Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Commentary

Content posted in April 2006
Do Your Passwords Pass Microsoft's Test?
Commentary  |  4/25/2006  | 
There's a scene in the movie Spaceballs when King Roland, having given in to Dark Helmet's threats, tells him that the combination to his planet's "air shield" is 1, 2, 3, 4, 5. Exasperated, Dark Helmet responds, "That's the stupidest combination I've ever heard in my life! The kind of thing an idiot would have on his luggage!" Moments later, we learn that this is indeed the combination to the evil President Skroob's luggage. At this point, we're pretty sure that Lone Starr and the rest o
Security Research Isn't Pretty, But It's Necessary
Commentary  |  4/17/2006  | 
Security research is a dirty job, but somebody has to do it. Security researchers run an assembly line of self-aggrandizing publicity, churning out press releases and announcements patting themselves on the back for discovering security vulnerabilities in software by Microsoft, Oracle, and other major vendors. The researchers operate under a constant cloud of suspicion: Are they simply creating a climate of useless fear, stifling innovation, E-commerce, and technology implementation? Are they
Software Security Groupies Kiss And Tell
Commentary  |  4/13/2006  | 
Bet you didn't know that software companies, like rock stars, have groupies. Rock star groupies know every word to every one of their favorite band's songs, and they know how to wrangle backstage passes that make them privy to the band's inner workings. In my April 17 article on software companies and the security researcher groupies who love them, I spin a yarn about several instances where researchers found their way onto the proverbial tour bus. Do the people in charge of IT security really w
IT Security: Playing To Win
Commentary  |  4/11/2006  | 
Security company Fortify Software today released a Flash-based game called IT Defender that attempts to educate players about workplace security risks while they risk their jobs by playing a game at work. Sure, it's a PR ploy. But it's a good one. (Really, anything is better than another press release.) As a game, it's nothing groundbreaking, but it's nicely done for what it is.


News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15734
PUBLISHED: 2021-04-12
An Origin Validation Error vulnerability in Bitdefender Safepay allows an attacker to manipulate the browser's file upload capability into accessing other files in the same directory or sub-directories. This issue affects: Bitdefender Safepay versions prior to 25.0.7.29.
CVE-2020-7924
PUBLISHED: 2021-04-12
Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions late...
CVE-2021-27486
PUBLISHED: 2021-04-12
The Fatek Automation WinProladder Versions 3.3 and prior are vulnerable to an integer underflow, which may cause an out-of-bounds write and allow an attacker to execute arbitrary code.
CVE-2021-3465
PUBLISHED: 2021-04-12
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2020-15942
PUBLISHED: 2021-04-12
An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile.