::init expr cache tracker function of the MariaDB database management system. This can be exploited by a remote attacker to...

SUSE-SU-2022:1717-1 Security update for nodejs10

This update for nodejs10 fixes the following issues: - CVE-2021-23343: Fixed ReDoS via splitDeviceRe, splitTailRe and splitPathRe bsc1192153. - CVE-2021-32803: Fixed insufficient symlink protection in node-tar allowing arbitrary file creation and overwrite bsc1191963. - CVE-2021-32804: Fixed...

GHSA-39VM-P9MR-4R27 Beaker Sensitive Information Disclosure vulnerability

Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors...

GHSA-4XW6-HJ5P-4J79 OpenStack Glance sensitive information disclosure via logs

OpenStack Image Registry and Delivery Service Glance 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading th...

[SECURITY] Fedora 34 Update: ecdsautils-0.4.1-1.fc34

This collection of ECDSA utilities can be used to sign and verify data in a simple manner...

CVE-2022-25762

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling...