Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Vulnerabilities / Threats posted in November 2008
U.S. Army Goes Bot Hunting
News  |  11/26/2008  | 
As an automated network-flow analysis tool, BotHunter uses IDS routines to scan inbound and outbound network packet headers and payloads.
Nightmare Before Christmas: Researchers Warn Of Holiday Shopping Threats
News  |  11/26/2008  | 
Increases in malware, enterprise vulnerabilities, laptop theft expected
Facebook Wins $873 Million Judgment Against Spammer
News  |  11/24/2008  | 
The penalty is the largest award yet under the 2003 Can-Spam Act.
China Targets U.S. Computers For Espionage, Report Warns
News  |  11/20/2008  | 
The 2008 Annual Report to Congress urges tighter computer security measures to prevent data loss or corruption.
IT Security's Next Big Threat: Young People
News  |  11/19/2008  | 
Generation Y user behavior could endanger security of enteprise systems, studies say
Broadband Explosion in China And India To Fuel Bots, Spam
News  |  11/19/2008  | 
Botnets to cast wider geographic net, more widely adopt stealthy fast-flux technology, researcher says
Microsoft To Offer Free Security Software
News  |  11/19/2008  | 
Morro will replace the subscription Windows Live OneCare service starting next year.
Anti-Virus Vendor Makes Amends For PC-Breaking Snafu
News  |  11/14/2008  | 
The problem started Nov. 9 when AVG released a virus signature update that misidentified the user32.dll file, a core Windows XP file, as a Trojan.
Researchers Find Flaws In Microsoft VoIP Apps
News  |  11/14/2008  | 
Vulnerabilities could lead to denial-of-service attacks, researchers say
Employees' Online Shopping Could Threaten Company Security
Quick Hits  |  11/14/2008  | 
Younger employees say they plan to spend as much as five work hours shopping for the holiday season
Hosting King Of Spam And Botnets Shut Down, For Now
Quick Hits  |  11/13/2008  | 
McColo's fall results in a brief holiday from spam and botnet activity, but don't get used to it, researchers say
Antivirus Vendor's Snafu Breaks Users' PCs
News  |  11/11/2008  | 
AVG customers that unknowingly deleted the user32.dll file ended up with a PC that either wouldn't reboot or would go into an endless reboot cycle.
Microsoft's November Patch Tuesday Unusually Light
News  |  11/11/2008  | 
The lone critical vulnerability affects Microsoft XML Core Services and, left unchecked, could allow remote code execution if the user visits a maliciously crafted Web page.
25% Of DNS Servers Still Vulnerable To Kaminsky Flaw
News  |  11/11/2008  | 
Security researchers say that DNS will remain a primary exploit target because many people don't understand the Internet's domain name system.
ISPs Facing More Service-Level Attacks
Quick Hits  |  11/11/2008  | 
DDoS attacks hit 40Gbps, but it's the lower-profile attacks that most worry service providers, according to Arbor's new Wordwide Infrastructure Security Report
Many DNS Servers Still Vulnerable To Attack
Quick Hits  |  11/10/2008  | 
One-quarter of DNS servers are still not patched against cache poisoning, study says
Don't Blame TCP/IP
News  |  11/10/2008  | 
Recently disclosed threats to the Internet's IP infrastructure turn spotlight on the protocols -- but protection hinges more on politics and business than technology
Keys To Success Of Vulnerability Management
News  |  11/6/2008  | 
Follow these four principles: focus on output, align with business processes, integrate technologies, and leverage measurement.
Vulnerability Management That Works
News  |  11/6/2008  | 
IT must align its program with business values in order to succeed.
Obama, McCain Campaign Computers Hacked
News  |  11/5/2008  | 
Tech experts at the Obama headquarters initially believed that the computer systems had been invaded by a computer virus.
Web 2.0 Summit: Google, Wikipedia's Tips On Thwarting Spam Abuse
News  |  11/5/2008  | 
Panelists suggest using spam filtering services, "no follow" links, CAPTCHAs, patching religiously, and possibly even charging money to deter spammer registrations.
Virtual Worlds Riskier in Financial Crisis
News  |  11/5/2008  | 
Criminals 'follow the money' to where virtual and real-world economies converge
Adobe Issues Patch for Critical Reader Flaw
Quick Hits  |  11/4/2008  | 
Critical vulnerability could be used to exploit JavaScript engine in popular Reader application
Online Auction for Vulnerabilities Mulls Shutdown
News  |  11/4/2008  | 
WabiSabiLabi is considering closing the online marketplace for security vulnerabilities as it focuses on new line of unified threat management (UTM) appliances
Worm Exploiting Microsoft Windows Server Spotted
News  |  11/3/2008  | 
The vulnerability, which could allow a remote attacker to take over Windows computers without any user interaction, taps into the recent Microsoft Security Bulletin MS08-067.
Lock-Picking Made Easy: New Key Duplication Tool Demonstrates Physical Security Risk
Quick Hits  |  11/3/2008  | 
UC-San Diego researchers show that a photograph is all you need to duplicate a key
Sneaky Malware Hard to Kill
News  |  11/3/2008  | 
Microsoft's new Security Intelligence Report finds Trojan downloaders/droppers are on the rise, while viruses decline
Google Patches Android Security Flaw
News  |  11/3/2008  | 
The company's over-the-air update fixes a browser vulnerability that could enable hackers to gain access to information like saved passwords.
Microsoft: Malware Threats Up 43%
News  |  11/3/2008  | 
The software maker says that the spread of unwanted software is growing faster than ever.


Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: We need more votes, check the obituaries.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4889
PUBLISHED: 2021-01-26
IBM Spectrum Scale 5.0.0 through 5.0.5.4 and 5.1.0 could allow a local user to poison log files which could impact support and development efforts. IBM X-Force ID: 190971.
CVE-2020-4949
PUBLISHED: 2021-01-26
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 192025.
CVE-2021-21275
PUBLISHED: 2021-01-25
The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit f828dc6 by making use of Medi...
CVE-2021-21272
PUBLISHED: 2021-01-25
ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the ...
CVE-2021-23901
PUBLISHED: 2021-01-25
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML ...