Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

News & Commentary
Baidu Apps Leaked Location Data, Machine Learning Reveals
Robert Lemos, Contributing WriterNews
Several apps available on the Google Play Store, including two made by Chinese Internet giant Baidu, leaked information about the phone's hardware and location without the user's knowledge, research finds.
By Robert Lemos Contributing Writer, 11/24/2020
Comment0 comments  |  Read  |  Post a Comment
What's in Store for Privacy in 2021
Robert Lemos, Contributing WriterNews
Changes are coming to the privacy landscape, including more regulations and technologies.
By Robert Lemos Contributing Writer, 11/24/2020
Comment0 comments  |  Read  |  Post a Comment
Facebook Messenger Flaw Enabled Spying on Android Callees
Dark Reading Staff, Quick Hits
A critical flaw in Facebook Messenger on Android would let someone start an audio or video call without the victim's knowledge.
By Dark Reading Staff , 11/20/2020
Comment1 Comment  |  Read  |  Post a Comment
Security Pros Push for More Pervasive Threat Modeling
Robert Lemos, Contributing WriterNews
With the release of the "Threat Modeling Manifesto," a group of 16 security professionals hope to prompt more companies to consider the threats to software.
By Robert Lemos Contributing Writer, 11/20/2020
Comment0 comments  |  Read  |  Post a Comment
Go SMS Pro Messaging App Exposed Users' Private Media Files
Dark Reading Staff, Quick Hits
The popular Android app uses easily guessable Web addresses when users send private photos, videos, and voice messages.
By Dark Reading Staff , 11/19/2020
Comment0 comments  |  Read  |  Post a Comment
Online Shopping Surge Puts Focus on Consumer Security Habits
Robert Lemos, Contributing WriterNews
Companies will have to tread a fine line between delivering security and a frictionless shopping experience, security firms say.
By Robert Lemos Contributing Writer, 11/18/2020
Comment0 comments  |  Read  |  Post a Comment
EFF, Security Experts Condemn Politicization of Election Security
Dark Reading Staff, Quick Hits
Open letter, signed by high-profile security professionals and organizations, urges White House to "reverse course and support election security."
By Dark Reading Staff , 11/17/2020
Comment0 comments  |  Read  |  Post a Comment
Vulnerability Prioritization Tops Security Pros' Challenges
David Habusha, VP of Product, WhiteSourceCommentary
Why vulnerability prioritization has become a top challenge for security professionals and how security and development teams can get it right.
By David Habusha VP of Product, WhiteSource, 11/17/2020
Comment0 comments  |  Read  |  Post a Comment
Researchers Scan for Supply-Side Threats in Open Source
Robert Lemos, Contributing WriterNews
A recent project to scan the main Python repository's 268,000 packages found only a few potentially malicious programs, but work earlier this year uncovered hundreds of instances of malware.
By Robert Lemos Contributing Writer, 11/17/2020
Comment0 comments  |  Read  |  Post a Comment
Twitter Taps Mudge
Dark Reading Staff, Quick Hits
Noted security researcher Peiter Zatko joins the social network as head of security.
By Dark Reading Staff , 11/16/2020
Comment0 comments  |  Read  |  Post a Comment
Zoom Debuts New Tools to Fight Meeting Disruptions
Dark Reading Staff, Quick Hits
Two new capabilities in version 5.4.3 let hosts and co-hosts pause Zoom meetings to remove and report disruptive attendees.
By Dark Reading Staff , 11/16/2020
Comment0 comments  |  Read  |  Post a Comment
Apple Issues Security Updates
Dark Reading Staff, Quick Hits
Vulnerabilities found in three most recent versions of macOS.
By Dark Reading Staff , 11/13/2020
Comment0 comments  |  Read  |  Post a Comment
Self-Service Security for Developers Is the DevSecOps Brass Ring
Ericka Chickowski, Contributing WriterNews
DevOps teams with full security integration and self-service capabilities are 80% more likely to fix critical vulnerabilities in under a day, according to the ninth annual "State of DevOps Report."
By Ericka Chickowski Contributing Writer, 11/13/2020
Comment0 comments  |  Read  |  Post a Comment
A Hacker's Holiday: How Retailers Can Avoid Black Friday Cyber Threats
Matthew McGuirk, Senior Solutions Engineer at Source DefenseCommentary
Starting on Nov. 27, online retailers of all sizes will find out if their e-commerce capabilities are ready for prime time or not.
By Matthew McGuirk Senior Solutions Engineer at Source Defense, 11/13/2020
Comment0 comments  |  Read  |  Post a Comment
Credential Stuffing Fills E-commerce Pipeline in 2020
Dark Reading Staff, Quick Hits
There were 1.3 billion attacks in the third quarter alone, according to new analysis from Arkose Labs.
By Dark Reading Staff , 11/12/2020
Comment0 comments  |  Read  |  Post a Comment
5 Steps Every Company Should Take to Avoid Data Theft Risk
Bradford K. Newman, Principal, Litigation / Chair of North America Trade Secrets PracticeCommentary
It's never been easier for employees to download company data and take it with them to their next gig.
By Bradford K. Newman Principal, Litigation / Chair of North America Trade Secrets Practice, 11/12/2020
Comment1 Comment  |  Read  |  Post a Comment
Security Hiring Plans Remain Constant Despite Pandemic
Kelly Sheridan, Staff Editor, Dark ReadingNews
Although we saw workforce gains this year, 56% of businesses surveyed report staff shortages are putting their organization at risk.
By Kelly Sheridan Staff Editor, Dark Reading, 11/11/2020
Comment0 comments  |  Read  |  Post a Comment
3 Tips For Successfully Running Tech Outside the IT Department
Patrick Kehoe, Chief Marketing and Strategy Officer, CoalfireCommentary
When marketing opts for "extra-departmental IT," coordination and communication are required to keep things secured.
By Patrick Kehoe Chief Marketing and Strategy Officer, Coalfire, 11/11/2020
Comment0 comments  |  Read  |  Post a Comment
Barracuda to Acquire Fyde for Zero-Trust Capabilities
Dark Reading Staff, Quick Hits
Plans call for expanding the Barracuda CloudGen SASE platform.
By Dark Reading Staff , 11/11/2020
Comment0 comments  |  Read  |  Post a Comment
How to Avoid Getting Killed by Ransomware
Karthik Krishnan, Founder & CEO, ConcentricCommentary
Using a series of processes, infosec pros can then tap automated data hygiene to find and fix files that attackers key in on.
By Karthik Krishnan Founder & CEO, Concentric, 11/11/2020
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25159
PUBLISHED: 2020-11-24
499ES EtherNet/IP (ENIP) Adaptor Source Code is vulnerable to a stack-based buffer overflow, which may allow an attacker to send a specially crafted packet that may result in a denial-of-service condition or code execution.
CVE-2020-25654
PUBLISHED: 2020-11-24
An ACL bypass flaw was found in pacemaker before 1.1.24-rc1 and 2.0.5-rc2. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went throu...
CVE-2020-28329
PUBLISHED: 2020-11-24
Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19.
CVE-2020-29053
PUBLISHED: 2020-11-24
HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.
CVE-2020-25640
PUBLISHED: 2020-11-24
A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.