Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Products and Releases

Content posted in January 2019
Social Engineering, Credential Compromise Jumped in 2018: Proofpoint
Products and Releases  |  1/25/2019  | 
Cybercriminals continue to target end users, requiring a people-centric security approach and demonstrating the importance of security awareness training.
nCipher Security Launches
Products and Releases  |  1/24/2019  | 
Newly formed organization preserves competition and ensures continued innovation in general purpose HSM market
Overlooked and Underappreciated? IT Security Professionals are Suffering from an Image Problem
Products and Releases  |  1/24/2019  | 
New Research from Thycotic reveals IT security professionals feel theyre seen as the doom mongers or a necessary evil by employees
Aspen Tech Policy Hub Launches Inaugural Fellowship Program
Products and Releases  |  1/18/2019  | 
New West Coast Initiative from the Aspen Institute Will Engage Technologists in Policymaking
Syncsort Survey Finds Disconnect Between Confidence in IT Security Programs and Data Breaches
Products and Releases  |  1/18/2019  | 
Despite an Optimistic Security Outlook, 61 Percent of Organizations Report They Have Either Experienced a Security Breach or Arent Sure
Trend Micro Rolls Out IoT Security 2.0
Products and Releases  |  1/9/2019  | 
Latest version of IoT security platform improves protection, visibility and control
FireEye Updates Email Security with New Threat Detection and Evasion Defenses Based on Insights from the Front Lines
Products and Releases  |  1/9/2019  | 
On-premises email enhancements include executive impersonation protection, expanded URL protection, a new machine learning engine to detect emerging threats, password-protected image analysis, and guest image customization
FireEye Introduces New Cloud Security Capabilities
Products and Releases  |  1/9/2019  | 
New cloud-focused capabilities bring best-in-class FireEye threat detection and protection regardless of location, defending increasingly complex hybrid security environments.
Nuspire Launches Managed Detection And Response Solution With Three Detection And Response Services
Products and Releases  |  1/7/2019  | 
Nuspires MDR solution to provide EDR, NDR and XDR services that detects and protects against malicious threats


When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162
PUBLISHED: 2021-01-15
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...
CVE-2021-21245
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to u...
CVE-2021-21246
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/` endpoint there are no security checks enforced so it is possible to retrieve ar...