Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
A Tale Of Two IoT Security Outcomes
Newest First  |  Oldest First  |  Threaded View
Some Guy
50%
50%
Some Guy,
User Rank: Moderator
9/8/2015 | 12:08:17 PM
Jeep Fix Available, but hardly Deployed
1.4M vehicles is a lot of service work, and a general hassle for the owners because, unlike Tesla, there is no over-the-air-update capability. (Maybe they should contract with Chris Valasek and Charlie Miller to do it for them. ;)

While we can claim Jeep got a fix, how many Chrysler vehicles affected by the hack have *actually* been updated? I think the best we can say is that a fix for this hack is available. I expect in the automotive industry's 8D, 8-step problem resolution model, this is really only step D3: interim containment. It's not even fully deployed, let alone verified as a permanent corrective action.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
8/27/2015 | 7:33:04 PM
IoT makers
This is the inherent problem with IoT.  IoT-enabled device manufacturers are not tech companies proper, lack the security mindset/culture of tech companies (not to mention the capability), and simply don't give two darns.  Perhaps that will change in the next five to ten years...or perhaps they'll keep trying to tell us that those kittens roasting in the oven are really biscuits.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29800
PUBLISHED: 2021-09-23
IBM Tivoli Netcool/OMNIbus_GUI and IBM Jazz for Service Management 1.1.3.10 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a t...
CVE-2021-36823
PUBLISHED: 2021-09-23
Authenticated Stored Cross-Site Scripting (XSS) vulnerability in WordPress Absolutely Glamorous Custom Admin plugin (versions <= 6.8). Stored XSS possible via unsanitized input fields of the plugin settings, some of the payloads could make the frontend and the backend inaccessible.
CVE-2021-36873
PUBLISHED: 2021-09-23
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress iQ Block Country plugin (versions <= 1.2.11). Vulnerable parameter: &blockcountry_blockmessage.
CVE-2021-38863
PUBLISHED: 2021-09-23
IBM Security Verify Bridge 1.0.5.0 stores user credentials in plain clear text which can be read by a locally authenticated user. IBM X-Force ID: 208154.
CVE-2021-38864
PUBLISHED: 2021-09-23
IBM Security Verify Bridge 1.0.5.0 could allow a user to obtain sensitive information due to improper certificate validation. IBM X-Force ID: 208155.