Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Commentary

Content posted in March 2012
Forensic Approach To Mobile App Vulnerability Research
Commentary  |  3/30/2012  | 
Intro to a unique approach for vulnerability research on mobile apps using traditional PC forensic tools
Google Big Tent: Regulation Vs. Personal Responsibility
Commentary  |  3/29/2012  | 
Society should embrace the touch-the-stove approach when it comes to online common sense, explains 14-year-old Adora Svitak, author of no less than three books and advocate of techno-youth empowerment, at Google event on Web regulation.
Someone Left The Keys In Your Compliance System
Commentary  |  3/29/2012  | 
Information security is at the mercy of your entire staff's habits
A Single 'Pain' Of Glass?
Commentary  |  3/27/2012  | 
Is the often-pitched 'single pane of glass' a benefit to security monitoring tools or yet another point of contention?
Facebook's Privacy Two-Step On Passwords, Employers
Commentary  |  3/23/2012  | 
Facebook says sharing your password with a potential employer violates its rules. But will Facebook enforce this rule, when it still doesn't confirm user ages?
Technology Cannot Solve All Your People Problems
Commentary  |  3/22/2012  | 
Too many in business assume compliance is primarily a technology issue
Keep Your Friends Close, Especially If They Are Anonymous
Commentary  |  3/22/2012  | 
Sabu's traitorous ways reminds us of the sage advice to keep your friends close and your enemies closer
Fun With REMnux -- And New Malware Analysis Book
Commentary  |  3/22/2012  | 
"Practical Malware Analysis" provides in-depth knowledge on malware analysis and includes useful lab exercises. We take REMnux for a spin with the labs
Nobody Cares About HIPAA
Commentary  |  3/15/2012  | 
Compliance in many organizations is seen as only a costly inconvenience
Ron Was Wrong, Whit Is Right, And What You Need To Know
Commentary  |  3/13/2012  | 
Clarifying the technical findings on a weakness in RSA crypto keys and some recommendations on how to prepare and protect your assets from the next inevitable crypto weakness discovery
Big Data Security Or SIEM Buzzword Parity?
Commentary  |  3/9/2012  | 
If you attended the 2012 RSA Security Conference, BSides San Francisco, or the America’s Growth Capital Summit, you no doubt noticed claims of SIEM vendors jumping on the 'big data security' bandwagon
Six Things Management Needs To Better Understand About Compliance
Commentary  |  3/8/2012  | 
It may be boring or scary to management, but compliance is ultimately their burden to bear
Doing Tech Evangelism Right
Commentary  |  3/8/2012  | 
Kaspersky Lab's public request for help on an unsolved mystery surrounding Duqu serves as a case study about the power of technology evangelism
Anonymous Hackers' Helper: IT Security Neglect
Commentary  |  3/8/2012  | 
Despite successful FBI arrests of members of LulzSec and Anonymous, hacktivist attacks will continue so long as easy-to-exploit weaknesses persist. How much are our security practices to blame?
8 Privacy Threats Worse Than Google
Commentary  |  3/2/2012  | 
Google's privacy policy tweaks this week caused a fresh flurry of outrage. But Google should not be your top privacy worry.
10 Lessons From RSA Security Conference
Commentary  |  3/1/2012  | 
Mobile, social, and cloud computing have changed the security equation.
Carrier IQ Fights Back With Consumer Dashboard
Commentary  |  3/1/2012  | 
Carrier IQ, attacked last year for monitoring cell phone user data, says it can help consumers gauge wireless phone performance--if carriers implement the app.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Machine Learning, AI & Deep Learning Improve Cybersecurity
Machine intelligence is influencing all aspects of cybersecurity. Organizations are implementing AI-based security to analyze event data using ML models that identify attack patterns and increase automation. Before security teams can take advantage of AI and ML tools, they need to know what is possible. This report covers: -How to assess the vendor's AI/ML claims -Defining success criteria for AI/ML implementations -Challenges when implementing AI
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-3074
PUBLISHED: 2022-09-26
The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks.
CVE-2022-3076
PUBLISHED: 2022-09-26
The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.
CVE-2022-3098
PUBLISHED: 2022-09-26
The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
CVE-2022-3119
PUBLISHED: 2022-09-26
The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know...
CVE-2022-3135
PUBLISHED: 2022-09-26
The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)