Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

News & Commentary
Securing Containers with Zero Trust
Peter Smith, Founder & Chief Executive Officer, Edgewise NetworksCommentary
A software identity-based approach should become a standard security measure for protecting workloads in all enterprise networks.
By Peter Smith Founder & Chief Executive Officer, Edgewise Networks, 1/29/2020
Comment0 comments  |  Read  |  Post a Comment
Threat Hunting Is Not for Everyone
Anton Chuvakin, Head of Security Solution Strategy, ChronicleCommentary
Threat hunting is a sophisticated, advanced technique that should be reserved for specific instances and be conducted only by trained professionals.
By Anton Chuvakin Head of Security Solution Strategy, Chronicle, 1/29/2020
Comment1 Comment  |  Read  |  Post a Comment
'Understand What You Believe': Fmr. FBI Agent Unpacks Information Threats
Kelly Sheridan, Staff Editor, Dark ReadingNews
In the past few years, social media has transformed from a communications gold mine to a minefield of disinformation campaigns.
By Kelly Sheridan Staff Editor, Dark Reading, 1/28/2020
Comment0 comments  |  Read  |  Post a Comment
Russian Brothers Sentenced to 12 Years for Fraud and Identity Theft
Dark Reading Staff, Quick Hits
The pair, based in Fort Lauderdale, Fla., were running a sophisticated credit card fraud factory.
By Dark Reading Staff , 1/28/2020
Comment0 comments  |  Read  |  Post a Comment
Intel Previews Newest 'Zombieload' Patch
Dark Reading Staff, Quick Hits
Intel has promised a third patch to remediate the Zombieload speculative execution vulnerability.
By Dark Reading Staff , 1/28/2020
Comment0 comments  |  Read  |  Post a Comment
CCPA: Cut From the Same Cloth as PCI DSS
Jonathan Deveaux, Head of Enterprise Data Protection at comforte AGCommentary
Finally, some good news about CCPA: If you've built your security infrastructure to PCI DSS standards, you may be already covered by California's new data protection rules
By Jonathan Deveaux Head of Enterprise Data Protection at comforte AG, 1/28/2020
Comment0 comments  |  Read  |  Post a Comment
How to Get the Most Out of Your Security Metrics
Curtis Simpson, Chief Information Security Officer at ArmisCommentary
There's an art to reporting security metrics so that they speak the language of leadership and connect the data from tools to business objectives.
By Curtis Simpson Chief Information Security Officer at Armis, 1/27/2020
Comment1 Comment  |  Read  |  Post a Comment
'CardPlanet' Operator Pleads Guilty in Federal Court
Dark Reading Staff, Quick Hits
Russian national faced multiple charges in connection with operating the marketplace for stolen credit-card credentials, and a forum for VIP criminals to offer their services.
By Dark Reading Staff , 1/24/2020
Comment0 comments  |  Read  |  Post a Comment
7 Steps to IoT Security in 2020
Curtis Franklin Jr., Senior Editor at Dark Reading
There are important steps security teams should take to be ready for the evolving security threats to the IoT in 2020.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 1/24/2020
Comment0 comments  |  Read  |  Post a Comment
DHS Warns of Increasing Emotet Risk
Dark Reading Staff, Quick Hits
Emotet is considered one of the most damaging banking Trojans, primarily through its ability to carry other malware into an organization.
By Dark Reading Staff , 1/23/2020
Comment0 comments  |  Read  |  Post a Comment
NSA Offers Guidance on Mitigating Cloud Flaws
Dark Reading Staff, Quick Hits
A new document separates cloud vulnerabilities into four classes and offers mitigations to help businesses protect cloud resources.
By Dark Reading Staff , 1/23/2020
Comment0 comments  |  Read  |  Post a Comment
Severe Vulnerabilities Discovered in GE Medical Devices
Kelly Sheridan, Staff Editor, Dark ReadingNews
CISA has released an advisory for six high-severity CVEs for GE Carescape patient monitors, Apex Pro, and Clinical Information Center systems.
By Kelly Sheridan Staff Editor, Dark Reading, 1/23/2020
Comment0 comments  |  Read  |  Post a Comment
Weathering the Privacy Storm from GDPR to CCPA & PDPA
Mark McClain, CEO & Co-founderCommentary
A general approach to privacy, no matter the regulation, is the only way companies can avoid a data protection disaster in 2020 and beyond.
By Mark McClain CEO & Co-founder, 1/23/2020
Comment0 comments  |  Read  |  Post a Comment
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark ReadingNews
New research finds security operations centers suffer high turnover and yield mediocre results for the investment they require.
By Kelly Sheridan Staff Editor, Dark Reading, 1/22/2020
Comment1 Comment  |  Read  |  Post a Comment
Eight Flaws in MSP Software Highlight Potential Ransomware Vector
Robert Lemos, Contributing WriterNews
An attack chain of vulnerabilities in ConnectWise's software for MSPs has similarities to some of the details of the August attack on Texas local and state agencies.
By Robert Lemos Contributing Writer, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Why DPOs and CISOs Must Work Closely Together
Rajesh Ganesan, Vice President at ManageEngineCommentary
Recent data protection laws mean that the data protection officer and CISO must work in tandem to make sure users' data is protected.
By Rajesh Ganesan Vice President at ManageEngine, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Cybersecurity Lessons Learned from 'The Rise of Skywalker'
Matt Davey, Chief Operations Optimist, 1PasswordCommentary
They're especially relevant regarding several issues we face now, including biometrics, secure data management, and human error with passwords.
By Matt Davey Chief Operations Optimist, 1Password, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Microsoft, DHS Warn of Zero-Day Attack Targeting IE Users
Robert Lemos, Contributing WriterNews
Software firm is "aware of limited targeted attacks" exploiting a scripting issue vulnerability in Internet Explorer 9, 10, and 11 that previously has not been disclosed.
By Robert Lemos Contributing Writer, 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
New Ransomware Tactic Shows How Windows EFS Can Aid Attackers
Kelly Sheridan, Staff Editor, Dark ReadingNews
Researchers have discovered how ransomware can take advantage of the Windows Encrypting File System, prompting security vendors to release patches.
By Kelly Sheridan Staff Editor, Dark Reading, 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
FireEye Buys Cloudvisory
Dark Reading Staff, Quick Hits
The purchase is intended to bring new cloud capabilities to the FireEye Helix security platform.
By Dark Reading Staff , 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
Greater Focus on Privacy Pays Off for Firms
Robert Lemos, Contributing Writer,  1/27/2020
Average Ransomware Payments More Than Doubled in Q4 2019
Jai Vijayan, Contributing Writer,  1/27/2020
Emerging Long-Range WAN Networks Vulnerable to Hacking, Compromise
Jai Vijayan, Contributing Writer,  1/28/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Physical Security Privilege Escalation
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-3719
PUBLISHED: 2020-01-29
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have an sql injection vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2020-3758
PUBLISHED: 2020-01-29
Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.
CVE-2020-8432
PUBLISHED: 2020-01-29
In Das U-Boot through 2020.01, a double free has been found in the cmd/gpt.c do_rename_gpt_parts() function. Double freeing may result in a write-what-where condition, allowing an attacker to execute arbitrary code. NOTE: this vulnerablity was introduced when attempting to fix a memory leak identifi...
CVE-2020-3710
PUBLISHED: 2020-01-29
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2020-3711
PUBLISHED: 2020-01-29
Adobe Illustrator CC versions 24.0 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.