Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Latest Content tagged with Vulnerabilities / Threats
Page 1 / 2   >   >>
Successful Malware Incidents Rise as Attackers Shift Tactics
News  |  1/15/2021  | 
As employees moved to working from home and on mobile devices, attackers followed them and focused on weekend attacks, a security firm says.
'Chimera' Threat Group Abuses Microsoft & Google Cloud Services
Quick Hits  |  1/14/2021  | 
Researchers detail a new threat group targeting cloud services to achieve goals aligning with Chinese interests.
Businesses Struggle with Cloud Availability as Attackers Take Aim
News  |  1/14/2021  | 
Researchers find organizations struggle with availability for cloud applications as government officials warn of cloud-focused cyberattacks.
NSA Recommends Using Only 'Designated' DNS Resolvers
Quick Hits  |  1/14/2021  | 
Agency provides guidelines on securely deploying DNS over HTTPS, aka DoH.
Who Is Responsible for Protecting Physical Security Systems From Cyberattacks?
News  |  1/14/2021  | 
It's a question that continues to engage debate, as the majority of new physical security devices being installed are now connected to a network. While this offers myriad benefits, it also raises the question: Who is responsible for their cybersecurity?
Vulnerability Management Has a Data Problem
Commentary  |  1/14/2021  | 
Security teams have an abundance of data, but most of it lacks the context necessary to improve remediation outcomes.
Virtual Pen-Testing Competition Tasks College Students With Running a Red Team Operation
News  |  1/13/2021  | 
Aimed at developing offensive cyber talent, last weekend's sixth annual Collegiate Penetration Testing Competition brought out some of the brightest from RIT and Stanford, among other universities.
The Data-Centric Path to Zero Trust
Commentary  |  1/13/2021  | 
Data is an organization's most valuable asset, so a data-centric approach would provide the best value for organizations, now and in the future.
United Nations Security Flaw Exposed 100K Staff Records
Quick Hits  |  1/12/2021  | 
Security researchers have disclosed a vulnerability they exploited to access more than 100,000 private employee records.
Microsoft Defender Zero-Day Fixed in First Patch Tuesday of 2021
News  |  1/12/2021  | 
Microsoft patched 83 bugs, including a Microsoft Defender zero-day and one publicly known elevation of privilege flaw.
Over-Sharer or Troublemaker? How to Identify Insider-Risk Personas
Commentary  |  1/12/2021  | 
It's past time to begin charting insider risk indicators that identify risky behavior and stop it in its tracks.
Intel's New vPro Processors Aim to Help Defend Against Ransomware
News  |  1/11/2021  | 
The newest Intel Core vPro mobile platform gives PC hardware a direct role in detecting ransomware attacks.
New Tool Sheds Light on AppleScript-Obfuscated Malware
News  |  1/11/2021  | 
The AEVT decompiler helped researchers analyze a cryptominer campaign that used AppleScript for obfuscation and will help reverse engineers focused on other Mac OS malware.
When It Comes To Security Tools, More Isn't More
Commentary  |  1/11/2021  | 
Organizations that focus on optimizing their tools, cutting down on tool sprawl, and taking a strategic approach to transitioning to the cloud are poised for success.
Top 5 'Need to Know' Coding Defects for DevSecOps
Commentary  |  1/8/2021  | 
Integrating static analysis into the development cycle can prevent coding defects and deliver secure software faster.
Cobalt Strike & Metasploit Tools Were Attacker Favorites in 2020
News  |  1/7/2021  | 
Research reveals APT groups and cybercriminals employ these offensive security tools as often as red teams.
FireEye's Mandia: 'Severity-Zero Alert' Led to Discovery of SolarWinds Attack
News  |  1/7/2021  | 
CEO Kevin Mandia shared some details on how his company rooted out the major cyberattack campaign affecting US government and corporate networks.
State Dept. to Create New Cybersecurity & Technology Agency
Quick Hits  |  1/7/2021  | 
Bureau of Cyberspace Security and Emerging Technologies (CSET) will serve as diplomatic arm for US cybersecurity interests.
Even Small Nations Have Jumped into the Cyber Espionage Game
News  |  1/7/2021  | 
While the media tends to focus on the Big 5 nation-state cyber powers, commercial spyware has given smaller countries sophisticated capabilities, as demonstrated by a "zero-click" iMessage exploit that targeted journalists last year.
The 3 Most Common Types of BEC Attacks (And What You Can Do About Them)
Commentary  |  1/7/2021  | 
Always be skeptical and double check credentials.
Nissan Source Code Leaked via Misconfigured Git Server
Quick Hits  |  1/6/2021  | 
Leaked information includes source code of Nissan mobile apps, diagnostics tool, and market research tools and data, among other assets.
How to Protect Your Organization's Digital Footprint
Commentary  |  1/6/2021  | 
As the digital risk landscape evolves and grows, organizations must stay vigilant against online threats.
6 Open Source Tools for Your Security Team
Slideshows  |  1/6/2021  | 
Open source tools can be great additions to your cloud security arsenal. Here are a half-dozen to get you started.
Dark Web Forum Activity Surged 44% in Early COVID Months
News  |  1/5/2021  | 
Researchers analyzed the activity of five popular English- and Russian-speaking Dark Web forums and discovered exponential membership growth.
SolarWinds Hit With Class-Action Lawsuit Following Orion Breach
Quick Hits  |  1/5/2021  | 
SolarWinds shareholders accuse the company of lying about its security practices ahead of the disclosure of a massive security incident.
Microsoft Source Code Exposed: What We Know & What It Means
News  |  1/4/2021  | 
Microsoft says there is no increase in security risk; however, experts say access to source code could make some steps easier for attackers.
CISO New Year's Resolutions for 2021
Slideshows  |  1/4/2021  | 
Six resolutions for forward-looking cyber-risk leaders.
How to Build Cyber Resilience in a Dangerous Atmosphere
Commentary  |  12/31/2020  | 
Our polarized climate and COVID-19 are putting the nation's cybersecurity in imminent danger, and it's past time to act.
The Coolest Hacks of 2020
News  |  12/31/2020  | 
Despite a pandemic and possibly the worst cyberattack campaign ever waged against the US, the year still had some bright spots when it came to "good" and creative hacks.
Mobile Endpoint Security: Still the Crack in the Enterprise's Cyber Armor
Commentary  |  12/30/2020  | 
A combination of best practices and best-in-class technology will help keep your enterprise from falling victim to ever-growing threats.
Reducing the Risk of Third-Party SaaS Apps to Your Organization
Commentary  |  12/29/2020  | 
Such apps may try to leak your data, or can contain malicious code. And even legitimate apps may be poorly written, creating security risks.
India: A Growing Cybersecurity Threat
Commentary  |  12/29/2020  | 
Geopolitical tensions and a dramatic rise in offensive and defensive cyber capabilities lead India to join Iran, Russia, China, and North Korea as a top nation-state adversary.
Defending the COVID-19 Vaccine Supply Chain
Commentary  |  12/28/2020  | 
We must treat this supply chain like a piece of our nation's critical infrastructure, just like the electrical grid or air traffic control system.
10 Benefits of Running Cybersecurity Exercises
Commentary  |  12/28/2020  | 
There may be no better way to ascertain your organization's strengths and weaknesses than by running regular security drills.
Remote Desktop Bugs: Patches That Took Priority in a Pandemic Year
News  |  12/28/2020  | 
Remote Desktop flaws were a patching priority this year as Microsoft distributed fixes and businesses scrambled to protect remote employees.
Amazon Gift Card Scam Delivers Dridex This Holiday Season
News  |  12/24/2020  | 
Dridex operators launch a social engineering scam that promises victims a $100 gift card but delivers a banking Trojan.
Quarterbacking Vulnerability Remediation
Commentary  |  12/24/2020  | 
It's time that security got out of the armchair and out on the field.
Microsoft, McAfee, Rapid7, and Others Form New Ransomware Task Force
News  |  12/23/2020  | 
Industry group wants to get a framework in the hands of the new administration's cybersecurity officials by early spring 2021.
White Ops Announces Its Acquisition
Quick Hits  |  12/23/2020  | 
A group including Goldman Sachs Merchant Banking Division, ClearSky Security, and NightDragon has purchased the human verification technology company.
Lazarus Group Seeks Intelligence Related to COVID-19
News  |  12/23/2020  | 
Researchers attribute attacks targeting a pharmaceutical company and a government ministry related to COVID-19 response.
Enterprise IoT Security Is a Supply Chain Problem
Commentary  |  12/23/2020  | 
Organizations that wish to take advantage of the potential benefits of IoT systems in enterprise environments should start evaluating third-party risk during the acquisition process.
Emotet Campaign Restarts After Seven-Week Hiatus
News  |  12/22/2020  | 
Multiple security researchers note the return of an email campaign attempting to spread the malware, which is often used to drop the Ryuk ransomware and Trickbot banking Trojan.
Prepare to Fight Upcoming Cyber-Threat Innovations
Commentary  |  12/22/2020  | 
Cybercriminals are preparing to use computing performance innovations to launch new types of attacks.
Law Enforcement Disrupts VPN Services Enabling Cybercrime
Quick Hits  |  12/22/2020  | 
The United States and international partners shut down three bulletproof hosting services used to facilitate criminal activity.
Security as Code: How Repeatable Policy-Driven Deployment Improves Security
Commentary  |  12/22/2020  | 
The SaC approach lets users codify and enforce a secure state of application configuration deployment that limits risk.
Cisco, Intel, Deloitte Among Victims of SolarWinds Breach: Report
Quick Hits  |  12/21/2020  | 
The Wall Street Journal identified 24 businesses so far that have downloaded the SolarWinds software infected with malicious code.
NSA, CISA Warn of Attacks on Federated Authentication
News  |  12/21/2020  | 
While incident responders focus on attacks using SolarWinds Orion, government cyber defenders highlight other methods likely being used as well.
We Have a National Cybersecurity Emergency -- Here's How We Can Respond
Commentary  |  12/21/2020  | 
Let's prioritize bipartisan strategic actions that can ensure our national security and strengthen the economy. Here are five ideas for how to do that.
FBI Warns of DoppelPaymer Attacks on Critical Infrastructure
Quick Hits  |  12/18/2020  | 
The operators behind DoppelPaymer have begun calling victims to pressure them into paying ransom, officials say.
2021 Cybersecurity Predictions: The Intergalactic Battle Begins
Commentary  |  12/18/2020  | 
There's much in store for the future of cybersecurity, and the most interesting things aren't happening on Earth.
Page 1 / 2   >   >>


More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/12/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-20619
PUBLISHED: 2021-01-19
Cross-site scripting vulnerability in GROWI (v4.2 Series) versions prior to v4.2.3 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2020-29450
PUBLISHED: 2021-01-19
Affected versions of Atlassian Confluence Server and Data Center allow remote attackers to impact the application's availability via a Denial of Service (DoS) vulnerability in the avatar upload feature. The affected versions are before version 7.2.0.
CVE-2020-36192
PUBLISHED: 2021-01-18
An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues (either marked as Private, or part of a private Project), if they are attached to an existing Changeset. The information is visible on the view.php p...
CVE-2020-36193
PUBLISHED: 2021-01-18
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
CVE-2020-7343
PUBLISHED: 2021-01-18
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.