Vulnerabilities / Threats //

Vulnerability Management

News & Commentary
How to Raise the Level of AppSec Competency in Your Organization
Sammy Migues, Principal Scientist, SynopsysCommentary
Improving processes won't happen overnight, but it's not complicated either.
By Sammy Migues Principal Scientist, Synopsys, 4/18/2019
Comment0 comments  |  Read  |  Post a Comment
Selecting the Right Strategy to Reduce Vulnerability Risk
Tim Erlin, VP of Product Management & Strategy at TripwireCommentary
There's no one-size-fits-all strategy for eliminating vulnerability risk. Knowing how your organization operates is what makes the difference.
By Tim Erlin VP of Product Management & Strategy at Tripwire, 4/17/2019
Comment0 comments  |  Read  |  Post a Comment
Benefiting from Data Privacy Investments
Marc Wilczek, Digital Strategist & CIO AdvisorCommentary
GDPR-ready companies experience lower overall costs associated with data breaches, research finds.
By Marc Wilczek Digital Strategist & CIO Advisor, 4/16/2019
Comment0 comments  |  Read  |  Post a Comment
New Attacks (and Old Attacks Made New)
Derek Manky, Global Security Strategist, FortinetCommentary
Although new attacks might get the most attention, don't assume old ones have gone away.
By Derek Manky Global Security Strategist, Fortinet, 4/16/2019
Comment0 comments  |  Read  |  Post a Comment
The Single Cybersecurity Question Every CISO Should Ask
Arif Kareem, CEO, ExtraHopCommentary
The answer can lead to a scalable enterprise security solution for years to come.
By Arif Kareem CEO, ExtraHop, 4/15/2019
Comment1 Comment  |  Read  |  Post a Comment
CERT, CISA Warn of Vuln in at Least 4 Major VPNs
Dark Reading Staff, Quick Hits
VPN products by Cisco, Palo Alto Networks, F5 Networks, Pulse Secure, insecurely store session cookies.
By Dark Reading Staff , 4/12/2019
Comment1 Comment  |  Read  |  Post a Comment
Cloudy with a Chance of Security Breach
Ronan David, Chief Marketing Officer and Vice President of Business Development for EfficientIPCommentary
Businesses must be aware of the security weaknesses of the public cloud and not assume that every angle is covered.
By Ronan David Chief Marketing Officer and Vice President of Business Development for EfficientIP, 4/12/2019
Comment0 comments  |  Read  |  Post a Comment
In Security, All Logs Are Not Created Equal
Joe Partlow, Chief Technology Officer, ReliaQuestCommentary
Prioritizing key log sources goes a long way toward effective incident response.
By Joe Partlow Chief Technology Officer, ReliaQuest, 4/11/2019
Comment0 comments  |  Read  |  Post a Comment
Merging Companies, Merging Clouds
Scott Totman, VP of Engineering, DivvyCloudCommentary
Integrating cloud environments is anything but easy. Evaluating the security risks in doing so must be a starting component of an overall M&A strategy.
By Scott Totman VP of Engineering, DivvyCloud, 4/10/2019
Comment0 comments  |  Read  |  Post a Comment
Safe Harbor Programs: Ensuring the Bounty Isn't on White Hat Hackers' Heads
Matt Honea, Director of Cyber, Guidewire SoftwareCommentary
As crowdsourced security-testing surges in popularity, companies need to implement safe harbor provisions to protect good-faith hackers -- and themselves.
By Matt Honea Director of Cyber, Guidewire Software, 4/10/2019
Comment0 comments  |  Read  |  Post a Comment
A New Approach to Application Security Testing
Manish Gupta, CEO of ShiftLeftCommentary
If the appsec industry were to develop a better AST solution from scratch, what would it look like?
By Manish Gupta CEO of ShiftLeft, 4/9/2019
Comment1 Comment  |  Read  |  Post a Comment
Stop Mocking & Start Enabling Emerging Technologies
Rick Holland, Chief Information Security Officer and Vice President of  Strategy at Digital ShadowsCommentary
Mocking new technology isn't productive and can lead to career disadvantage.
By Rick Holland Chief Information Security Officer and Vice President of Strategy at Digital Shadows, 4/9/2019
Comment0 comments  |  Read  |  Post a Comment
Credential-Stuffing Attacks Behind 30 Billion Login Attempts in 2018
Robert Lemos, Technology Journalist/Data ResearcherNews
Using e-mail addresses and passwords from compromised sites, attackers most often targeted retail sites, video-streaming services, and entertainment companies, according to Akamai.
