Release Information for Veeam Availability for Nutanix AHV 1.0 Update 3

Challenge Release Notes for Veeam Availability for Nutanix AHV 1.0 Update 3. This update supersedes Veeam Availability for Nutanix AHV 1.0 Update 2. Solution Veeam Availability for Nutanix AHV 1.0 Update 3 includes improvements and fixes for series of issues. The most critical ones are listed...

CVE-2019-0231

Handling of the closenotify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This...

Apple Changes the Way It Listens to Your Siri Recordings Following Privacy Concerns

Apple today announced some major changes to its controversial 'Siri audio grading program' following criticism for employing humans to listen to audio recordings of users collected via its voice-controlled Siri personal assistant without their knowledge or consent. The move came a month after The...

Apple Suspends Siri Program After Privacy Backlash

Apple is suspending a program that lets contractors listen in on Siri voice recordings after facing a rain of backlash regarding the privacy implications of the program. The suspension comes after a report in The Guardian last week outlining how contractors regularly listen to intimate voice...

Design/Logic Flaw

In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts SEC-393...

iMessage - NSArray Deserialization can Invoke Subclass that does not Retain References Exploit

When deserializing a class with initWithCoder, subclasses of that class can also be deserialized so long as they do not override initWithCoder and implement all methods that require a concrete implementation. PFArray is such a subclass of NSArray. When a PFArray is deserialized, it is deserialize...

Amazon Alexa, Google Home Are On a Collision Course With Regulation

Voice assistants are growing rapidly in popularity — but at the same time, the privacy concerns and security issues with popular home assistant devices like Amazon Echo and Google Home are peaking too. Earlier in July, Amazon came under fire after acknowledging that it retains the voice recording...

Google Home Captures Porn and More, Unbeknownst to Users

Google Home smart speakers and the Google Assistant virtual assistant have been caught eavesdropping without permission — capturing and recording highly personal audio of domestic violence, confidential business calls — and even some users asking their smart speakers to play porn on their connect...

CVE-2019-0325

SAP ERP HCM SAPHRCES , version 3, does not perform necessary authorization checks for a report that reads payroll data of employees in a certain area. Due to this under certain conditions, the user that once had authorization to payroll data of an employee, which was later revoked, may retain...

GHSA-4XCV-9JJX-GFJ3 Denial of Service in mem

Versions of mem prior to 4.0.0 are vulnerable to Denial of Service DoS. The package fails to remove old values from the cache even after a value passes its maxAge property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging. Recommendation...

Amazon Admits Alexa Voice Recordings Saved Indefinitely

Amazon has acknowledged that it retains the voice recordings and transcripts of customers’ interactions with its Alexa voice assistant indefinitely. The admission raises questions about how long companies should be able to save highly-personal data collected from voice assistant devices. After U....

How to Limit How Long Google Keeps Your Data

Google has a new feature that lets you delete your web and app activity after three months. Here's how to use it...

Moderate: Red Hat Security Advisory: openstack-cinder security and bug fix update

An update for openstack-cinder is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2019-7155

An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It has Incorrect Access Control. A user retains their role within a project in a private group after being removed from the group, if their...

Ex-NSA Contractor Pleads Guilty to 20-Year-Long Theft of Classified Data

A former National Security Agency contractor—who stole an enormous amount of sensitive information from the agency and then stored it at his home and car for over two decades—today changed his plea to guilty. The theft was labeled as the largest heist of classified government material in America'...

How Our Threat Analytics Multi-Region Data Lake on AWS Stores More, Slashes Costs

Data is the lifeblood of digital businesses, and a key competitive advantage. The question is: how can you store your data cost-efficiently, access it quickly, while abiding by privacy laws? At Imperva, we wanted to store our data for long-term access. Databases would’ve cost too much in disk and...

RSAC 2019: 58% of Orgs Have Unfilled Cyber Positions

SAN FRANCISCO – Much has been made of the cybersecurity workforce gap, and it appears to be a persistent issue: A full 69 percent of respondents in a recent survey said that they have cybersecurity teams that are understaffed. According to ISACA’s State of Cybersecurity 2019 survey, released at t...

Kanboard 1.2.7 Code Execution / Cross Site Request Forgery Vulnerabilities

Kanboard version 1.2.7 contains multiple vulnerabilities. The vulnerabilities include CSV account import cross site request forgery which allows an unauthenticated attacker to create a new administrative user. Cross site request forgery 2FA deactivation, allowing an unauthenticated attacker to...

5 Questions to Ask About Your Security People in a World Saturated by Security Tools

Definition of tool - 1a: a handheld device that aids in accomplishing a task b1: the cutting or shaping part in a machine or machine tool 2: a machine for shaping metal : MACHINE TOOL 2a: something such as an instrument or apparatus used in performing an operation or necessary in the practice of ...

Qualys Cloud Platform (VM, PC) 8.16 New Features

This new release of the Qualys Cloud Platform VM, PC, version 8.16, contains several new improvements in Qualys Vulnerability Management and Qualys Policy Compliance, which includes new password security option, increased limit for virtual hosts that can be added to a subscription, added support...