Application Security

News & Commentary
Businesses Manage 9.7PB of Data but Struggle to Protect It
Kelly Sheridan, Staff Editor, Dark ReadingNews
What's more, their attempts to secure it may be putting information at risk, a new report finds.
By Kelly Sheridan Staff Editor, Dark Reading, 3/21/2019
Comment0 comments  |  Read  |  Post a Comment
Facebook Employees for Years Could See Millions of User Passwords in Plain Text
Dark Reading Staff, Quick Hits
2,000 Facebook engineers or developers reportedly made some nine million internal queries for data elements with plain text passwords.
By Dark Reading Staff , 3/21/2019
Comment3 comments  |  Read  |  Post a Comment
Google Photos Bug Let Criminals Query Friends, Location
Kelly Sheridan, Staff Editor, Dark ReadingNews
The vulnerability, now patched, let attackers query where, when, and with whom victims' photos were taken.
By Kelly Sheridan Staff Editor, Dark Reading, 3/20/2019
Comment0 comments  |  Read  |  Post a Comment
'Critical' Denial-of-Service Bug Patched in Facebook Fizz
Dark Reading Staff, Quick Hits
Researchers report a now-patched DoS vulnerability in Facebook Fizz, its open source implementation of the TLS protocol.
By Dark Reading Staff , 3/20/2019
Comment1 Comment  |  Read  |  Post a Comment
6 Ways Mature DevOps Teams Are Killing It in Security
Ericka Chickowski, Contributing Writer, Dark Reading
New survey shows where "elite" DevOps organizations are better able to incorporate security into application security.
By Ericka Chickowski Contributing Writer, Dark Reading, 3/19/2019
Comment0 comments  |  Read  |  Post a Comment
7 Low-Cost Security Tools
Curtis Franklin Jr., Senior Editor at Dark Reading
Security hardware doesn't have to be expensive or complex to do the job. Here are seven examples of low-cost hardware that could fill a need in your security operations.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 3/15/2019
Comment0 comments  |  Read  |  Post a Comment
US Prosecutors Investigate Facebook's Data-Sharing Deals
Dark Reading Staff, Quick Hits
The news follows a long, tumultuous period of scandal around Facebook and its privacy practices.
By Dark Reading Staff , 3/14/2019
Comment0 comments  |  Read  |  Post a Comment
'SimBad': Android Adware Hits 210 Apps with 150M Downloads
Dark Reading Staff, Quick Hits
Google has removed infected applications from the Google Play store after a form of adware potentially affected millions of users.
By Dark Reading Staff , 3/13/2019
Comment1 Comment  |  Read  |  Post a Comment
The Case for Transparency in End-User License Agreements
Lysa Myers, Security Researcher, ESETCommentary
Why it behooves technology companies to consider EULAs as an opportunity to accurately inform customers about privacy issues and other important information.
By Lysa Myers Security Researcher, ESET, 3/13/2019
Comment0 comments  |  Read  |  Post a Comment
There May Be a Ceiling on Vulnerability Remediation
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
Most organizations are doing all they can to keep up with the release of vulnerabilities, new research shows.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 3/12/2019
Comment0 comments  |  Read  |  Post a Comment
Citrix Breach Underscores Password Perils
Robert Lemos, Technology Journalist/Data ResearcherNews
Attackers used a short list of passwords to knock on every digital door to find vulnerable systems in the vendor's network.
By Robert Lemos Technology Journalist/Data Researcher, 3/12/2019
Comment1 Comment  |  Read  |  Post a Comment
Microsoft Patch Tuesday: 64 Vulnerabilities Patched, 2 Under Attack
Kelly Sheridan, Staff Editor, Dark ReadingNews
Seventeen vulnerabilities patches today are rated critical, four are publicly known, and two have been exploited in the wild.
By Kelly Sheridan Staff Editor, Dark Reading, 3/12/2019
Comment0 comments  |  Read  |  Post a Comment
How the Best DevSecOps Teams Make Risk Visible to Developers
Ericka Chickowski, Contributing Writer, Dark ReadingNews
DevOps-minded CISOs say enterprise security teams need to do a better job scoring and visualizing risk for developers and business executives.
By Ericka Chickowski Contributing Writer, Dark Reading, 3/12/2019
Comment1 Comment  |  Read  |  Post a Comment
5 Essentials for Securing and Managing Windows 10
Josh Mayfield, Director of Security Strategy at AbsoluteCommentary
It's possible to intelligently deploy and utilize Windows 10's many security enhancements while avoiding common and costly migration pitfalls.
By Josh Mayfield Director of Security Strategy at Absolute, 3/12/2019
Comment0 comments  |  Read  |  Post a Comment
763M Email Addresses Exposed in Latest Database Misconfiguration Episode
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
MongoDB once again used by database admin who opens unencrypted database to the whole world.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 3/11/2019
Comment1 Comment  |  Read  |  Post a Comment
Hackers Break into System That Houses College Application Data
Dark Reading Staff, Quick Hits
More than 900 colleges and universities use Slate, owned by Technolutions, to collect and manage information on applicants.
By Dark Reading Staff , 3/11/2019
Comment4 comments  |  Read  |  Post a Comment
Citrix Hacked by 'International Cybercriminals'
Dark Reading Staff, Quick Hits
FBI informed Citrix this week of a data breach that appears to have begun with a 'password spraying' attack to steal weak credentials to access the company's network.
By Dark Reading Staff , 3/8/2019
Comment0 comments  |  Read  |  Post a Comment
Debunking 5 Myths About Zero Trust Security
Torsten George, Cybersecurity Evangelist at CentrifyCommentary
Rather than "trust but verify," a zero trust model assumes that attackers will inevitably get in if they aren't already. However, several misconceptions are impeding its adoption.
By Torsten George Cybersecurity Evangelist at Centrify, 3/7/2019
Comment0 comments  |  Read  |  Post a Comment
4 Ways At-Work Apps Are Vulnerable to Attack
Yoram Salinger, CEO of Perception PointCommentary
Collaboration applications make users and IT teams more efficient. But they come with an added cost: security.
By Yoram Salinger CEO of Perception Point, 3/7/2019
Comment3 comments  |  Read  |  Post a Comment
Code42: Data Loss Protection is the New DLP
Dark Reading Staff, CommentaryVideo
Data loss protection helps companies get more proactive than data loss prevention and will help customers in an era of Big Data, says Vijay Ramanathan of Code 42. Data loss protection helps with both time to awareness and time to response; its reliance on automation also means greater volumes of data can be managed.
By Dark Reading Staff , 3/7/2019
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Well, at least it isn't Mobby Dick!
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-10743
PUBLISHED: 2019-03-23
hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.
CVE-2019-9947
PUBLISHED: 2019-03-23
An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.2. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the query string or PATH_INFO) follo...
CVE-2019-9948
PUBLISHED: 2019-03-23
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
CVE-2019-9945
PUBLISHED: 2019-03-23
SoftNAS Cloud 4.2.0 and 4.2.1 allows remote command execution. The NGINX default configuration file has a check to verify the status of a user cookie. If not set, a user is redirected to the login page. An arbitrary value can be provided for this cookie to access the web interface without valid user...
CVE-2019-9942
PUBLISHED: 2019-03-23
A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the __toString() method on an object even if not allowed by the security policy in place.