Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Vulnerabilities / Threats posted in April 2009
Panda Security Offers Free 'Cloud Antivirus'
News  |  4/29/2009  | 
The antivirus company says its approach protects against malware 100 times faster than traditional signature-based solutions.
Swine Flu Fears Fanned By Spammers
News  |  4/28/2009  | 
Some of these messages contain no malware or malicious links and appear to be information harvesting campaigns.
The Real Costs Of Laptop Loss
Commentary  |  4/27/2009  | 
How many movies have you seen where the bad guy is just about to get caught and interrogated when he bites down on a cyanide capsule and dies almost instantaneously? It's a pretty common scene that I've seen in movies as recent as "The Watchmen." Similar solutions, like virtual cyanide capsules, exist that can address lost or stolen electronic devices, and a study released by Intel and the Ponemon Institute last week highlights the importance of those products.
SANS: Newest WLAN Hacks Come From Afar
News  |  4/24/2009  | 
Expert warns of deadly combination of long-distance remote and wireless hacking to get inside an organization
Symantec Rolls Out Small Business Offerings
News  |  4/22/2009  | 
Company also announces acquisition of Web security gateway appliance maker Mi5
Botnets: Coming To A Social Network Near You
Commentary  |  4/17/2009  | 
I've dealt with a lot of different types of bots. The communication channels among them have varied from unsophisticated IRC command and control (C&C) servers to advanced peer-to-peer (P2P) protocols. For botnet herders, the challenge is flying under the radar of network security professionals who are monitoring their networks and looking for anomalies. The infosec pros who know their networks inside and out are likely to pick up on strange protocols pretty quickly -- which is one of the reasons
RSA: Microsoft Pushes 'Geneva' In War On Passwords
News  |  4/16/2009  | 
Formerly known as Zermatt, the claims-based access platform is a framework for granting people access to information.
Spam Is Killing The Planet
News  |  4/16/2009  | 
McAfee says that the energy required to send, route, and filter spam e-mail each year could power 2.4 million homes and release as much greenhouse gas as 3.1 million cars.
More Data Breached In 2008 Than In Previous Four Years Combined
News  |  4/14/2009  | 
Surprisingly, 99% of breached records were accessed through servers and applications, rather than desktop computers, notebooks, mobile phones, or portable media.
Attack Sneaks Rootkits Into Linux Kernel
News  |  4/14/2009  | 
A researcher at Black Hat Europe this week will demonstrate a more stealthy way to hack Linux
Microsoft Issues Eight Security Bulletins For April Patch Day
News  |  4/14/2009  | 
The fixes repair an Excel flaw that Microsoft warned about in February, as well as an Internet Information Services and SQL Server vulnerability.
Conficker Worm Hits University Of Utah
News  |  4/13/2009  | 
Conficker tries to copy itself to removable media drives in a way that forces code execution whenever the removable drive is inserted into a computer system.
Twitter Visited By Worms Instead Of Bunnies
News  |  4/13/2009  | 
An exploit of a cross-site scripting flaw in Twitter sent almost 10,000 spam tweets and compromised at least 190 accounts over the weekend.
Researcher To Demonstrate Flaws In Wireless Warehouse Networks
Quick Hits  |  4/10/2009  | 
Trustwave pen tester says 802.11 FHSS networks aren't as safe as many companies think
Microsoft Plans Eight Security Fixes Next Week
News  |  4/9/2009  | 
Five of the Patch Tuesday fixes affect Windows, one affects Internet Explorer, one affects Excel, and one affects ISA Server.
Conficker Worm Arms Itself To Steal And Spam
News  |  4/9/2009  | 
The new variant, designated Conficker.E, is arriving through the worm's P2P connectivity.
Giving Government Power To Unplug The Internet
News  |  4/9/2009  | 
In the best-case scenario, that power could enable a president to prevent cyberattacks on the power grid, air traffic control systems or the root of the Internet.
Rolling Review: StealthWatch System For Network Behavior Analysis
News  |  4/9/2009  | 
Lancope appliances provide deep threat analysis that's easy to see.
Cloakware Survey: Acceptable Security Controls A Rarity
News  |  4/8/2009  | 
Most companies rely on antiquated security procedures that don't account for widespread corporate layoffs or the realities of a more virtual workforce, according to study of 12,500 U.S. infosec pros
U.S. Electrical Grid Breached By Cyber Spies
News  |  4/8/2009  | 
The intrusions were detected by U.S. intelligence agencies. In November, a congressional advisory committee warned that Chinese cyberattacks were increasing.
Microsoft: Rogue AV Found On 10 Million Machines
Quick Hits  |  4/7/2009  | 
Scareware more pervasive than thought, while data breaches more about lost and stolen equipment than hackers, according to new Microsoft Security Intelligence Report
Facebook, Microsoft Partner To Fight Koobface Worm
News  |  4/6/2009  | 
The Koobface virus, which spreads through social networking sites, has been added to Microsoft's Malicious Software Removal Tool.
Report: Americans More Worried About Fraud Than Personal Safety
Quick Hits  |  4/5/2009  | 
Financial fraud fears eclipse national security worries in Unisys' latest security poll
Microsoft Issues PowerPoint Security Advisory
News  |  4/3/2009  | 
Microsoft said it's aware only of limited, targeted attempts to exploit this vulnerability, which could allow an attacker to execute code remotely.
Black Hat Europe Researcher Hacks Database Servers
News  |  4/1/2009  | 
New tool to be unleashed at Amsterdam conference uses SQL injection to gain a foothold into the underlying database server


Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29040
PUBLISHED: 2021-05-16
The JSON web services in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 20 and 7.2 before fix pack 10 may provide overly verbose error messages, which allows remote attackers to use the contents of error messages to help launch another, more focused att...
CVE-2021-29041
PUBLISHED: 2021-05-16
Denial-of-service (DoS) vulnerability in the Multi-Factor Authentication module in Liferay DXP 7.3 before fix pack 1 allows remote authenticated attackers to prevent any user from authenticating by (1) enabling Time-based One-time password (TOTP) on behalf of the other user or (2) modifying the othe...
CVE-2021-29047
PUBLISHED: 2021-05-16
The SimpleCaptcha implementation in Liferay Portal 7.3.4, 7.3.5 and Liferay DXP 7.3 before fix pack 1 does not invalidate CAPTCHA answers after it is used, which allows remote attackers to repeatedly perform actions protected by a CAPTCHA challenge by reusing the same CAPTCHA answer.
CVE-2021-22668
PUBLISHED: 2021-05-16
Delta Industrial Automation CNCSoft ScreenEditor Versions 1.01.28 (with ScreenEditor Version 1.01.2) and prior are vulnerable to an out-of-bounds read while processing project files, which may allow an attacker to execute arbitrary code.
CVE-2021-29039
PUBLISHED: 2021-05-16
Cross-site scripting (XSS) vulnerability in the Asset module's categories administration page in Liferay Portal 7.3.4 allows remote attackers to inject arbitrary web script or HTML via the site name.