Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

News & Commentary

Content tagged with Vulnerabilities / Threats posted in August 2014
CryptoWall More Pervasive, Less Profitable Than CryptoLocker
News  |  8/28/2014  | 
The former CryptoLocker wannabe has netted 625,000 infected systems and more than $1 million in ransoms.
Backoff, Dairy Queen, UPS & Retail's Growing PoS Security Problem
News  |  8/27/2014  | 
Retail brands are trying to pass the buck for data security to banks and franchisees, say some experts.
How I Hacked My Home, IoT Style
Commentary  |  8/27/2014  | 
It didnt take long to find a score of vulnerabilities in my home entertainment, gaming, and network storage systems.
Top 5 Reasons Your Small Business Website is Under Attack
Commentary  |  8/26/2014  | 
There is no such thing as too small to hack. If a business has a website, hackers can exploit it.
All In For The Coming World of 'Things'
Commentary  |  8/25/2014  | 
At a Black Hat round table, experts discuss the strategies necessary to lock down the Internet of Things, the most game-changing concept in Internet history.
Flash Poll: CSOs Need A New Boss
Commentary  |  8/22/2014  | 
Only one out of four respondents to our flash poll think the CSO should report to the CIO.
Hacker Or Military? Best Of Both In Cyber Security
Commentary  |  8/21/2014  | 
How radically different approaches play out across the security industry.
Heartbleed Not Only Reason For Health Systems Breach
News  |  8/20/2014  | 
Community Health Systems' bad patching practices are nothing compared to its poor encryption, network monitoring, fraud detection, and data segmentation, experts say.
Debugging The Myths Of Heartbleed
Commentary  |  8/20/2014  | 
Does Heartbleed really wreak havoc without a trace? The media and many technical sites seemed convinced of this, but some of us were skeptical.
Q&A: DEF CON At 22
News  |  8/19/2014  | 
DEF CON founder Jeff Moss, a.k.a. The Dark Tangent, reflects on DEF CON's evolution, the NSA fallout, and wider security awareness.
Why John McAfee Is Paranoid About Mobile
Commentary  |  8/19/2014  | 
Mobile apps are posing expanding risks to both enterprises and their customers. But maybe being paranoid about mobile is actually healthy for security.
Cloud Apps & Security: When Sharing Matters
Commentary  |  8/18/2014  | 
Sharing documents and data is happening all over the cloud today but not all sharing activity carries equal risk.
Infographic: 70 Percent of World's Critical Utilities Breached
Commentary  |  8/15/2014  | 
New research from Unisys and Ponemon Institute finds alarming security gaps in worldwide ICS and SCADA systems within the last 12 months.
Test Drive: GFI LanGuard 2014
Commentary  |  8/15/2014  | 
LanGuard worked well in the lab and may prove more beneficial to IT operations than security teams.
Why Patching Makes My Heart Bleed
Commentary  |  8/14/2014  | 
Heartbleed was a simple mistake that was allowed to propagate through "business as usual" patching cycles and change management. It could easily happen again.
Internet Of Things Security Reaches Tipping Point
News  |  8/13/2014  | 
Public safety issues bubble to the top in security flaw revelations.
Security Holes Exposed In Trend Micro, Websense, Open Source DLP
News  |  8/12/2014  | 
Researchers Zach Lanier and Kelly Lum at Black Hat USA took the wraps off results of their security testing of popular data loss prevention software.
CloudBot: A Free, Malwareless Alternative To Traditional Botnets
News  |  8/11/2014  | 
Researchers take advantage of cloud service providers' free trials and lousy anti-automation controls to use cloud instances like bots.
Closing The Skills Gap Between Hackers & Defenders: 4 Steps
Commentary  |  8/11/2014  | 
Improvements in security education, budgets, tools, and methods will help our industry avoid more costly and dangerous attacks and data breaches in the future.
The Hyperconnected World Has Arrived
Commentary  |  8/8/2014  | 
Yes, the ever-expanding attack surface of the Internet of Things is overwhelming. But next-gen security leaders gathered at Black Hat are up to the challenge.
Heartbleed, GotoFail Bring Home Pwnie Awards
Quick Hits  |  8/7/2014  | 
The Pwnie Awards celebrate the best bug discoveries and worst security fails.
Dan Geer Touts Liability Policies For Software Vulnerabilities
News  |  8/6/2014  | 
Vendor beware. At Black Hat, Dan Geer suggests legislation to change product liability and abandonment rules for vulnerable and unsupported software.
The Illegitimate Milliners Guide to Black Hat
Commentary  |  8/6/2014  | 
A less-than-honest "Abe" goes undercover to get a behind-the-scenes look at Black Hat and its infamous attendees.
5 Steps To Supply Chain Security
News  |  8/6/2014  | 
The integrity of enterprise data is only as strong as your most vulnerable third-party supplier or business partner. It's time to shore up these connection points.
How Malware Writers Cheat AV Zero-Day Detection
News  |  8/4/2014  | 
A researcher reverse engineers AVG's code emulation engine after easily bypassing other major antivirus software products.
Is IT The New Boss Of Video Surveillance?
Commentary  |  8/4/2014  | 
ITs participation in the security of corporate video surveillance is growing, much to the chagrin of the physical security team. Heres why corporate infosec needs to pay attention.
'Backoff' Malware: Time To Step Up Remote Access Security
Commentary  |  8/1/2014  | 
DHS issues advisory about remote desktop access tools associated with recent point-of-sale breaches.
LIVE From Las Vegas: Dark Reading Radio at Black Hat
Commentary  |  8/1/2014  | 
If you can't physically be at Black Hat USA 2014, Dark Reading offers a virtual alternative where you can engage with presenters and attendees about hot show topics and trends.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-41617
PUBLISHED: 2021-09-26
sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with gro...
CVE-2021-3830
PUBLISHED: 2021-09-26
btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2021-21742
PUBLISHED: 2021-09-25
There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers could use this vulnerability to obtain some sensitive information of users by accessing specific pages.
CVE-2020-20508
PUBLISHED: 2021-09-24
Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hijack user credentials via a crafted payload in the E-Mail text field.
CVE-2020-20514
PUBLISHED: 2021-09-24
A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users.