Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Vulnerabilities / Threats posted in January 2019
Page 1 / 3   >   >>
Cisco Router Vulnerability Gives Window into Researchers' World
News  |  1/31/2019  | 
The research around a recent vulnerability shows how researchers follow leads and find unexpected results.
8 Cybersecurity Myths Debunked
Commentary  |  1/31/2019  | 
The last thing any business needs is a swarm of myths and misunderstandings seeding common and frequent errors organizations of all sizes make in safeguarding data and infrastructure.
Dell, CrowdStrike, Secureworks Join Forces to Secure Endpoints
News  |  1/31/2019  | 
Dell SafeGuard and Response is geared toward businesses, governments, and schools that may lack resources they need to detect and remediate sophisticated threats.
Airbus Employee Info Exposed in Data Breach
Quick Hits  |  1/31/2019  | 
Few details as yet on a cyberattack that hit Airbus' commercial aircraft business.
For a Super Security Playbook, Take a Page from Football
Commentary  |  1/31/2019  | 
Four key questions to consider as you plan out your next winning security strategy.
Rubrik Data Leak is Another Cloud Misconfiguration Horror Story
News  |  1/30/2019  | 
A server security mishap exposed vast stores of data belonging to clients of Rubrik, a security and cloud management firm.
Yes, You Can Patch Stupid
Commentary  |  1/30/2019  | 
Before you start calling users stupid, remember that behind every stupid user is a stupider security professional.
Discover Issues New Cards Following Data Breach
Quick Hits  |  1/30/2019  | 
The credit card company reports Discover's card systems were not involved in the breach, discovered in August 2018.
Access Control Lists: 6 Key Principles to Keep in Mind
Slideshows  |  1/30/2019  | 
Build them carefully and maintain them rigorously, and ACLs will remain a productive piece of your security infrastructure for generations of hardware to come.
Open Source & Machine Learning: A Dynamic Duo
Commentary  |  1/30/2019  | 
In recent months, machine-learning code has become readily available in the open source community, putting security analysts on a path toward easier data pattern recognition.
Microsoft Exchange Vuln Enables Attackers to Gain Domain Admin Privileges
News  |  1/29/2019  | 
Anyone with access to an Exchange mailbox can take control of domain, security researcher says.
FaceTime Bug an AppSec Fail
News  |  1/29/2019  | 
Apple has shut off Group FaceTime while it prepares a fix for a newly found security flaw found by a 14-year-old gamer.
Americans Worried More About Computer - Not Border - Security
Quick Hits  |  1/29/2019  | 
A new survey shows more Americans are more concerned about their computer's security than the US border's.
Remote Access & the Diminishing Security Perimeter
Commentary  |  1/29/2019  | 
Where security really matters, the enterprise is only as secure as the endpoints it allows to access its sensitive core systems.
Creating a Security Culture & Solving the Human Problem
Commentary  |  1/29/2019  | 
People are the biggest weakness to security breaches; people can also be your organization's biggest defense.
Turn Off FaceTime in Apple iOS Now, Experts Warn
Quick Hits  |  1/28/2019  | 
Newly found bug reportedly allows callers to spy on you – even if you don't pick up.
Japan Authorizes IoT Hacking
Quick Hits  |  1/28/2019  | 
A new campaign will see government employees hacking into personal IoT devices to identify those at highest security risk.
3 Ways Companies Mess Up GDPR Compliance the Most
Commentary  |  1/28/2019  | 
The best way to conform to the EU's new privacy regulation is to assume that you don't need to hold on to personal data, versus the opposite.
Internet Society to Issue Privacy Code of Conduct
News  |  1/25/2019  | 
In time for Data Privacy Day, on Monday, the nine-point guidance will offer insights into how companies can more effectively manage personal data.
Ukraine Sees Surge in Election-Targeted Cyberattacks
Quick Hits  |  1/25/2019  | 
The nation suspects Russia's hand in the attacks, which seem aimed at disrupting the upcoming presidential election.
Satya Nadella: Privacy Is a Human Right
Quick Hits  |  1/25/2019  | 
In a talk at the World Economic Forum, Microsoft's CEO voiced support for GDPR and expressed hope the United States creates a similar approach to privacy.
Credential Compromises by the Numbers
Slideshows  |  1/25/2019  | 
Recent statistics show just how much credential stealing has become a staple in the attacker playbook.
The 5 Stages of CISO Success, Past & Future
Commentary  |  1/25/2019  | 
In cybersecurity, as in history, security leaders who forget the lessons of the past will be doomed to repeat them.
After Eight Years, Metasploit Gets Its First Major Update
News  |  1/24/2019  | 
Metasploit 5.0 offers a host of service-oriented features, along with a new commitment from Rapid7 for regular releases.
Cyberattackers Bait Financial Firms with Google Cloud Platform
News  |  1/24/2019  | 
A new wave of attacks abuses the Google Cloud Platform URL redirection in PDF decoys, sending users to a malicious link.
