Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Vulnerabilities / Threats posted in June 2013
HTTPS Side-Channel Attack A Tool For Encrypted Secret Theft
News  |  6/29/2013  | 
Researchers to release details on how SSL vulnerability gives attackers ability to steal everything from OAuth tokens to PII through an enterprise app in just 30 seconds
Machine-Learning Project Sifts Through Big Security Data
News  |  6/28/2013  | 
As the volume of data created by security and network devices multiplies, researchers look for ways to teach computer to better highlight attack patterns
3 Stupid Corporation Tricks
News  |  6/28/2013  | 
With exactly one month to go before the start of Black Hat USA 2013, we highlight a trio of Briefings that focus on data security in corporate environments.
The (Attack) Path To Prioritization
Commentary  |  6/28/2013  | 
Since you can't fix every vulnerability, you need to prioritize what needs to get done now and what doesn't. Using attack path data can help
IE, Chrome Browser Attack Exploits Windows PCs
News  |  6/28/2013  | 
Microsoft says the social-engineering vulnerability, which uses "pop-under" browser notifications and a fake Captcha, isn't a Windows bug.
96 Percent Of Androids Running Old OS Versions
Quick Hits  |  6/27/2013  | 
Some 90 percent of all mobile threats target the popular Android platform, Juniper Networks report says
Sextortion Warning: Masking Tape Time For Webcams
Commentary  |  6/27/2013  | 
"Camjacking" attacks activate your webcam and record your every move. Female images are in demand.
Researcher To Demo Spy-Phone At Black Hat
News  |  6/26/2013  | 
Using the ability to inject malicious code into applications on Android devices, a researcher will demonstrate at Black Hat how to create the infrastructure to spy on mobile users
Carberp Source Code Leak Likely To Spawn Malware Variants, Innovation
News  |  6/26/2013  | 
Source code for the Carberp Trojan has been leaked, creating a double-edged sword for security researchers
Germany Criticizes U.K. 'Project Tempora' Cyber Spy Program
News  |  6/26/2013  | 
German politician wants the EU to address reports that Britain's spymasters are even better at harvesting Internet traffic than their NSA allies.
Cybercriminals Expand DDOS Extortion Demands
News  |  6/26/2013  | 
Free toolkits and outsourced cybercrime services make DDoS attacks popular with Anonymous, criminals, unscrupulous business competitors and anyone with a grudge.
British Cyber Defenses Receive Unexpected Boost
News  |  6/26/2013  | 
British intelligence services and cybersecurity initiatives get increased investment, even amidst brutal government cuts.
Google Now Sharing Web Security Data
Quick Hits  |  6/25/2013  | 
Search engine giant's transparency report will now include data on numbers of malicious and infected websites, cleanup rates
Black Hat USA: T-Minus One Month And Counting
News  |  6/25/2013  | 
This highlighted trio of Briefings range widely in topic, yet they all sport that certain cool factor
Analyzing Vulnerabilities In Business-Critical Applications
Quick Hits  |  6/21/2013  | 
Fears of downtime and broken apps complicate the vulnerability scanning process. Here are some tips to help
Cloud Can Simplify Vulnerability Management For SMBs
News  |  6/21/2013  | 
Lacking security skills, most small and midsize businesses need help in locking down their information technology, including cataloging and triaging vulnerabilities
Microsoft Establishes Rewards Programs For Windows 8.1, Internet Explorer 11 Preview Security Bugs
News  |  6/19/2013  | 
Microsoft is launching new programs to get its hands on cutting-edge exploits developed by researchers
Microsoft Dangles $100,000 Bug Bounty
News  |  6/19/2013  | 
One hitch: The bugs might be worth more on the open market.
Slide Show: 10 Ways Attackers Automate Malware Production
Slideshows  |  6/18/2013  | 
Peeking into an attacker's toolbox to see how malware production is automated and the Internet is flooded with millions of unique malware applications
CrowdStrike Falcon Traces Attacks Back To Hackers
News  |  6/17/2013  | 
Startup that encourages playing offense on security launches cloud-based service to help businesses identify adversaries, mitigate attacks and pursue responses.
