Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

News & Commentary
1.2B Records Exposed in Massive Server Leak
Dark Reading Staff, Quick Hits
A single server leaked 4 terabytes of personal data, including social media profiles, work histories, and home and mobile phone numbers.
By Dark Reading Staff , 11/22/2019
Comment0 comments  |  Read  |  Post a Comment
Government Agency Partners on New Tool for Election Security
Dark Reading Staff, Quick Hits
The Cybersecurity and Infrastructure Security Agency has partnered with VotingWorks on an open source tool to aid election result audits.
By Dark Reading Staff , 11/21/2019
Comment0 comments  |  Read  |  Post a Comment
Google Increases Top Android Hacking Prize to $1M
Dark Reading Staff, Quick Hits
Google expands its Android Security Rewards program and multiplies its top cash prize from $200,000 to $1 million.
By Dark Reading Staff , 11/21/2019
Comment0 comments  |  Read  |  Post a Comment
Patch 'Easily Exploitable' Oracle EBS Flaws ASAP: Onapsis
Robert Lemos, Contributing WriterNews
Organizations that have not yet applied a pair of months-old critical patches from Oracle for E-Business Suite are at risk of attacks on their financial systems, the application security firm says.
By Robert Lemos Contributing Writer, 11/20/2019
Comment0 comments  |  Read  |  Post a Comment
Google Cloud Update Gives Users Greater Data Control
Dark Reading Staff, Quick Hits
External Key Manager and Key Access Justification are intended to give organizations greater visibility into requests for data access.
By Dark Reading Staff , 11/20/2019
Comment0 comments  |  Read  |  Post a Comment
Employee Privacy in a Mobile Workplace
Michael J. Covington, Vice President of Product Strategy at WanderaCommentary
Why businesses need guidelines for managing their employees' personal information -- without compromising on security.
By Michael J. Covington Vice President of Product Strategy at Wandera, 11/20/2019
Comment0 comments  |  Read  |  Post a Comment
Vulnerability Could Give Criminals Camera Control on Millions of Android Smartphones
Dark Reading Staff, Quick Hits
Unauthorized activities could be triggered even if a phone is locked, its screen is turned off, or a person is in the middle of a call.
By Dark Reading Staff , 11/20/2019
Comment0 comments  |  Read  |  Post a Comment
DDoS Attacks Up Sharply in Third Quarter of 2019
Dark Reading Staff, Quick Hits
DDoS attacks of all sorts were up by triple-digit percentages, with smaller volume attacks growing most rapidly.
By Dark Reading Staff , 11/19/2019
Comment0 comments  |  Read  |  Post a Comment
TPM-Fail: What It Means & What to Do About It
Ari Singer, CTO at TrustPhiCommentary
Trusted Platform Modules are well-suited to a wide range of applications, but for the strongest security, architect them into "defense-in-depth" designs.
By Ari Singer CTO at TrustPhi, 11/19/2019
Comment1 Comment  |  Read  |  Post a Comment
Magecart Hits Macy's: Retailer Discloses Data Breach
Dark Reading Staff, Quick Hits
The retail giant discovered malicious code designed to capture customer data planted on its payment page.
By Dark Reading Staff , 11/19/2019
Comment0 comments  |  Read  |  Post a Comment
Disney+ Credentials Land in Dark Web Hours After Service Launch
Dark Reading Staff, Quick Hits
The credentials, priced from free to $11 per account, appear to be due to victims' re-use of logins and passwords.
By Dark Reading Staff , 11/18/2019
Comment1 Comment  |  Read  |  Post a Comment
Windows Hello for Business Opens Door to New Attack Vectors
Kelly Sheridan, Staff Editor, Dark ReadingNews
Researchers exploring Windows Hello for Business found an Active Directory backdoor and other attack vectors that could lead to privilege escalation.