By Robert Lemos , 4/8/2019
Comment1 Comment  |  Read  |  Post a Comment
Ignore the Insider Threat at Your Peril
Bryan Sartin, Executive Director, Global Security Services, at VerizonCommentary
Attacks from insiders often go undiscovered for months or years, so the potential impact can be huge. These 11 countermeasures can mitigate the damage.
By Bryan Sartin Executive Director, Global Security Services, at Verizon, 4/8/2019
Comment1 Comment  |  Read  |  Post a Comment
Third Parties in Spotlight as More Facebook Data Leaks
Robert Lemos, Technology Journalist/Data ResearcherNews
Two third-party services left Facebook user data exposed online -- in one case, 540 million records of user comments -- highlighting the ease with which third-party developers can access data and the risk of lax security.
By Robert Lemos , 4/4/2019
Comment1 Comment  |  Read  |  Post a Comment
3 Lessons Security Leaders Can Learn from Theranos
Chad Loeven, President of VMRay Inc.Commentary
Theranos flamed out in spectacular fashion, but you can still learn from the company's "worst practices."
By Chad Loeven President of VMRay Inc., 4/4/2019
Comment1 Comment  |  Read  |  Post a Comment
True Cybersecurity Means a Proactive Response
Liron Barak, CEO of BitDamCommentary
Successful, secure organizations must take an aggressive, pre-emptive posture if they want true data security.
By Liron Barak CEO of BitDam, 4/4/2019
Comment0 comments  |  Read  |  Post a Comment
Privacy & Regulatory Considerations in Enterprise Blockchain
Steve McNew, Senior Managing Director at FTI ConsultingCommentary
People who understand information governance, privacy, and security should be active participants on the distributed ledger technology implementation team to ensure success.
By Steve McNew Senior Managing Director at FTI Consulting, 4/3/2019
Comment0 comments  |  Read  |  Post a Comment
In Security, Programmers Aren't Perfect
Roselle Safran & Utpal Desai, President of Rosint Labs/Director of Product Management of BitdefenderCommentary
Software developers and their managers must change their perception of secure coding from being an optional feature to being a requirement that is factored into design from the beginning.
By Roselle Safran & Utpal Desai President of Rosint Labs/Director of Product Management of Bitdefender, 4/3/2019
Comment0 comments  |  Read  |  Post a Comment
In the Race Toward Mobile Banking, Don't Forget Risk Management
Sam Abadir, Vice President of Industry Solutions at LockpathCommentary
The rise of mobile banking and payment services has sparked widespread adoption, making a focus on risk essential.
By Sam Abadir Vice President of Industry Solutions at Lockpath, 4/1/2019
Comment2 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by brucewinters
Current Conversations What is the question?  :-)
In reply to: One Question?
Post Your Own Reply
More Conversations
Julian Assange Arrested in London
Dark Reading Staff 4/11/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
The Single Cybersecurity Question Every CISO Should Ask
Arif Kareem, CEO, ExtraHop,  4/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11320
PUBLISHED: 2019-04-18
In Motorola CX2 1.01 and M2 1.01, users can access the router's /priv_mgt.html web page to launch telnetd, as demonstrated by the 192.168.51.1 address.
CVE-2019-11321
PUBLISHED: 2019-04-18
An issue was discovered in Motorola CX2 1.01 and M2 1.01. The router opens TCP port 8010. Users can send hnap requests to this port without authentication to obtain information such as the MAC addresses of connected client devices.
CVE-2019-11322
PUBLISHED: 2019-04-18
An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function startRmtAssist in hnap, which leads to remote code execution via shell metacharacters in a JSON value.
CVE-2019-8999
PUBLISHED: 2019-04-18
An XML External Entity vulnerability in the UEM Core of BlackBerry UEM version(s) earlier than 12.10.1a could allow an attacker to potentially gain read access to files on any system reachable by the UEM service account.
CVE-2018-17168
PUBLISHED: 2019-04-18
PrinterOn Enterprise 4.1.4 contains multiple Cross Site Request Forgery (CSRF) vulnerabilities in the Administration page. For example, an administrator, by following a link, can be tricked into making unwanted changes to a printer (Disable, Approve, etc).