Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Vulnerabilities / Threats posted in May 2018
<<   <   Page 2 / 2
25% of Businesses Targeted with Cryptojacking in the Cloud
News  |  5/15/2018  | 
New public cloud security report detects a spike in cryptojacking, mismanaged cloud storage, account takeover, and major patches getting overlooked.
Kaspersky Lab to Move Some Core Operations to Switzerland
News  |  5/15/2018  | 
Most customer data storage and processing, software assembly, and threat detection updates will be based in Zurich.
Don't Roll the Dice When Prioritizing Vulnerability Fixes
News  |  5/15/2018  | 
CVSS scores alone are ineffective risk predictors - modeling for likelihood of exploitation also needs to be taken into account.
Taming the Chaos of Application Security: 'We Built an App for That'
Commentary  |  5/15/2018  | 
Want to improve the state of secure software coding? Hide the complexity from developers.
Rail Europe Notifies Riders of Three-Month Data Breach
Quick Hits  |  5/15/2018  | 
Rail Europe North America alerts customers to a security incident in which hackers planted card-skimming malware on its website.
New DDoS Attack Method Leverages UPnP
News  |  5/15/2018  | 
'Lock down UPnP routers,' researchers say.
Smashing Silos and Building Bridges in the IT-Infosec Divide
News  |  5/14/2018  | 
A strong relationship between IT and security leads to strong defense, but it's not always easy getting the two to collaborate.
'EFAIL' Email Encryption Flaw Research Stirs Debate
News  |  5/14/2018  | 
A newly revealed vulnerability in email encryption is a big problem for a small subset of users.
Facebook Suspends 200 Apps
Quick Hits  |  5/14/2018  | 
Thousands of apps have been investigated as Facebook determines which had access to large amounts of user data before its 2014 policy changes.
Why Enterprises Can't Ignore Third-Party IoT-Related Risks
Commentary  |  5/14/2018  | 
There's a major disconnect between Internet of Things governance and risk management, according to a new report. Follow these five steps to address the risks.
Gandcrab Ransomware Exploits Website Vulnerabilities
News  |  5/11/2018  | 
Researchers find campaigns distributing Gandcrab by hosting malware on legitimate websites with poor security measures.
Hide and Seek Brings Persistence to IoT Botnets
News  |  5/11/2018  | 
The rapidly evolving Hide and Seek botnet is now persistent on a wide range of infected IoT devices.
Newly Released Russian Facebook Ads Show Scale of Manipulation
Quick Hits  |  5/11/2018  | 
House Democrats this week released 3,500 Facebook ads demonstrating the extent of Russia's influence on US citizens from 2015 to 2017.
8 Ways Hackers Can Game Air Gap Protections
Slideshows  |  5/11/2018  | 
Isolating critical systems from connectivity isn't a guarantee they can't be hacked.
The New Security Playbook: Get the Whole Team Involved
Commentary  |  5/11/2018  | 
Smart cybersecurity teams are harnessing the power of human intelligence so employees take the right actions.
Author of TreasureHunter PoS Malware Releases Its Source Code
News  |  5/10/2018  | 
Leak gives threat actors a way to build newer, nastier versions of the point-of-sale malware, Flashpoint says.
Phishing Attack Bypasses Two-Factor Authentication
News  |  5/10/2018  | 
Hacker Kevin Mitnick demonstrates a phishing attack designed to abuse multi-factor authentication and take over targets' accounts.
17 Zero-Days Found & Fixed in OPC-UA Industrial Protocol Implementations
Quick Hits  |  5/10/2018  | 
Vulnerabilities in the framework used for secure data transfer in industrial systems were all fixed by March, says Kaspersky Lab.
Risky Business: Deconstructing Ray Ozzie's Encryption Backdoor
Commentary  |  5/10/2018  | 
With the addition of secure enclaves, secure boot, and related features of "Clear," the only ones that will be able to test this code are Apple, well-resourced nations, and vendors who sell jailbreaks.
As Personal Encryption Rises, So Do Backdoor Concerns
Quick Hits  |  5/10/2018  | 
Geopolitical changes drive personal encryption among security pros, who are increasingly worried about encryption backdoors.
Ready or Not: Transport Layer Security 1.3 Is Coming
Commentary  |  5/10/2018  | 
Better encryption could mean weaker security if you're not careful.
Electroneum Cryptomining Targets Microsoft IIS 6.0 Vulnerability
Partner Perspectives  |  5/10/2018  | 
New campaign shows that there are still systems exposed to the year-old CVE20177269 vuln on an operating system that was declared end-of-life three years ago.
Email Security Tools Try to Keep Up with Threats
News  |  5/9/2018  | 
Email has long been a prime vector for cyberattacks, and hackers are only getting sneakier. Can email platforms and security tools keep up?
Script Kiddies, Criminals Hacking Video Streams for Fun & Profit
Quick Hits  |  5/9/2018  | 
Video streams are getting hijacked for 'prestige,' DDoS, and financial gain, a new report found.
Phishing Threats Move to Mobile Devices
News  |  5/9/2018  | 
Mobile devices are emerging as a primary gateway for phishing attacks aimed at stealing data.
20 Signs You Are Heading for a Retention Problem
Commentary  |  5/9/2018  | 
If you don't invest in your best security talent, they will look to burnish their resumes elsewhere. Here's why.
Compliance Complexity: The (Avoidable) Risks of Not Playing by the Rules
Commentary  |  5/9/2018  | 
Achieving compliance is a challenging process, but with the right systems and customized data management policy, your organization can stay ahead of the next data breach -- and the regulators.
Microsoft's Patch Tuesday Fixes Two CVEs Under Active Attack
News  |  5/8/2018  | 
This month's updates addressed vulnerabilities in Windows, Office, Edge, Internet Explorer, .Net Framework, Exchange Server, and other services.
APT Attacks on Mobile Rapidly Emerging
News  |  5/8/2018  | 
Mobile devices are becoming a 'primary' enterprise target for attackers.
Breakout Time: A Critical Key Cyber Metric
Commentary  |  5/8/2018  | 
Why organizations need to detect an intrusion in under a minute, understand it in under 10 minutes, and eject the adversary in under an hour.
Publicly Disclosed Breaches Down Drastically in Q1 2018
News  |  5/8/2018  | 
Quietest first quarter since 2012, according to new report from Risk Based Security.
Defending Against an Automated Attack Chain: Are You Ready?
Commentary  |  5/7/2018  | 
Recent threats like AutoSploit bring malware-as-a-service to a whole new level. Here are four ways to be prepared.
Spectre Returns with 8 New Variants
News  |  5/4/2018  | 
Researchers have discovered versions of the processor vulnerability.
We're Doing Security Wrong!
Commentary  |  5/4/2018  | 
When you simply heap technology onto a system, you limit your hiring pool and spread your employees too thin. Focus on your people instead.
RSA CTO: 'Modernization Can Breed Malice'
News  |  5/3/2018  | 
Zulfikar Ramzan predicted the future of cybersecurity, drivers shaping it, and how enterprise IT should react in his InteropITX 2018 keynote.
Twitter Alerts Users to Change Passwords Due to Flaw that Stored Them Unprotected
Quick Hits  |  5/3/2018  | 
Social media giant discovered bug in an internal system that inadvertently stored passwords in plain text.
Hackers Leverage GDPR to Target Airbnb Customers
Quick Hits  |  5/3/2018  | 
Fraudsters are taking advantage of new EU privacy laws to demand personal information from Airbnb users.
Encryption is Necessary, Tools and Tips Make It Easier
News  |  5/3/2018  | 
In the InteropITX conference, a speaker provided tips, tools, and incentives for moving to pervasive encryption in the enterprise.
6 Enterprise Password Managers That Lighten the Load for Security
Slideshows  |  5/3/2018  | 
EPMs offer the familiar password wallet with more substantial administrative management and multiple deployment models.
GDPR Requirements Prompt New Approach to Protecting Data in Motion
Commentary  |  5/3/2018  | 
The EU's General Data Protection Regulation means that organizations must look at new ways to keep data secure as it moves.
Survey Shows Sensitive Data Goes Astray in Email
Quick Hits  |  5/2/2018  | 
Many employees have trouble controlling the release of sensitive information in email.
Spring Clean Your Security Systems: 6 Places to Start
Commentary  |  5/2/2018  | 
The sun is shining and you have an extra kick in your step. Why not use that newfound energy to take care of those bothersome security tasks you've put off all winter?
Breaches Drive Consumer Stress over Cybersecurity
News  |  5/2/2018  | 
As major data breaches make headlines, consumers are increasingly worried about cyberattacks, password management, and data security.
Are You Protecting Your DevOps Software 'Factory'?
News  |  5/1/2018  | 
New study highlights insecurities in DevOps toolchain implementations.
LoJack Attack Finds False C2 Servers
News  |  5/1/2018  | 
A new attack uses compromised LoJack endpoint software to take root on enterprise networks.
Inside the Two Types of Account Takeover Attacks
News  |  5/1/2018  | 
There are two types of automated threats that leverage user credentials to target login pages with account takeover.
Password Reuse Abounds, New Survey Shows
News  |  5/1/2018  | 
Despite heightened awareness of the security implications many users still continue to reuse passwords and rarely if ever change them, a LogMeIn survey shows.
A Data Protection Officer's Guide to GDPR 'Privacy by Design'
Commentary  |  5/1/2018  | 
These five steps can show you how to start building your foundational privacy program for the EU's General Data Protection Regulation.
<<   <   Page 2 / 2


Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: The old using of sock puppets for Shoulder Surfing technique. 
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17513
PUBLISHED: 2019-10-18
An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
CVE-2019-8216
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8217
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-8218
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8219
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .