Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Vulnerabilities / Threats posted in December 2018
<<   <   Page 2 / 2
DanaBot Malware Adds Spam to its Menu
News  |  12/10/2018  | 
A new generation of modular malware increases its value to criminals.
'Highly Active' Seedworm Group Hits IT Services, Governments
News  |  12/10/2018  | 
Since September, the cyber espionage actors have targeted more than 130 victims in 30 organizations including NGOs, oil and gas, and telecom businesses.
'Dr. Shifro' Prescribes Fake Ransomware Cure
Quick Hits  |  12/10/2018  | 
A Russian firm aims to capitalize on ransomware victims' desperation by offering to unlock files then passing money to attackers.
6 Cloud Security Predictions for 2019
Commentary  |  12/10/2018  | 
How the fast pace of cloud computing adoption in 2018 will dramatically change the security landscape next year.
Kubernetes Deployments Around the World Show Vulnerabilities
Quick Hits  |  12/7/2018  | 
Kubernetes owners who expose APIs to the Internet are leaving their systems open to hackers.
Insider Threats & Insider Objections
Commentary  |  12/7/2018  | 
The tyranny of the urgent and three other reasons why its hard for CISOs to establish a robust insider threat prevention program.
Kubernetes Vulnerability Hits Top of Severity Scale
News  |  12/6/2018  | 
The security issue strikes at some of the basic reasons for the rising popularity of containers as an architecture and Kubernetes as an orchestration mechanism.
Adobe Flash Zero-Day Spreads via Office Docs
News  |  12/6/2018  | 
Adobe has patched a zero-day in its Flash player after attackers leveraged the exploit in an active campaign.
Bringing Compliance into the SecDevOps Process
Commentary  |  12/6/2018  | 
Application security should be guided by its responsibility to maintain the confidentiality, integrity, and availability of systems and data. But often, compliance clouds the picture.
4 Lessons Die Hard Teaches About Combating Cyber Villains
Commentary  |  12/6/2018  | 
With proper planning, modern approaches, and tools, we can all be heroes in the epic battle against the cyber threat.
55% of Companies Don't Offer Mandatory Security Awareness Training
Quick Hits  |  12/6/2018  | 
Even those that provide employee training do so sparingly, a new study finds.
Apple Issues Security Fixes Across Mac, iOS
Quick Hits  |  12/6/2018  | 
Software updates for Mac and iOS bring patches to Safari, iCloud, iTunes on Windows, and tvOS.
Boosting SOC IQ Levels with Knowledge Transfer
Commentary  |  12/6/2018  | 
Despite shortages of skills and staff, these six best practices can improve analysts' performance in a security operations center.
Toyota Builds Open-Source Car-Hacking Tool
News  |  12/5/2018  | 
PASTA testing platform specs will be shared via open-source.
A Shift from Cybersecurity to Cyber Resilience: 6 Steps
Commentary  |  12/5/2018  | 
Getting to cyber resilience means federal agencies must think differently about how they build and implement their systems. Here's where to begin.
Starwood Breach Reaction Focuses on 4-Year Dwell
News  |  12/5/2018  | 
The unusually long dwell time in the Starwood breach has implications for both parent company Marriott International and the companies watching to learn from.
Windows 10 Security Questions Prove Easy for Attackers to Exploit
News  |  12/5/2018  | 
New research shows how attackers can abuse security questions in Windows 10 to maintain domain privileges.
The Case for a Human Security Officer
Commentary  |  12/5/2018  | 
Wanted: a security exec responsible for identifying and mitigating the attack vectors and vulnerabilities specifically targeting and involving people.
Backdoors Up 44%, Ransomware Up 43% from 2017
News  |  12/4/2018  | 
Nearly one in three computers was hit with a malware attack this year, and ransomware and backdoors continue to pose a risk.
Jared, Kay Jewelers Web Vuln Exposes Shoppers' Data
Quick Hits  |  12/4/2018  | 
A Jared customer found he could access other orders by changing a link in his confirmation email.
5 Emerging Trends in Cybercrime
Commentary  |  12/4/2018  | 
Organizations can start today to protect against 2019's threats. Look out for crooks using AI "fuzzing" techniques, machine learning, and swarms.
'Influence Agents' Used Twitter to Sway 2018 Midterms
Quick Hits  |  12/3/2018  | 
About 25% of political support in Arizona and Florida was generated by influence agents using Twitter as a platform, research shows.
Filling the Cybersecurity Jobs Gap Now and in the Future
Commentary  |  12/3/2018  | 
Employers must start broadening their search for experienced security professionals to include people with the right traits rather than the right skills.
<<   <   Page 2 / 2


Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
State of SMB Insecurity by the Numbers
Ericka Chickowski, Contributing Writer,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16966
PUBLISHED: 2019-10-21
An issue was discovered in Contactmanager 13.x before 13.0.45.3, 14.x before 14.0.5.12, and 15.x before 15.0.8.21 for FreePBX 14.0.10.3. In the Contactmanager class (html\admin\modules\contactmanager\Contactmanager.class.php), an unsanitized group variable coming from the URL is reflected in HTML on...
CVE-2019-9491
PUBLISHED: 2019-10-21
Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when executed.
CVE-2019-16964
PUBLISHED: 2019-10-21
app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated attackers (with at least the permission call_center_queue_add or call_center_queue_edit) to execute any comma...
CVE-2019-16965
PUBLISHED: 2019-10-21
resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute any commands on the host as www-data.
CVE-2019-18203
PUBLISHED: 2019-10-21
On the RICOH MP 501 printer, HTML Injection and Stored XSS vulnerabilities have been discovered in the area of adding addresses via the entryNameIn and KeyDisplay parameter to /web/entry/en/address/adrsSetUserWizard.cgi.