Vulnerabilities / Threats

News & Commentary
Shadow IT, IaaS & the Security Imperative
Sanjay Kalra, Co-Founder & Chief Strategy Officer at LaceworkCommentary
Organizations must strengthen their security posture in cloud environments. That means considering five critical elements about their infrastructure, especially when it operates as an IaaS.
By Sanjay Kalra Co-Founder & Chief Strategy Officer at Lacework, 1/21/2019
Comment0 comments  |  Read  |  Post a Comment
2018's Most Common Vulnerabilities Include Issues New and Old
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
The most common vulnerabilities seen last year run the gamut from cross-site scripting to issues with CMS platforms.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 1/18/2019
Comment0 comments  |  Read  |  Post a Comment
VC Investments in Cybersecurity Hit Record Highs in 2018
Jai Vijayan, Freelance writerNews
But rate of funding appears unsustainable, according to Strategic Cyber Ventures.
By Jai Vijayan Freelance writer, 1/18/2019
Comment0 comments  |  Read  |  Post a Comment
GDPR Suit Filed Against Amazon, Apple
Dark Reading Staff, Quick Hits
An Austrian non-profit, led by privacy activist and attorney Max Schrems, has filed suit against 8 tech giants for non-compliance with the EU General Data Protection Regulation.
By Dark Reading Staff , 1/18/2019
Comment0 comments  |  Read  |  Post a Comment
PCI Council Releases New Software Framework for DevOps Era
Ericka Chickowski, Contributing Writer, Dark ReadingNews
The PCI Software Security Framework will eventually replace PCI DA-DSS when it expires in 2022.
By Ericka Chickowski Contributing Writer, Dark Reading, 1/18/2019
Comment0 comments  |  Read  |  Post a Comment
The Rx for HIPAA Compliance in the Cloud
Jason Polancich, CEO, MusubuCommentary
For medical entities, simply following HIPAA cloud service provider guidelines is no longer enough to ensure that your practice is protected from cyber threats, government investigations, and fines.
By Jason Polancich CEO, Musubu, 1/18/2019
Comment0 comments  |  Read  |  Post a Comment
Microsoft Launches New Azure DevOps Bug Bounty Program
Dark Reading Staff, Quick Hits
A new program will pay bounties of up to $20,000 for new critical bugs in the company's Azure DevOps systems and services.
By Dark Reading Staff , 1/17/2019
Comment0 comments  |  Read  |  Post a Comment
New Attacks Target Recent PHP Framework Vulnerability
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
Multiple threat actors are using relatively simple techniques to take advantage of the vulnerability, launching cryptominers, skimmers, and other malware payloads.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 1/17/2019
Comment0 comments  |  Read  |  Post a Comment
The Security Perimeter Is Dead; Long Live the New Endpoint Perimeter
Ofer Amitai, CEO, PortnoxCommentary
The network no longer provides an air gap against external threats, but access devices can take up the slack.
By Ofer Amitai CEO, Portnox, 1/17/2019
Comment5 comments  |  Read  |  Post a Comment
Simulating Lateral Attacks Through Email
Igal Gofman, Head of Security Research at XM CyberCommentary
A skilled attacker can get inside your company by abusing common email applications. Here are three strategies to block them.
By Igal Gofman Head of Security Research at XM Cyber, 1/17/2019
Comment0 comments  |  Read  |  Post a Comment
Malware Built to Hack Building Automation Systems
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Researchers dig into vulnerabilities in popular building automation systems, devices.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/16/2019
Comment1 Comment  |  Read  |  Post a Comment
Oklahoma Data Leak Compromises Years of FBI Data
Dark Reading Staff, Quick Hits
The Oklahoma Securities Commission accidentally leaked 3 TB of information, including data on years of FBI investigations.
By Dark Reading Staff , 1/16/2019
Comment0 comments  |  Read  |  Post a Comment
How the US Chooses Which Zero-Day Vulnerabilities to Stockpile
Ricardo Arroyo, Senior Technical Product Manager, Watchguard TechnologiesCommentary
When it comes to acceptable circumstances for government disclosure of zero-days, the new Vulnerabilities Equity Process might be the accountability practice security advocates have been waiting for.
By Ricardo Arroyo Senior Technical Product Manager, Watchguard Technologies, 1/16/2019
Comment1 Comment  |  Read  |  Post a Comment
Fortnite Players Compromised Via Epic Games Vulnerability
Kelly Sheridan, Staff Editor, Dark ReadingNews
Bugs in Epic Games' platform could let intruders take over players' accounts, view personal data, and/or buy in-game currency.
By Kelly Sheridan Staff Editor, Dark Reading, 1/16/2019
Comment1 Comment  |  Read  |  Post a Comment
Are You Listening to Your Kill Chain?
Ben Haley, SVP Engineering at HOPZERO SecurityCommentary
With the right tools and trained staff, any organization should be able to deal with threats before information is compromised.
By Ben Haley SVP Engineering at HOPZERO Security, 1/16/2019
Comment0 comments  |  Read  |  Post a Comment
Triton/Trisis Attack Was More Widespread Than Publicly Known
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Signs of the attack first showed up two months before it was identified as a cyberattack, but they were mistaken for a pure equipment failure by Schneider Electric, security expert reveals at S4x19.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/16/2019
Comment0 comments  |  Read  |  Post a Comment
Hijacking a PLC Using its Own Network Features
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Researcher at S4x19 to show how attackers can exploit the built-in advanced connectivity functions in some Rockwell PLCs.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 1/15/2019
Comment0 comments  |  Read  |  Post a Comment
Report: Bots Add Volume to Account Takeover Attacks
Dark Reading Staff, Quick Hits
Bots that can launch hundreds of attacks per second are making account takeover fraud more difficult to defend against.
By Dark Reading Staff , 1/15/2019
Comment1 Comment  |  Read  |  Post a Comment
Online Fraud: Now a Major Application Layer Security Problem
Ting-Fang Yen, Research Scientist, DataVisor, Inc.Commentary
The explosion of consumer-facing online services and applications is making it easier and cheaper for cybercriminals to host malicious content and launch attacks.
By Ting-Fang Yen Research Scientist, DataVisor, Inc., 1/15/2019
Comment0 comments  |  Read  |  Post a Comment
7 Privacy Mistakes That Keep Security Pros on Their Toes
Steve Zurier, Freelance Writer
When it comes to privacy, it's the little things that can lead to big mishaps.
By Steve Zurier Freelance Writer, 1/15/2019
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-10739
PUBLISHED: 2019-01-21
In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possib...
CVE-2019-6499
PUBLISHED: 2019-01-21
Teradata Viewpoint before 14.0 and 16.20.00.02-b80 contains a hardcoded password of TDv1i2e3w4 for the viewpoint database account (in viewpoint-portal\conf\server.xml) that could potentially be exploited by malicious users to compromise the affected system.
CVE-2019-6500
PUBLISHED: 2019-01-21
In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with %2e instead of '.' characters, as demonstrated by an initial /h2hdocumentation//%2e%2e/ substring.
CVE-2019-6498
PUBLISHED: 2019-01-21
GattLib 0.2 has a stack-based buffer over-read in gattlib_connect in dbus/gattlib.c because strncpy is misused.
CVE-2019-6497
PUBLISHED: 2019-01-20
Hotels_Server through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter.