Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

News & Commentary
What A Security Engineer & Software Engineer Learned By Swapping Roles
Kelly Sheridan, Staff Editor, Dark ReadingNews
A security engineer and infrastructure engineer with Salesforce share lessons learned from their professional role reversal, and advice for people on both teams.
By Kelly Sheridan Staff Editor, Dark Reading, 8/5/2020
Comment0 comments  |  Read  |  Post a Comment
Tales from the Trenches Show Security Issues Endemic to Healthcare
Robert Lemos, Contributing WriterNews
The CISO for Indiana University Health says simple policies, good communication, and strong authentication go much further than vendor tools in solving security problems.
By Robert Lemos Contributing Writer, 8/5/2020
Comment0 comments  |  Read  |  Post a Comment
Dark Reading Video News Desk Returns to Black Hat
Sara Peters, Senior Editor at Dark ReadingNews
UPDATED: Coming to you prerecorded from in front of carefully arranged bookcases around the world ...!
By Sara Peters Senior Editor at Dark Reading, 8/5/2020
Comment0 comments  |  Read  |  Post a Comment
Synopsys: Why Security-Minded Companies Are Transitioning to DevSecOps
Terry Sweeney, Contributing EditorNews
SPONSORED: For too long, developers have had to weigh the tradeoffs between software security and feature development. But as DevSecOps continues to gain momentum over application security, organizations realize that adopting security in software development needn't be a drag on productivity, says Tim Mackey from the Synopsys Cybersecurity Research Center.
By Terry Sweeney Contributing Editor, 8/5/2020
Comment0 comments  |  Read  |  Post a Comment
HealthScare: Prioritizing Medical AppSec Research
Dark Reading Staff, News
Seth Fogie, information security director at Penn Medicine, explains which healthcare app vulnerabilities really matter in the day-to-day business of providing patient care.
By Dark Reading Staff , 8/5/2020
Comment0 comments  |  Read  |  Post a Comment
How An Electronic Medical Record System Flaw Exacerbated the Opioid Crisis
Dark Reading Staff, News
Mitch Parker, CISO of Indiana University Health, explains how healthcare appsec vulnerabilities and abuse can go undetected in small medical centers -- at great cost.
By Dark Reading Staff , 8/5/2020
Comment0 comments  |  Read  |  Post a Comment
Voatz Delivers Multilayered Security to Protect Electronic Voting
Terry Sweeney, Contributing EditorNews
SPONSORED CONTENT: While electronic voting has been plagued by fears of tampering or fraud, Voatz is looking to make the process more transparent and auditable, according to company founder Nimit Sawhney. He offers learning points from three recent pilots that highlight how governments can improve the integrity and better protect the voting process and its data.
By Terry Sweeney Contributing Editor, 8/5/2020
Comment0 comments  |  Read  |  Post a Comment
3 Tips for Securing Open Source Software
Robert Former, CISO/VP of Security, AcquiaCommentary
Maintaining myriad open source components can be tough. Here's how teams can begin to address open source security and continue to innovate.
By Robert Former CISO/VP of Security, Acquia, 8/5/2020
Comment0 comments  |  Read  |  Post a Comment
Microsoft Paid $13.7M in Bug Bounty Rewards in 2019-2020
Dark Reading Staff, Quick Hits
The 2019-2020 program year awarded 327 security researchers through 15 bounty programs, with a largest reward of $200,000.
By Dark Reading Staff , 8/5/2020
Comment0 comments  |  Read  |  Post a Comment
FBI Warns on New E-Commerce Fraud
Dark Reading Staff, News
A wave of new, fraudulent websites has popped up to take advantage of the rise in online shopping during the coronavirus pandemic.
By Dark Reading Staff , 8/3/2020
Comment0 comments  |  Read  |  Post a Comment
New Initiative Links Cybersecurity Pros to Election Officials
Dark Reading Staff, Quick Hits
A University of Chicago Harris School of Public Policy initiative will build a database of cybersecurity volunteers.
By Dark Reading Staff , 7/31/2020
Comment0 comments  |  Read  |  Post a Comment
'Hidden Property Abusing' Allows Attacks on Node.js Applications
Robert Lemos, Contributing WriterNews
A team of researchers from Georgia Tech find a new attack technique that targets properties in Node.js and plan to publicly release a tool that has already identified 13 new vulnerabilities.
By Robert Lemos Contributing Writer, 7/31/2020
Comment0 comments  |  Read  |  Post a Comment
Mimecast Buys MessageControl
Dark Reading Staff, Quick Hits
The email security provider brings into its fold social engineering and human identity capabilities.
By Dark Reading Staff , 7/30/2020
Comment0 comments  |  Read  |  Post a Comment
Google Adds Security Updates to Chrome Autofill
Dark Reading Staff, Quick Hits
Chrome users can retrieve payment card numbers via biometric authentication and use a new "touch-to-fill: feature to log in to accounts.
By Dark Reading Staff , 7/30/2020
Comment0 comments  |  Read  |  Post a Comment
11 Security Tools to Expect at the Black Hat USA 2020 Arsenal Virtual Event
Jai Vijayan, Contributing Writer
More than 130 security researchers and developers are ready to showcase their work.
By Jai Vijayan Contributing Writer, 7/29/2020
Comment0 comments  |  Read  |  Post a Comment
Security Flaws Discovered in OKCupid Dating Service
Dark Reading Staff, Quick Hits
Researchers identified a variety of vulnerabilities in apps and websites for the popular online dating platform.
By Dark Reading Staff , 7/29/2020
Comment1 Comment  |  Read  |  Post a Comment
70,000+ WordPress Sites Affected by Critical Plug-in Flaw
Dark Reading Staff, Quick Hits
A vulnerability in the wpDiscuz plug-in could let attackers remotely execute code on the servers of affected websites.
By Dark Reading Staff , 7/29/2020
Comment1 Comment  |  Read  |  Post a Comment
Avon Server Leaks User Info and Administrative Data
Dark Reading Staff, Quick Hits
An unprotected server has exposed more than 7GB of data from the beauty brand.
By Dark Reading Staff , 7/28/2020
Comment2 comments  |  Read  |  Post a Comment
Out-of-Date and Unsupported Cloud Workloads Continue as a Common Weakness
Robert Lemos, Contributing WriterNews
More than 80% of companies have at least one Internet-facing cloud asset that is more than six months out of date or running software that is no longer supported, according to scan data.
By Robert Lemos Contributing Writer, 7/28/2020
Comment2 comments  |  Read  |  Post a Comment
Researchers Foil Phishing Attempt on Netflix Customers
Steve Zurier, Contributing WriterNews
Hackers use two stolen domains to steal credentials from Netflix users and then send them to the real Netflix site.
By Steve Zurier Contributing Writer, 7/28/2020
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
Browsers to Enforce Shorter Certificate Life Spans: What Businesses Should Know
Kelly Sheridan, Staff Editor, Dark Reading,  7/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-17366
PUBLISHED: 2020-08-05
An issue was discovered in NLnet Labs Routinator 0.1.0 through 0.7.1. It allows remote attackers to bypass intended access restrictions or to cause a denial of service on dependent routing systems by strategically withholding RPKI Route Origin Authorisation ".roa" files or X509 Certificate...
CVE-2020-9036
PUBLISHED: 2020-08-05
Jeedom through 4.0.38 allows XSS.
CVE-2020-15127
PUBLISHED: 2020-08-05
In Contour ( Ingress controller for Kubernetes) before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes flip...
CVE-2020-15132
PUBLISHED: 2020-08-05
In Sulu before versions 1.6.35, 2.0.10, and 2.1.1, when the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is returned, along with a error message saying that th...
CVE-2020-7298
PUBLISHED: 2020-08-05
Unexpected behavior violation in McAfee Total Protection (MTP) prior to 16.0.R26 allows local users to turn off real time scanning via a specially crafted object making a specific function call.