By Kelly Sheridan Staff Editor, Dark Reading, 11/18/2019
Comment0 comments  |  Read  |  Post a Comment
Facebook Discloses WhatsApp MP4 Video Vulnerability
Dark Reading Staff, Quick Hits
A stack-based buffer overflow bug can be exploited by sending a specially crafted video file to a WhatsApp user.
By Dark Reading Staff , 11/18/2019
Comment0 comments  |  Read  |  Post a Comment
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing WriterNews
Based on penetration tests and vulnerability assessments, attackers' costs to compromise a company's network increases significantly when security is continuously tested, a report finds.
By Robert Lemos Contributing Writer, 11/15/2019
Comment1 Comment  |  Read  |  Post a Comment
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at NetskopeCommentary
There's a skills and resources gap industrywide, but a DevSecOps approach can go a long way toward closing that gap.
By Lamont Orange Chief Information Security Officer at Netskope, 11/15/2019
Comment3 comments  |  Read  |  Post a Comment
BSIMM10 Shows Industry Vertical Maturity
Sammy Migues, BSIMM Co-Author and Principal Scientist at SynopsysCommentary
The Building Security In Maturity Model is the only detailed measuring stick for software security initiatives, and it continues to evolve.
By Sammy Migues BSIMM Co-Author and Principal Scientist at Synopsys, 11/14/2019
Comment0 comments  |  Read  |  Post a Comment
Microsoft Patches IE Zero-Day Among 74 Vulnerabilities
Kelly Sheridan, Staff Editor, Dark ReadingNews
The November Patch Tuesday update fixed 13 critical flaws, including a zero-day bug in Internet Explorer.
By Kelly Sheridan Staff Editor, Dark Reading, 11/12/2019
Comment0 comments  |  Read  |  Post a Comment
Researchers Find New Approach to Attacking Cloud Infrastructure
Kelly Sheridan, Staff Editor, Dark ReadingNews
Cloud APIs' accessibility over the Internet opens a new window for adversaries to gain highly privileged access to cloud assets.
By Kelly Sheridan Staff Editor, Dark Reading, 11/11/2019
Comment1 Comment  |  Read  |  Post a Comment
OpenText to Buy Carbonite for $800M Cash in $1.42B Deal
Dark Reading Staff, Quick Hits
The acquisition was confirmed just six months after Carbonite bought Webroot.
By Dark Reading Staff , 11/11/2019
Comment0 comments  |  Read  |  Post a Comment
Joker's Stash Puts $130M Price Tag on Credit Card Database
Dark Reading Staff, Quick Hits
A new analysis advises security teams on what they should know about the underground payment card seller.
By Dark Reading Staff , 11/11/2019
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by KhalilMills
Current Conversations Thank Pro
In reply to: thank so much
Post Your Own Reply
Posted by robertmbaker
Current Conversations hi
In reply to: thank pro
Post Your Own Reply
Posted by ronaldjeichner
Current Conversations thank so much
In reply to: thank pro
Post Your Own Reply
Posted by TerryWilliams
Current Conversations very useful information
In reply to: thanks
Post Your Own Reply
Posted by charlesemorris
Current Conversations wow
In reply to: Re: thank for somuch
Post Your Own Reply
Posted by debrajohansen
Current Conversations thanks
In reply to: thanks
Post Your Own Reply
More Conversations
PR Newswire
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
6 Top Nontechnical Degrees for Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/21/2019
Anatomy of a BEC Scam
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11287
PUBLISHED: 2019-11-23
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header ca...
CVE-2019-11291
PUBLISHED: 2019-11-22
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user w...
CVE-2019-15593
PUBLISHED: 2019-11-22
GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service attack in Issue Comments.
CVE-2019-16285
PUBLISHED: 2019-11-22
If a local user has been configured and logged in, an unauthenticated attacker with physical access may be able to extract sensitive information onto a local drive.
CVE-2019-16286
PUBLISHED: 2019-11-22
An attacker may be able to bypass the OS application filter meant to restrict applications that can be executed by changing browser preferences to launch a separate process that in turn can execute arbitrary commands.