Application Security

News & Commentary
Veracode: 75% Of Apps Have at Least One Vulnerability on Initial Scan
Jai Vijayan, Freelance writerNews
But developers not the only ones to blame, company says.
By Jai Vijayan Freelance writer, 10/20/2017
Comment0 comments  |  Read  |  Post a Comment
Oracle Fixes 20 Remotely Exploitable Java SE Vulns
Jai Vijayan, Freelance writerNews
Quarterly update for October is the smallest of the year: only 252 flaws to fix! Oracle advises to apply patches 'without delay.'
By Jai Vijayan Freelance writer, 10/18/2017
Comment0 comments  |  Read  |  Post a Comment
What's Next After HTTPS: A Fully Encrypted Web?
Guy Podjarny, CEO & Cofounder, SnykCommentary
As the rate of HTTPS adoption grows faster by the day, it's only a matter of time before a majority of websites turn on SSL. Here's why.
By Guy Podjarny CEO & Cofounder, Snyk, 10/18/2017
Comment0 comments  |  Read  |  Post a Comment
Reuters: Microsoft's 2013 Breach Hit Bug Repository, Insiders Say
Dark Reading Staff, Quick Hits
Five anonymous former Microsoft employees tell Reuters that Microsoft's database of internally discovered vulnerabilities was compromised in 2013, but Microsoft will not confirm it occurred.
By Dark Reading Staff , 10/17/2017
Comment0 comments  |  Read  |  Post a Comment
Adobe Patches Flash ZeroDay Used To Plant Surveillance Software
Dark Reading Staff, Quick Hits
Second time in four weeks FINSPY "lawful intercept" tool and a zero-day found together.
By Dark Reading Staff , 10/16/2017
Comment0 comments  |  Read  |  Post a Comment
GDPR Compliance: 5 Early Steps to Get Laggards Going
Sara Peters, Senior Editor at Dark Reading
If you're just getting on the EU General Data Protection Regulation bandwagon, here's where you should begin.
By Sara Peters Senior Editor at Dark Reading, 10/16/2017
Comment1 Comment  |  Read  |  Post a Comment
Equifax: 12.5 Million UK Client Records Exposed in Breach
Dark Reading Staff, Quick Hits
But of that data, it affects 700K of British consumers, credit-monitoring company said today.
By Dark Reading Staff , 10/10/2017
Comment0 comments  |  Read  |  Post a Comment
Unstructured Data: The Threat You Cannot See
Charles Fullwood, Software Practice Director at Force 3Commentary
Why security teams needs to take a cognitive approach to the increasing volumes of data flowing from sources they don't control.
By Charles Fullwood Software Practice Director at Force 3, 10/10/2017
Comment0 comments  |  Read  |  Post a Comment
Artificial Intelligence: Experts Talk Ethical, Security Concerns
Kelly Sheridan, Associate Editor, Dark ReadingNews
Global leaders weigh the benefits and dangers of a future in which AI plays a greater role in business and security strategy.
By Kelly Sheridan Associate Editor, Dark Reading, 10/10/2017
Comment0 comments  |  Read  |  Post a Comment
Russian Hackers Pilfered Data from NSA Contractor's Home Computer: Report
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
Classified information and hacking tools from the US National Security Agency landed in the hands of Russian cyberspies, according to a Wall Street Journal report.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 10/5/2017
Comment14 comments  |  Read  |  Post a Comment
Private, Public, or Hybrid? Finding the Right Fit in a Bug Bounty Program
Jason Haddix, Head of Trust & Security, BugcrowdCommentary
How can a bug bounty not be a bug bounty? There are several reasons. Here's why you need to understand the differences.
By Jason Haddix Head of Trust & Security, Bugcrowd, 10/5/2017
Comment1 Comment  |  Read  |  Post a Comment
What Security Teams Need to Know about the NIAC Report
Mike Shultz, CEO of CybernanceCommentary
Which of the recommendations made by the NIAC working group will affect security teams the most, and how should they prepare?
By Mike Shultz CEO of Cybernance, 10/4/2017
Comment0 comments  |  Read  |  Post a Comment
Ransomware Will Target Backups: 4 Ways to Protect Your Data
Rod Mathews, Senior VP and General Manager of Data ProtectionCommentary
Backups are the best way to take control of your defense against ransomware, but they need protecting as well.
By Rod Mathews Senior VP and General Manager of Data Protection, 10/4/2017
Comment1 Comment  |  Read  |  Post a Comment
DevOpsSec: A Big Step in Cloud Application Security
Jeff Schilling, Chief Security Officer, ArmorCommentary
Why it's time for DevOps and security teams to bury the hatchet -- and not in each other's back.
By Jeff Schilling Chief Security Officer, Armor, 10/3/2017
Comment0 comments  |  Read  |  Post a Comment
Google Tightens Web Security for 45 TLDs with HSTS
Dark Reading Staff, Quick Hits
Google broadens HTTPS Strict Transport Security to Top Level Domains under its control and makes them secure by default.
By Dark Reading Staff , 10/2/2017
Comment0 comments  |  Read  |  Post a Comment
Best and Worst Security Functions to Outsource
Kelly Sheridan, Associate Editor, Dark Reading
Which security functions are best handled by third parties, and which should be kept in-house? Experts weigh in.
By Kelly Sheridan Associate Editor, Dark Reading, 9/29/2017
Comment14 comments  |  Read  |  Post a Comment
How to Live by the Code of Good Bots
Ido Safruti,  Founder and CTO at PerimeterXCommentary
Following these four tenets will show the world that your bot means no harm.
By Ido Safruti Founder and CTO at PerimeterX, 9/27/2017
Comment0 comments  |  Read  |  Post a Comment
Why Your Business Must Care about Privacy
Niko Keller, Co-founder and CTO of Opaque CommunicationsCommentary
It might not have something to hide, but it definitely has something to protect.
By Niko Keller Co-founder and CTO of Opaque Communications, 9/26/2017
Comment1 Comment  |  Read  |  Post a Comment
Security's #1 Problem: Economic Incentives
Dimitri Stiliadis, CEO of AporetoCommentary
The industry rewards cutting corners rather than making software safe. Case in point: the Equifax breach.
By Dimitri Stiliadis CEO of Aporeto, 9/25/2017
Comment15 comments  |  Read  |  Post a Comment
Why Size Doesn't Matter in DDoS Attacks
Nicolai Bezsonoff, General Manager, Security Solutions, NeustarCommentary
Companies both large and small are targets. Never think "I'm not big enough for a hacker's attention."
By Nicolai Bezsonoff General Manager, Security Solutions, Neustar, 9/21/2017
Comment1 Comment  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Why Security Leaders Can't Afford to Be Just 'Left-Brained'
Bill Bradley, SVP, Cyber Engineering and Technical Services, CenturyLink,  10/17/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.