Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

News & Commentary
Bolstering Our Nation's Defenses Against Cybersecurity Attacks
Shawn Henry, CrowdStrike president of services and CSOCommentary
Shawn Henry, former Executive Assistant Director of the FBI and current CrowdStrike president of services and CSO, shares the top three cybersecurity priorities that the Biden administration needs to address.
By Shawn Henry CrowdStrike president of services and CSO, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing WriterNews
The number of components in the average application rose 77% over two years. No wonder, then, that 84% of codebases have at least one vulnerability.
By Robert Lemos Contributing Writer, 4/14/2021
Comment0 comments  |  Read  |  Post a Comment
DNS Vulnerabilities Expose Millions of Internet-Connected Devices to Attack
Jai Vijayan, Contributing WriterNews
Researchers uncover a fresh set of nine vulnerabilities in four TCP/IP stacks that are widely used in everything from powerful servers and firewalls to consumer IoT products.
By Jai Vijayan Contributing Writer, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
NSA Alerted Microsoft to New Exchange Server Vulnerabilities
Kelly Sheridan, Staff Editor, Dark ReadingNews
Microsoft today patched 114 CVEs to address the Exchange Server flaws, more than 50 remote code execution vulnerabilities, and one zero-day.
By Kelly Sheridan Staff Editor, Dark Reading, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Compromised Microsoft Exchange Server Used to Host Cryptominer
Dark Reading Staff, Quick Hits
Researchers say an unknown attacker is targeting vulnerable Exchange Servers with a payload hosted on a compromised Exchange Server.
By Dark Reading Staff , 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Dark Reading to Upgrade Site Design, Performance
Tim Wilson, Editor in Chief, Dark Reading, Commentary
Improvements will make site content easier to navigate, faster, and more functional.
By Tim Wilson, Editor in Chief, Dark Reading , 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
5 Objectives for Establishing an API-First Security Strategy
Ryan Nolette, Technical Security Lead at PostmanCommentary
With APIs predicted to be the most common attack vector by 2022, an API-first security strategy is critical now more than ever.
By Ryan Nolette Technical Security Lead at Postman, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Clear & Present Danger: Data Hoarding Undermines Better Security
Elissa M. Redmiles, Researcher, Max Planck Institute for Software SystemsCommentary
Facebook and Google can identify patterns of attack within their own data, but smaller businesses rarely see enough traffic to successfully identify an attack or warn users.
By Elissa M. Redmiles Researcher, Max Planck Institute for Software Systems, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Microsoft Warns of Malware Delivery via Google URLs
Dark Reading Staff, Quick Hits
A new campaign abuses legitimate website contact forms to send URLs that ultimately deliver the IcedID banking Trojan.
By Dark Reading Staff , 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Federal Reserve Chairman Says Cyber-Risk a Top Threat to National Economy
Dark Reading Staff, Quick Hits
Jerome Powell tells 60 Minutes that cyberattacks have the potential to do major damage to US financial system.
By Dark Reading Staff , 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Microsoft Uses Machine Learning to Predict Attackers' Next Steps
Robert Lemos, Contributing WriterNews
Researchers build a model to attribute attacks to specific groups based on tactics, techniques, and procedures, and then figure out their next move.
By Robert Lemos Contributing Writer, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
New Malware Downloader Spotted in Targeted Campaigns
Jai Vijayan, Contributing WriterNews
Saint Bot is being used to drop stealers on compromised systems but could be used to deliver any malware.
By Jai Vijayan Contributing Writer, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Wake Up and Smell the JavaScript
Deepika Gajaria, VP of Products, Tala SecurityCommentary
The SolarWinds attack showed the true meaning of a supply chain breach. And it's the canary in the coal mine for sensitive data on the Web.
By Deepika Gajaria VP of Products, Tala Security, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Omdia Research Spotlight: XDR
Eric Parizo, Senior Analyst, OmdiaCommentary
Few emerging cybersecurity market segments are garnering more attention than XDR. Here, Omdia highlights its recent research on XDR.
By Eric Parizo Senior Analyst, Omdia, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Unofficial Android App Store APKPure Infected With Malware
Dark Reading Staff, Quick Hits
The APKPure app store was infected with malware that can download Trojans to other Android devices, researchers report.
By Dark Reading Staff , 4/9/2021
Comment0 comments  |  Read  |  Post a Comment
CISA Launches New Threat Detection Dashboard
Dark Reading Staff, Quick Hits
Aviary is a new dashboard that works with CISA's Sparrow threat detection tool.
By Dark Reading Staff , 4/9/2021
Comment0 comments  |  Read  |  Post a Comment
Zoom Joins Microsoft Teams on List of Enterprise Tools Hacked at Pwn2Own
Jai Vijayan, Contributing WriterNews
White-hat hacking event shows yet again why there's no such thing as foolproof security against modern attacks.
By Jai Vijayan Contributing Writer, 4/8/2021
Comment0 comments  |  Read  |  Post a Comment
Fraudsters Use HTML Legos to Evade Detection in Phishing Attack
Dark Reading Staff, Quick Hits
Criminals stitch pieces of HTML together and hide them in JavaScript files, researchers report.
By Dark Reading Staff , 4/8/2021
Comment0 comments  |  Read  |  Post a Comment
Handcuffs Over AI: Solving Security Challenges With Law Enforcement
Charles Herring, CTO and Co-Founder, WitFooCommentary
We've tried everything else ... now it's time to make the prospect of getting caught -- and punished -- a real deterrent to cybercrime.
By Charles Herring CTO and Co-Founder, WitFoo, 4/8/2021
Comment4 comments  |  Read  |  Post a Comment
Voice-Changing Software Found on APT Attackers' Server
Kelly Sheridan, Staff Editor, Dark ReadingQuick Hits
Security researchers believe the presence of Morph Vox Pro could indicate APT-C-23 has new plans for their phishing campaigns.
By Kelly Sheridan Staff Editor, Dark Reading, 4/7/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-22879
PUBLISHED: 2021-04-14
Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation.
CVE-2021-27989
PUBLISHED: 2021-04-14
Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters within /medianet/sgcontentset.aspx.
CVE-2021-25316
PUBLISHED: 2021-04-14
A Insecure Temporary File vulnerability in s390-tools of SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-SP2 allows local attackers to prevent VM live migrations This issue affects: SUSE Linux Enterprise Server 12-SP5 s390-tools versions prior to 2.1.0-18.29.1. SUSE Linux Enterp...
CVE-2021-28797
PUBLISHED: 2021-04-14
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (an...
CVE-2020-36323
PUBLISHED: 2021-04-14
In the standard library in Rust before 1.50.3, there is an optimization for joining strings that can cause uninitialized bytes to be exposed (or the program to crash) if the borrowed string changes after its length is checked.