Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
10 Free Security Tools at Black Hat Asia 2021
Dark Reading Celebrates 15th Anniversary
Ghost Town Security: What Threats Lurk in Abandoned Offices?
In Appreciation: Dan Kaminsky
News & Commentary
Troy Hunt: Organizations Make Security Choices Tough for Users
Kelly Sheridan, Staff Editor, Dark ReadingNews
The Have I Been Pwned founder took the virtual stage at Black Hat Asia to share stories about his work and industrywide challenges.
By Kelly Sheridan Staff Editor, Dark Reading, 5/6/2021
Comment0 comments  |  Read  |  Post a Comment
New Techniques Emerge for Abusing Windows Services to Gain System Control
Jai Vijayan, Contributing WriterNews
Organizations should apply principles of least privilege to mitigate threats, security researcher says.
By Jai Vijayan Contributing Writer, 5/6/2021
Comment0 comments  |  Read  |  Post a Comment
Google Plans to Automatically Enable Two-Factor Authentication
Dark Reading Staff, Quick Hits
The company plans to automatically enroll users in two-step verification if their accounts are properly configured.
By Dark Reading Staff , 5/6/2021
Comment0 comments  |  Read  |  Post a Comment
CISA Publishes Analysis on New 'FiveHands' Ransomware
Dark Reading Staff, Quick Hits
Attackers used publicly available tools, FiveHands ransomware, and SombRAT to successfully target an organization, officials report.
By Dark Reading Staff , 5/6/2021
Comment0 comments  |  Read  |  Post a Comment
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing WriterNews
More companies moved to cloud-native infrastructure in the past year, and security incidents and malware moved right along with them.
By Robert Lemos Contributing Writer, 5/6/2021
Comment0 comments  |  Read  |  Post a Comment
Securing the Internet of Things in the Age of Quantum Computing
Dr. Charles Grover, Cryptography Researcher, Crypto QuantiqueCommentary
Internet security, privacy, and authentication aren't new issues, but IoT presents unique security challenges.
By Dr. Charles Grover Cryptography Researcher, Crypto Quantique, 5/6/2021
Comment0 comments  |  Read  |  Post a Comment
Biden's Supply Chain Initiative Depends on Cybersecurity Insights
Padraic O'Reilly, Chief Product Officer & Co-Founder of CyberSaint SecurityCommentary
Those helming the US supply chain executive order need to leverage standards, measurement, and the lessons cybersecurity leaders have learned.
By Padraic O'Reilly Chief Product Officer & Co-Founder of CyberSaint Security, 5/6/2021
Comment0 comments  |  Read  |  Post a Comment
How to Move Beyond Passwords and Basic MFA
Samuel Greengard, Freelance Writer
It's not a question of whether passwordless is coming -- it's simply a question of when. How should your organization prepare? (Part two of a two-part series.)
By Samuel Greengard Freelance Writer, 5/6/2021
Comment0 comments  |  Read  |  Post a Comment
Black Hat Asia Speakers Share Secrets About Sandboxes, Smart Doors, and Security
Dark Reading Staff,
Find video interviews with some of the coolest Black Hat Asia experts right here, as part of the Dark Reading News Desk this week.
By Dark Reading Staff , 5/6/2021
Comment0 comments  |  Read  |  Post a Comment
Attackers Seek New Strategies to Improve Macros' Effectiveness
Robert Lemos, Contributing WriterNews
The ubiquity of Microsoft Office document formats means attackers will continue to use them to spread malware and infect systems.
By Robert Lemos Contributing Writer, 5/5/2021
Comment0 comments  |  Read  |  Post a Comment
Gap Between Security and Networking Teams May Hinder Tech Projects
Dark Reading Staff, Quick Hits
Professionals in each field describe a poor working relationship between the two teams
By Dark Reading Staff , 5/5/2021
Comment0 comments  |  Read  |  Post a Comment
DoD Lets Researchers Target All Publicly Accessible Info Systems
Dark Reading Staff, Quick Hits
The Department of Defense expands its vulnerability disclosure program to include a broad range of new targets.
By Dark Reading Staff , 5/5/2021
Comment0 comments  |  Read  |  Post a Comment
Wanted: The (Elusive) Cybersecurity 'All-Star'
Steve Zurier, Contributing WriterNews
Separate workforce studies by (ISC)² and ISACA point to the need for security departments to work with existing staff to identify needs and bring entry-level people into the field.
By Steve Zurier Contributing Writer, 5/5/2021
Comment1 Comment  |  Read  |  Post a Comment
Debating Law Enforcement's Role in the Fight Against Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading
The FBI's action to remove Web shells from compromised Microsoft Exchange Servers sparks a broader discussion about officials' response to cyberattacks.