Researcher To Open-Source Tools For Finding Odd Authentication Behavior
News  |  6/15/2013  | 
Rather than watching for communications between infected systems and command-and-control servers, companies can detect stealthy malware when it attempts to spread
Black Hat USA 2013 Reveals Turbo Talks On Top Topics
News  |  6/14/2013  | 
High-speed sessions will focus on content from almost every corner of security space
Bug Data Buys Businesses Intel From U.S. Government
News  |  6/14/2013  | 
Thousands of businesses are reportedly exchanging information with the government on zero-day vulnerabilities and online threats in return for classified intelligence.
Cyberespionage Operators Work In Groups, Process Enormous Data Workloads
News  |  6/14/2013  | 
A group of Taiwanese researchers peer into the operations center of a group behind one large espionage campaign
0-Day The (Bug) Bounty Hunter
Commentary  |  6/13/2013  | 
Companies increasingly offer bug bounties to help find vulnerabilities and threats. This is an opportunity for those looking to get into security
New OWASP Top 10 Reflects Unchanged State Of Web Security
News  |  6/13/2013  | 
Injection flaws still rank No. 1 in Web application vulnerabilities
Don't Take Vulnerability Counts At Face Value
News  |  6/13/2013  | 
With flaw tallies varying by up to 75 percent, vulnerability data needs to be taken with a grain of salt, yet reports based on the data fail to include caveats, Black Hat presenters say
NSA Prism Fallout Delays EU Airline Database Vote
News  |  6/12/2013  | 
Accusations of "paranoia" and discrimination against non-U.S. citizens aired in Brussels this week -- though the importance of working with America on security was also a theme.
NSA Prism Relies Heavily On IT Contractors
News  |  6/11/2013  | 
NSA whistleblower Snowden likely enjoyed access to Prism program details as a contracted NSA IT administrator. Systems administrators remain an important link in your security chain.
U.S.-Chinese Summit: 4 Information Security Takeaways
News  |  6/10/2013  | 
What did the summit accomplish with regard to cyber spying and cyber attacks -- and what's left undone?
Study: Rogue Employees Are Top Concern For Security Pros
Quick Hits  |  6/10/2013  | 
Insider threat tops list of worries for security pros; malware, unauthorized software also cause concern
Putting Vulnerabilities And Threats Into Context
Commentary  |  6/7/2013  | 
Advanced security research should play a role in your security program and be ready when science projects become weaponized attacks
Glasgow City Council Fined For Security Lapses
News  |  6/7/2013  | 
Stolen laptops and repeated cases of unencrypted data top the list of the City of Glasgow's security failings.
Google Ups Bug Bounty Awards
Quick Hits  |  6/7/2013  | 
Researchers now can get up to $7,500 per vulnerability they discover in Google applications
China To America: You Hack Us, Too
News  |  6/6/2013  | 
Difference is China doesn't point fingers, says head of China's computer emergency response team, even though it has "mountains" of evidence that U.S. snoops.
What To Ask Your Penetration Tester
Commentary  |  6/5/2013  | 
The importance of manual pen testing
ZeuS Malware Returns, Targets SMBs
News  |  6/5/2013  | 
ZeuS banking Trojan again puts small and midsize businesses at high risk. Here's what you need to know.
No Java Patch For You: 93 Percent Of Users Run Older Versions Of The App
Quick Hits  |  6/4/2013  | 
Many end users stuck with older Java to run certain apps, Websense finds
Anonymous Targets Turkish Government Websites
News  |  6/4/2013  | 
Hacktivists launch #OpTurkey DDoS campaign to support protests against government of Turkish prime minister Tayyip Erdogan.
LinkedIn, Evernote Add Two-Factor Authentication
News  |  6/4/2013  | 
Will LinkedIn and Evernote improve upon Apple and Twitter two-factor security systems, which have been widely criticized?
Are Businesses Knowingly Infecting Their Web Visitors?
News  |  6/3/2013  | 
Even after being informed of infrastructure serving up malware, some organizations still don't act to clean up their online messes
Oracle Promises Enterprise Java Security Tweaks
News  |  6/3/2013  | 
Critics say Oracle hasn't done enough to address ongoing security and code quality problems in the Java browser plug-in.
Fidelis Expands Into Malware Detection And Analysis
Quick Hits  |  6/1/2013  | 
New appliance for the Fortune 1000, SMB space


COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24847
PUBLISHED: 2020-10-23
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticat...
CVE-2020-24848
PUBLISHED: 2020-10-23
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
CVE-2020-5990
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure.
CVE-2020-25483
PUBLISHED: 2020-10-23
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
CVE-2020-5977
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node module, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.