Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Vulnerabilities / Threats posted in June 2013
HTTPS Side-Channel Attack A Tool For Encrypted Secret Theft
News  |  6/29/2013  | 
Researchers to release details on how SSL vulnerability gives attackers ability to steal everything from OAuth tokens to PII through an enterprise app in just 30 seconds
Machine-Learning Project Sifts Through Big Security Data
News  |  6/28/2013  | 
As the volume of data created by security and network devices multiplies, researchers look for ways to teach computer to better highlight attack patterns
3 Stupid Corporation Tricks
News  |  6/28/2013  | 
With exactly one month to go before the start of Black Hat USA 2013, we highlight a trio of Briefings that focus on data security in corporate environments.
The (Attack) Path To Prioritization
Commentary  |  6/28/2013  | 
Since you can't fix every vulnerability, you need to prioritize what needs to get done now and what doesn't. Using attack path data can help
IE, Chrome Browser Attack Exploits Windows PCs
News  |  6/28/2013  | 
Microsoft says the social-engineering vulnerability, which uses "pop-under" browser notifications and a fake Captcha, isn't a Windows bug.
96 Percent Of Androids Running Old OS Versions
Quick Hits  |  6/27/2013  | 
Some 90 percent of all mobile threats target the popular Android platform, Juniper Networks report says
Sextortion Warning: Masking Tape Time For Webcams
Commentary  |  6/27/2013  | 
"Camjacking" attacks activate your webcam and record your every move. Female images are in demand.
Researcher To Demo Spy-Phone At Black Hat
News  |  6/26/2013  | 
Using the ability to inject malicious code into applications on Android devices, a researcher will demonstrate at Black Hat how to create the infrastructure to spy on mobile users
Carberp Source Code Leak Likely To Spawn Malware Variants, Innovation
News  |  6/26/2013  | 
Source code for the Carberp Trojan has been leaked, creating a double-edged sword for security researchers
Germany Criticizes U.K. 'Project Tempora' Cyber Spy Program
News  |  6/26/2013  | 
German politician wants the EU to address reports that Britain's spymasters are even better at harvesting Internet traffic than their NSA allies.
Cybercriminals Expand DDOS Extortion Demands
News  |  6/26/2013  | 
Free toolkits and outsourced cybercrime services make DDoS attacks popular with Anonymous, criminals, unscrupulous business competitors and anyone with a grudge.
British Cyber Defenses Receive Unexpected Boost
News  |  6/26/2013  | 
British intelligence services and cybersecurity initiatives get increased investment, even amidst brutal government cuts.
Google Now Sharing Web Security Data
Quick Hits  |  6/25/2013  | 
Search engine giant's transparency report will now include data on numbers of malicious and infected websites, cleanup rates
Black Hat USA: T-Minus One Month And Counting
News  |  6/25/2013  | 
This highlighted trio of Briefings range widely in topic, yet they all sport that certain cool factor
Analyzing Vulnerabilities In Business-Critical Applications
Quick Hits  |  6/21/2013  | 
Fears of downtime and broken apps complicate the vulnerability scanning process. Here are some tips to help
Cloud Can Simplify Vulnerability Management For SMBs
News  |  6/21/2013  | 
Lacking security skills, most small and midsize businesses need help in locking down their information technology, including cataloging and triaging vulnerabilities
Microsoft Establishes Rewards Programs For Windows 8.1, Internet Explorer 11 Preview Security Bugs
News  |  6/19/2013  | 
Microsoft is launching new programs to get its hands on cutting-edge exploits developed by researchers
Microsoft Dangles $100,000 Bug Bounty
News  |  6/19/2013  | 
One hitch: The bugs might be worth more on the open market.
Slide Show: 10 Ways Attackers Automate Malware Production
Slideshows  |  6/18/2013  | 
Peeking into an attacker's toolbox to see how malware production is automated and the Internet is flooded with millions of unique malware applications
CrowdStrike Falcon Traces Attacks Back To Hackers
News  |  6/17/2013  | 
Startup that encourages playing offense on security launches cloud-based service to help businesses identify adversaries, mitigate attacks and pursue responses.
Researcher To Open-Source Tools For Finding Odd Authentication Behavior
News  |  6/15/2013  | 
Rather than watching for communications between infected systems and command-and-control servers, companies can detect stealthy malware when it attempts to spread
Black Hat USA 2013 Reveals Turbo Talks On Top Topics
News  |  6/14/2013  | 
High-speed sessions will focus on content from almost every corner of security space
Bug Data Buys Businesses Intel From U.S. Government
News  |  6/14/2013  | 
Thousands of businesses are reportedly exchanging information with the government on zero-day vulnerabilities and online threats in return for classified intelligence.
Cyberespionage Operators Work In Groups, Process Enormous Data Workloads
News  |  6/14/2013  | 
A group of Taiwanese researchers peer into the operations center of a group behind one large espionage campaign
0-Day The (Bug) Bounty Hunter
Commentary  |  6/13/2013  | 
Companies increasingly offer bug bounties to help find vulnerabilities and threats. This is an opportunity for those looking to get into security
New OWASP Top 10 Reflects Unchanged State Of Web Security
News  |  6/13/2013  | 
Injection flaws still rank No. 1 in Web application vulnerabilities
Don't Take Vulnerability Counts At Face Value
News  |  6/13/2013  | 
With flaw tallies varying by up to 75 percent, vulnerability data needs to be taken with a grain of salt, yet reports based on the data fail to include caveats, Black Hat presenters say
NSA Prism Fallout Delays EU Airline Database Vote
News  |  6/12/2013  | 
Accusations of "paranoia" and discrimination against non-U.S. citizens aired in Brussels this week -- though the importance of working with America on security was also a theme.
NSA Prism Relies Heavily On IT Contractors
News  |  6/11/2013  | 
NSA whistleblower Snowden likely enjoyed access to Prism program details as a contracted NSA IT administrator. Systems administrators remain an important link in your security chain.
U.S.-Chinese Summit: 4 Information Security Takeaways
News  |  6/10/2013  | 
What did the summit accomplish with regard to cyber spying and cyber attacks -- and what's left undone?
Study: Rogue Employees Are Top Concern For Security Pros
Quick Hits  |  6/10/2013  | 
Insider threat tops list of worries for security pros; malware, unauthorized software also cause concern
Putting Vulnerabilities And Threats Into Context
Commentary  |  6/7/2013  | 
Advanced security research should play a role in your security program and be ready when science projects become weaponized attacks
Glasgow City Council Fined For Security Lapses
News  |  6/7/2013  | 
Stolen laptops and repeated cases of unencrypted data top the list of the City of Glasgow's security failings.
Google Ups Bug Bounty Awards
Quick Hits  |  6/7/2013  | 
Researchers now can get up to $7,500 per vulnerability they discover in Google applications
China To America: You Hack Us, Too
News  |  6/6/2013  | 
Difference is China doesn't point fingers, says head of China's computer emergency response team, even though it has "mountains" of evidence that U.S. snoops.
What To Ask Your Penetration Tester
Commentary  |  6/5/2013  | 
The importance of manual pen testing
ZeuS Malware Returns, Targets SMBs
News  |  6/5/2013  | 
ZeuS banking Trojan again puts small and midsize businesses at high risk. Here's what you need to know.
No Java Patch For You: 93 Percent Of Users Run Older Versions Of The App
Quick Hits  |  6/4/2013  | 
Many end users stuck with older Java to run certain apps, Websense finds
Anonymous Targets Turkish Government Websites
News  |  6/4/2013  | 
Hacktivists launch #OpTurkey DDoS campaign to support protests against government of Turkish prime minister Tayyip Erdogan.
LinkedIn, Evernote Add Two-Factor Authentication
News  |  6/4/2013  | 
Will LinkedIn and Evernote improve upon Apple and Twitter two-factor security systems, which have been widely criticized?
Are Businesses Knowingly Infecting Their Web Visitors?
News  |  6/3/2013  | 
Even after being informed of infrastructure serving up malware, some organizations still don't act to clean up their online messes
Oracle Promises Enterprise Java Security Tweaks
News  |  6/3/2013  | 
Critics say Oracle hasn't done enough to address ongoing security and code quality problems in the Java browser plug-in.
Fidelis Expands Into Malware Detection And Analysis
Quick Hits  |  6/1/2013  | 
New appliance for the Fortune 1000, SMB space


AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16319
PUBLISHED: 2019-09-15
In Wireshark 3.0.0 to 3.0.3 and 2.6.0 to 2.6.10, the Gryphon dissector could go into an infinite loop. This was addressed in plugins/epan/gryphon/packet-gryphon.c by checking for a message length of zero.
CVE-2019-16320
PUBLISHED: 2019-09-15
Cobham Sea Tel v170 224521 through v194 225444 devices allow attackers to obtain potentially sensitive information, such as a vessel's latitude and longitude, via the public SNMP community.
CVE-2019-16321
PUBLISHED: 2019-09-15
ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO.
CVE-2019-16317
PUBLISHED: 2019-09-14
In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a phar:// URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the phar://../../../../../../../../var/www/html/web/var/assets/ directory, a different vulnerabi...
CVE-2019-16318
PUBLISHED: 2019-09-14
In Pimcore before 5.7.1, an attacker with limited privileges can bypass file-extension restrictions via a 256-character filename, as demonstrated by the failure of automatic renaming of .php to .php.txt for long filenames, a different vulnerability than CVE-2019-10867 and CVE-2019-16317.