Commentary

Content posted in July 2007
Cybercriminal Innovation Will Continue To Drive The IT Security Market
Commentary  |  7/26/2007  | 
The creativity and ambition of cybercriminals all but ensure for years to come there will be a market not only for security technology but for individual security components provided by a multiplicity of vendors.
China Weighs In On Its IT Security Challenges
Commentary  |  7/20/2007  | 
A blog by my InformationWeek China colleague Jon Tian entitled "Borders of Information Security" provides some cultural perspective for several key findings in InformationWeek Research's 10th annual Global Information Security Survey.
China's Security Syndrome
Commentary  |  7/19/2007  | 
InformationWeek Research's 10th annual Global Information Security Survey highlights some very different security concerns facing Chinese businesses as compared with their U.S. counterparts.
Who's Fighting Identity Theft? You'd Be Surprised
Commentary  |  7/12/2007  | 
I love a good scrap, and one of the more interesting ones I've been following this year involves the U.S. Justice Department and E-Gold, an organization that provides a payment system for online transactions. The government says that E-Gold facilitates cybercrime by allowing the criminal element to pay online for stolen goo
Are You Spending Your IT Security Dollars Wisely? If You Don't Know, You're Not Alone
Commentary  |  7/11/2007  | 
How do companies know they're getting their money's worth when they invest in IT security products and services? InformationWeek's upcoming 10th Annual Global Security Survey indicates that a surprising number of companies don't measure the value of their security investments at all. (Hint: it's up from last year).
Security Star Shares Top 5 Most Popular Web 2.0 Services Sure To Be A Hit With Hackers
Commentary  |  7/3/2007  | 
As I was checking out what's going on today (and, let's be honest, thinking about my July 4 plans), I came across a blog posting that I couldn't resist sharing with InformationWeek readers. It's entitled "The Top 5 most Popular Web2.0 Services Hackers Cannot live Without," and it includes mashups, RSS readers, and an online database app.


Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
White Hat to Black Hat: What Motivates the Switch to Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
PGA of America Struck By Ransomware
Dark Reading Staff 8/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3937
PUBLISHED: 2018-08-14
An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A specially crafted GET request can cause arbitrary commands to be executed. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2018-3938
PUBLISHED: 2018-08-14
An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 firmware 1.87.00. A specially crafted POST can cause a stack-based buffer overflow, resulting in remote code execution. An attacker can send a malicious POST r...
CVE-2018-12537
PUBLISHED: 2018-08-14
In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
CVE-2018-12539
PUBLISHED: 2018-08-14
In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows,...
CVE-2018-3615
PUBLISHED: 2018-08-14
Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via a side-channel analysis.