By Kelly Sheridan Staff Editor, Dark Reading, 5/5/2021
Comment0 comments  |  Read  |  Post a Comment
Will 2021 Mark the End of World Password Day?
Jake Madders, Director, Hyve Managed HostingCommentary
We might be leaving the world of mandatory asterisks and interrobangs behind for good.
By Jake Madders Director, Hyve Managed Hosting, 5/5/2021
Comment0 comments  |  Read  |  Post a Comment
Newer Generic Top-Level Domains a Security 'Nuisance'
Jai Vijayan, Contributing WriterNews
Ten years of passive DNS data shows classic TLDs such as .com and .net dominate newer TLDs in popularity and use.
By Jai Vijayan Contributing Writer, 5/4/2021
Comment0 comments  |  Read  |  Post a Comment
Apple Issues Patches for Webkit Security Flaws
Dark Reading Staff, Quick Hits
The vulnerabilities may already be under active attack, Apple says in an advisory.
By Dark Reading Staff , 5/4/2021
Comment0 comments  |  Read  |  Post a Comment
Planning Our Passwordless Future
Samuel Greengard, Freelance Writer
All the talk that passwords could one day go away seemed too good to be true, yet the scales are finally started to tip to a passwordless reality. (Part one of a two-part series.)
By Samuel Greengard Freelance Writer, 5/4/2021
Comment1 Comment  |  Read  |  Post a Comment
Hundreds of Millions of Dell Computers Potentially Vulnerable to Attack
Jai Vijayan, Contributing WriterNews
Hardware maker has issued an update to fix multiple critical privilege escalation vulnerabilities that have gone undetected since 2009.
By Jai Vijayan Contributing Writer, 5/4/2021
Comment0 comments  |  Read  |  Post a Comment
Raytheon: Supply Chain, Ransomware, Zero Trust Biggest Security Priorities
Dark Reading Staff, Commentary
SPONSORED CONTENT: While organizations may be more vulnerable than ever to supply chain attacks and ransomware, they can look to Zero Trust frameworks to keep their users and data safe, says Jon Check, senior director in Raytheon's cyber protection solutions unit.
By Dark Reading Staff , 5/4/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Products & Releases
SafeGuard Cyber Introduces Advanced Governance for Zoom Video Communications
Cyber Readiness Institute Calls on Biden Administration To Make Small Business Cybersecurity a National Priority
Secretary of Homeland Security to Participate in U.S. Chamber of Commerce NOW + NEXT
LiveAction Acquires CounterFlow AI to Expand Network Security Offerings
Sectigo Acquires SiteLock, Solidifying Its Market-Leading Position in Web Security
New Report Finds Online Phishing and Fraud Activity Up 185% in 2020
Mandiant Selects PlexTrac for its Proactive Assessment Reporting Platform
New Cybrary Feature Helps Leaders Translate Cybersecurity Skill Development into Meaningful Outcomes
More Products & Releases
PR Newswire
Dark Reading Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the Dark Reading site in the coming months.

How to Move Beyond Passwords and Basic MFA
It's not a question of whether passwordless is coming -- it's simply a question of when. How should your organization prepare? (Part two of a two-part series.)
Debating Law Enforcement's Role in the Fight Against Cybercrime
The FBI's action to remove Web shells from compromised Microsoft Exchange Servers sparks a broader discussion about officials' response to cyberattacks.
Planning Our Passwordless Future
All the talk that passwords could one day go away seemed too good to be true, yet the scales are finally started to tip to a passwordless reality. (Part one of a two-part series.)
Register for Dark Reading Newsletters
Cartoon Contest
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-36124
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE) injection. An authenticated attacker can compromise the private keys of a JWT token and reuse them to manipulate the access tokens to access the platform as any desired user (clients and administrators).
CVE-2020-36125
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control where password revalidation in sensitive operations can be bypassed remotely by an authenticated attacker through requesting the endpoint directly.
CVE-2020-36126
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control that can lead to remote privilege escalation. PAXSTORE marketplace endpoints allow an authenticated user to read and write data not owned by them, including third-party users, application and payment term...
CVE-2020-36127
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature functionality, an administrator will not have access to the current p12 certificate and password. When accessing this functionality, the administrator has the opt...
CVE-2020-36128
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing vulnerability. Each payment terminal has a session token (called X-Terminal-Token) to access the marketplace. This allows the store to identify the terminal and make available the applications distributed by its ...
Flash Poll
Video
Slideshows
Twitter Feed