Collateral Damage: When Cyberwarfare Targets Civilian Data
Commentary  |  1/24/2019  | 
You can call it collateral damage. You can call it trickledown cyberwarfare. Either way, foreign hacker armies are targeting civilian enterprises as a means of attacking rival government targets.
New Phishing Campaign Packs Triple Threat
Quick Hits  |  1/24/2019  | 
Attack threatens victims with three "deadly malware" infestations if they don't give up critical email account credentials.
Cloud Customers Faced 681M Cyberattacks in 2018
Quick Hits  |  1/24/2019  | 
The most common attacks involved software vulnerabilities, stolen credentials, Web applications, and IoT devices.
Why Cybersecurity Must Be a Top Priority for Small & Midsize Businesses
Commentary  |  1/24/2019  | 
The big corporations may grab the headlines, but America's SMBs have the most to lose in the aftermath of a data breach.
RF Hacking Research Exposes Danger to Construction Sites
News  |  1/23/2019  | 
Trend Micro team unearthed 17 vulnerabilities among seven vendors' remote controller devices.
DHS Issues Emergency Directive on DNS Security
News  |  1/23/2019  | 
All government domain owners are instructed to take immediate steps to strengthen the security of their DNS servers following a successful hacking campaign.
'Anatova' Emerges as Potentially Major New Ransomware Threat
News  |  1/23/2019  | 
Modular design, ability to infect network shares make the malware dangerous, McAfee says.
Aging PCs Running Out-of-Date Software Bring Security Worries
Quick Hits  |  1/23/2019  | 
Age is an issue with application languages and frameworks, too.
The Evolution of SIEM
Commentary  |  1/23/2019  | 
Expectations for these security information and event management systems have grown over the years, in ways that just aren't realistic.
Think Twice Before Paying a Ransom
Commentary  |  1/23/2019  | 
Why stockpiling cryptocurrency or paying cybercriminals is not the best response.
Enterprise Malware Detections Up 79% as Attackers Refocus
News  |  1/23/2019  | 
A new report on the state of malware shows a spike in B2B malware, with former banking Trojans Emotet and TrickBot topping the list.
Hack of Plug-in Website Ruffles WordPress Community
News  |  1/22/2019  | 
An intruder thought to be a former employee used a backdoor into the WPML website to skim email addresses and send a mass email blast.
The Fact and Fiction of Homomorphic Encryption
Commentary  |  1/22/2019  | 
The approach's promise continues to entice cryptographers and academics. But don't expect it to help in the real world anytime soon.
Real-World Threats That Trump Spectre & Meltdown
Slideshows  |  1/22/2019  | 
New side-channel attacks are getting lots of attention, but other more serious threats should top your list of threats.
How Cybercriminals Clean Their Dirty Money
Commentary  |  1/22/2019  | 
By using a combination of new cryptocurrencies and peer-to-peer marketplaces, cybercriminals are laundering up to an estimated $200 billion in ill-gotten gains a year. And that's just the beginning.
Shadow IT, IaaS & the Security Imperative
Commentary  |  1/21/2019  | 
Organizations must strengthen their security posture in cloud environments. That means considering five critical elements about their infrastructure, especially when it operates as an IaaS.
2018's Most Common Vulnerabilities Include Issues New and Old
News  |  1/18/2019  | 
The most common vulnerabilities seen last year run the gamut from cross-site scripting to issues with CMS platforms.
VC Investments in Cybersecurity Hit Record Highs in 2018
News  |  1/18/2019  | 
But rate of funding appears unsustainable, according to Strategic Cyber Ventures.
GDPR Suit Filed Against Amazon, Apple
Quick Hits  |  1/18/2019  | 
An Austrian non-profit, led by privacy activist and attorney Max Schrems, has filed suit against 8 tech giants for non-compliance with the EU General Data Protection Regulation.
PCI Council Releases New Software Framework for DevOps Era
News  |  1/18/2019  | 
The PCI Software Security Framework will eventually replace PCI DA-DSS when it expires in 2022.
The Rx for HIPAA Compliance in the Cloud
Commentary  |  1/18/2019  | 
For medical entities, simply following HIPAA cloud service provider guidelines is no longer enough to ensure that your practice is protected from cyber threats, government investigations, and fines.
Microsoft Launches New Azure DevOps Bug Bounty Program
Quick Hits  |  1/17/2019  | 
A new program will pay bounties of up to $20,000 for new critical bugs in the company's Azure DevOps systems and services.
New Attacks Target Recent PHP Framework Vulnerability
News  |  1/17/2019  | 
Multiple threat actors are using relatively simple techniques to take advantage of the vulnerability, launching cryptominers, skimmers, and other malware payloads.
The Security Perimeter Is Dead; Long Live the New Endpoint Perimeter
Commentary  |  1/17/2019  | 
The network no longer provides an air gap against external threats, but access devices can take up the slack.
Simulating Lateral Attacks Through Email
Commentary  |  1/17/2019  | 
A skilled attacker can get inside your company by abusing common email applications. Here are three strategies to block them.
Page 1 / 3   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-33196
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
CVE-2023-33185
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
CVE-2023-33187
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
CVE-2023-33194
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
CVE-2023-2879
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file