Vulnerabilities / Threats // Vulnerability Management
News & Commentary
Dark Reading News Desk Coming Back To Black Hat, Live
Sara Peters, Senior Editor at Dark ReadingNews
Live from Las Vegas: 40 video interviews with Black Hat USA conference speakers and sponsors. Wednesday Aug. 3, Thursday Aug, 4, 2 p.m. - 6:10 p.m. ET.
By Sara Peters Senior Editor at Dark Reading, 7/27/2016
Comment0 comments  |  Read  |  Post a Comment
Auto Industry ISAC Releases Best Practices For Connected Vehicle Cybersecurity
Jai Vijayan, Freelance writerNews
Goal is to provide car manufactures with guidelines for protecting modern vehicles against emerging cyber threats
By Jai Vijayan Freelance writer, 7/21/2016
Comment0 comments  |  Read  |  Post a Comment
National Governors Association Seeks Higher Profile on Cybersecurity
Steve Zurier, Freelance WriterNews
NGA’s new chairman Virginia Gov. Terry McAuliffe says states can play a pivotal role in cybersecurity, including emergency response, workforce development and protecting health care data.
By Steve Zurier Freelance Writer, 7/20/2016
Comment0 comments  |  Read  |  Post a Comment
Meet The Teams In DARPA's All-Machine Hacking Tournament
Steve Zurier, Freelance Writer
"Autonomous security" is DARPA's latest game. Its Cyber Grand Challenge will culminate at DEF CON with a contest to see which of these seven finalists' machines will automatically detect and remediate the most security vulnerabilities.
By Steve Zurier Freelance Writer, 7/15/2016
Comment1 Comment  |  Read  |  Post a Comment
Context-Rich And Context-Aware Cybersecurity
Ned Miller, Intel Security, Chief Technology Strategist for Public Sector
An adaptive threat-prevention model is quickly replacing traditional, unintegrated architectures as security teams work to achieve a sustainable advantage against complex threats.
By Ned Miller Intel Security, Chief Technology Strategist for Public Sector, 7/14/2016
Comment1 Comment  |  Read  |  Post a Comment
Purple Teaming: Red & Blue Living Together, Mass Hysteria
Sara Peters, Senior Editor at Dark ReadingNews
When you set focused objectives for the red team, you get your blue team to work the weak muscles they need trained most.
By Sara Peters Senior Editor at Dark Reading, 7/13/2016
Comment1 Comment  |  Read  |  Post a Comment
Adobe Fixes 52 Vulnerabilities In Flash
Dark Reading Staff, Quick Hits
Updated version fixes CVEs that allowed remote code execution on affected machines.
By Dark Reading Staff , 7/13/2016
Comment0 comments  |  Read  |  Post a Comment
Fiat Chrysler Launches Bug Bounty Program
Dark Reading Staff, Quick Hits
Platform will be leveraged to identify and resolve security issues in automobile software.
By Dark Reading Staff , 7/13/2016
Comment0 comments  |  Read  |  Post a Comment
What I Expect to See At Black Hat 2016: 5 Themes
Chris Wysopal, CTO, CISO and co-founder, VeracodeCommentary
Over the years, Black Hat has morphed from a little show for security researchers to a big conference that attracts everyone from black-hat hackers to C-level security execs. Here’s what piques my interest this year.
By Chris Wysopal CTO, CISO and co-founder, Veracode, 7/13/2016
Comment1 Comment  |  Read  |  Post a Comment
Profiles Of The Top 7 Bug Hunters From Around the Globe
Sean Martin, CISSP | President, imsmartin
'Super hunters' share a common goal: to find the most high impact valid bugs before a bad guy does.
By Sean Martin CISSP | President, imsmartin, 7/12/2016
Comment0 comments  |  Read  |  Post a Comment
5 Ways To Think Like A Hacker
Steve Zurier, Freelance Writer
Security expert says CISOs need to use simulations more effectively so they can understand how hackers work and beat them at their own game.
By Steve Zurier Freelance Writer, 6/24/2016
Comment0 comments  |  Read  |  Post a Comment
‘Bug Poachers:’ A New Breed of Cybercriminal
Chris Wysopal, CTO, CISO and co-founder, VeracodeCommentary
As if security researchers don’t have enough to worry about, we now have to contend with extortionists who take advantage of the well-established fact that applications are a ripe target for exploitation.
By Chris Wysopal CTO, CISO and co-founder, Veracode, 6/22/2016
Comment0 comments  |  Read  |  Post a Comment
Singapore To Cut Internet Access For Government Computers
Dark Reading Staff, Quick Hits
To counter cyberattacks, 100,000 computers will be taken offline next May.
By Dark Reading Staff , 6/10/2016
Comment0 comments  |  Read  |  Post a Comment
Zcrypt Ransomware: Old Wine In A New Bottle
Jai Vijayan, Freelance writerNews
Malware authors have combined old and new approaches to try and sneak Zcrypt past defenses, Check Point says.
By Jai Vijayan Freelance writer, 6/8/2016
Comment0 comments  |  Read  |  Post a Comment
‘Super Hunters’ Emerge As More Companies Adopt Bug Bounties
Rutrell Yasin, Business Technology Writer, Tech Writers BureauNews
'Super hunters' chase down vulnerabilities wherever there's a bug bounty payday...and they've become very popular with cybersecurity job recruiters, says Bugcrowd report.
By Rutrell Yasin Business Technology Writer, Tech Writers Bureau, 6/8/2016
Comment0 comments  |  Read  |  Post a Comment
Enterprises Still Don't Base Vuln Remediation On Risk
Ericka Chickowski, Contributing Writer, Dark ReadingNews
New White Hat study shows critical vulnerabilities aren't fixed any faster than other security flaws.
By Ericka Chickowski Contributing Writer, Dark Reading, 6/7/2016
Comment1 Comment  |  Read  |  Post a Comment
Top Security To-Dos For The Entertainment Industry
Sara Peters, Senior Editor at Dark ReadingNews
'The biz' has unique security needs. And it isn't only about preventing 'the next Sony.'
By Sara Peters Senior Editor at Dark Reading, 6/6/2016
Comment1 Comment  |  Read  |  Post a Comment
SWIFT Proposes New Measures For Bolstering Its Security
Jai Vijayan, Freelance writerNews
Measures come amid news that up to 12 banks may have fallen victim to attacks attempting to steal millions via the SWIFT network.
By Jai Vijayan Freelance writer, 5/27/2016
Comment5 comments  |  Read  |  Post a Comment
GSA May Offer Bug Bounty Program For Federal Agencies
Jai Vijayan, Freelance writerNews
Researchers will be eligible for bounties of up to $3,500 for discovering bugs in federal agency systems.
By Jai Vijayan Freelance writer, 5/24/2016
Comment0 comments  |  Read  |  Post a Comment
Cyber Security A Major Risk To US Financial System: SEC Chief
Dark Reading Staff, Quick Hits
Mary Jo White believes that despite preparedness, procedures in place to fight cyberattacks are inadequate.
By Dark Reading Staff , 5/20/2016
Comment1 Comment  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Why else would HR ask me if I have a handicap?"
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.