Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

News & Commentary
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark ReadingNews
New research finds security operations centers suffer high turnover and yield mediocre results for the investment they require.
By Kelly Sheridan Staff Editor, Dark Reading, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Eight Flaws in MSP Software Highlight Potential Ransomware Vector
Robert Lemos, Contributing WriterNews
An attack chain of vulnerabilities in ConnectWise's software for MSPs has similarities to some of the details of the August attack on Texas local and state agencies.
By Robert Lemos Contributing Writer, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Why DPOs and CISOs Must Work Closely Together
Rajesh Ganesan, Vice President at ManageEngineCommentary
Recent data protection laws mean that the data protection officer and CISO must work in tandem to make sure users' data is protected.
By Rajesh Ganesan Vice President at ManageEngine, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Cybersecurity Lessons Learned from 'The Rise of Skywalker'
Matt Davey, Chief Operations Optimist, 1PasswordCommentary
They're especially relevant regarding several issues we face now, including biometrics, secure data management, and human error with passwords.
By Matt Davey Chief Operations Optimist, 1Password, 1/22/2020
Comment0 comments  |  Read  |  Post a Comment
Microsoft, DHS Warn of Zero-Day Attack Targeting IE Users
Robert Lemos, Contributing WriterNews
Software firm is "aware of limited targeted attacks" exploiting a scripting issue vulnerability in Internet Explorer 9, 10, and 11 that previously has not been disclosed.
By Robert Lemos Contributing Writer, 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
New Ransomware Tactic Shows How Windows EFS Can Aid Attackers
Kelly Sheridan, Staff Editor, Dark ReadingNews
Researchers have discovered how ransomware can take advantage of the Windows Encrypting File System, prompting security vendors to release patches.
By Kelly Sheridan Staff Editor, Dark Reading, 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
FireEye Buys Cloudvisory
Dark Reading Staff, Quick Hits
The purchase is intended to bring new cloud capabilities to the FireEye Helix security platform.
By Dark Reading Staff , 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
Ransomware Upgrades with Credential-Stealing Tricks
Dark Reading Staff, Quick Hits
The latest version of the FTCode ransomware can steal credentials from five popular browsers and email clients.
By Dark Reading Staff , 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
Data Awareness Is Key to Data Security
Moti Gindi, Corporate Vice President, Microsoft Defender Advanced Threat ProtectionCommentary
Traditional data-leak prevention is not enough for businesses facing today's dynamic threat landscape.
By Moti Gindi Corporate Vice President, Microsoft Defender Advanced Threat Protection, 1/21/2020
Comment0 comments  |  Read  |  Post a Comment
Are We Secure Yet? How to Build a 'Post-Breach' Culture
Rich Armour, Former General Motors CISO & an advisor to Nozomi NetworksCommentary
There are many ways to improve your organization's cybersecurity practices, but the most important principle is to start from the top.
By Rich Armour Former General Motors CISO & an advisor to Nozomi Networks, 1/20/2020
Comment0 comments  |  Read  |  Post a Comment
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark ReadingNews
A new report from Check Point recaps the cybercrime trends, statistics, and vulnerabilities that defined the security landscape in 2019.
By Kelly Sheridan Staff Editor, Dark Reading, 1/17/2020
Comment3 comments  |  Read  |  Post a Comment
FBI Seizes Domain That Sold Info Stolen in Data Breaches
Dark Reading Staff, Quick Hits
The website, WeLeakData.com, claimed to have more than 12 billion records gathered from over 10,000 breaches.
By Dark Reading Staff , 1/17/2020
Comment0 comments  |  Read  |  Post a Comment
ADP Users Hit with Phishing Scam Ahead of Tax Season
Dark Reading Staff, Quick Hits
Fraudulent emails tell recipients their W-2 forms are ready and prompt them to click malicious links.
By Dark Reading Staff , 1/17/2020
Comment0 comments  |  Read  |  Post a Comment
Massive Oracle Patch Reverses Company's Trend Toward Fewer Flaws
Robert Lemos, Contributing WriterNews
Following a year that saw the fewest number of vulnerabilities reported since 2015, Oracle's latest quarterly patch fixes nearly 200 new vulnerabilities.
By Robert Lemos Contributing Writer, 1/17/2020
Comment0 comments  |  Read  |  Post a Comment
Phishing Today, Deepfakes Tomorrow: Training Employees to Spot This Emerging Threat
Ian Cruxton, CSO, CallsignCommentary
Cybercriminals are evolving their tactics, and the security community anticipates voice and video fraud to play a role in one of the next big data breaches -- so start protecting your business now.
By Ian Cruxton CSO, Callsign, 1/16/2020
Comment0 comments  |  Read  |  Post a Comment
CISO Resigns From Pete Buttigieg Presidential Campaign
Dark Reading Staff, Quick Hits
The only Democratic campaign known to have a CISO loses Mick Baccio due to a "fundamental philosophical difference with campaign management."
By Dark Reading Staff , 1/16/2020
Comment0 comments  |  Read  |  Post a Comment
NY Fed Reveals Implications of Cyberattack on US Financial System
Dark Reading Staff, Quick Hits
A "pre-mortem analysis" sheds light on the potential destruction of a cyberattack against major US banks.
By Dark Reading Staff , 1/16/2020
Comment0 comments  |  Read  |  Post a Comment
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double OctopusCommentary
AD is still the single point of authentication for most companies that use Windows. But it has some shortcomings that should be addressed.
By Raz Rafaeli CEO and Co-Founder at Secret Double Octopus, 1/16/2020
Comment2 comments  |  Read  |  Post a Comment
New Report Spotlights Changes in Phishing Techniques
Kelly Sheridan, Staff Editor, Dark ReadingNews
Common and evolving strategies include the use of zero-font attacks, homograph attacks, and new tactics for fake attachments.
By Kelly Sheridan Staff Editor, Dark Reading, 1/15/2020
Comment0 comments  |  Read  |  Post a Comment
How to Comprehend the Buzz About Honeypots
Curtis Franklin Jr., Senior Editor at Dark Reading
Honeypots are crucial tools for security researchers and security teams. Understanding what they are and what they can do can be critical for making them safe and useful for your organization.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 1/15/2020
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
New Attack Campaigns Suggest Emotet Threat Is Far From Over
Jai Vijayan, Contributing Writer,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20399
PUBLISHED: 2020-01-23
A timing vulnerability in the Scalar::check_overflow function in Parity libsecp256k1-rs before 0.3.1 potentially allows an attacker to leak information via a side-channel attack.
CVE-2020-7915
PUBLISHED: 2020-01-22
An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.
CVE-2019-20391
PUBLISHED: 2020-01-22
An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.
CVE-2019-20392
PUBLISHED: 2020-01-22
An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.
CVE-2019-20393
PUBLISHED: 2020-01-22
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.