Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

News & Commentary
Cloud Misconfiguration Mishaps Businesses Must Watch
Kelly Sheridan, Staff Editor, Dark ReadingNews
Cloud security experts explain which misconfigurations are most common and highlight other areas of the cloud likely to threaten businesses.
By Kelly Sheridan Staff Editor, Dark Reading, 9/30/2020
Comment0 comments  |  Read  |  Post a Comment
A Guide to the NIST Cybersecurity Framework
IFSEC Global, StaffNews
With cybersecurity threats growing exponentially, it has never been more important to put together an efficient cyber-risk management policy, and NIST's framework can help.
By By Julian Hall, Freelance Journalist and Copywriter, Textual Healing , 9/30/2020
Comment0 comments  |  Read  |  Post a Comment
COVID-19 Creates Opening for OT Security Reform
John Livingston,  CEO of Verve Industrial ProtectionCommentary
Operations technology was once considered low risk, at least until the virus came along and re-arranged the threat landscape.
By John Livingston CEO of Verve Industrial Protection, 9/30/2020
Comment0 comments  |  Read  |  Post a Comment
Phishing Attack Targets Microsoft 365 Users With Netflix & Amazon Lures
Dark Reading Staff, Quick Hits
Cyberattacker TA2552 primarily targets Spanish speakers with messages that leverage a narrow range of themes and popular brands.
By Dark Reading Staff , 9/30/2020
Comment0 comments  |  Read  |  Post a Comment
Attacker Dwell Time: Ransomware's Most Important Metric
Ricardo Villadiego, Founder and CEO of LumuCommentary
How to bolster security defenses by zeroing in on the length of time an interloper remains undetected inside your network.
By Ricardo Villadiego Founder and CEO of Lumu, 9/30/2020
Comment2 comments  |  Read  |  Post a Comment
DDoS Attacks Soar in First Half of 2020
Dark Reading Staff, Quick Hits
Shorter, faster, multivector attacks had a greater impact on victims.
By Dark Reading Staff , 9/29/2020
Comment0 comments  |  Read  |  Post a Comment
Vulnerability in Wireless Router Chipsets Prompts Advisory
Dark Reading Staff, Quick Hits
Synopsys issues an advisory for vulnerabilities affecting the chipsets of wireless routers from Qualcomm, Mediatek, and Realtek.
By Dark Reading Staff , 9/29/2020
Comment0 comments  |  Read  |  Post a Comment
Shifting Left of Left: Why Secure Code Isn't Always Quality Code
Matias Madou, CTO and co-founder, Secure Code WarriorCommentary
Enabling engineers to share responsibility for security and empowering them to erase common vulnerabilities are good starting points.
By Matias Madou CTO and co-founder, Secure Code Warrior, 9/29/2020
Comment0 comments  |  Read  |  Post a Comment
The Shared Irresponsibility Model in the Cloud Is Putting You at Risk
Dan Hubbard, CEO at LaceworkCommentary
Step up, put the architecture and organization in place, and take responsibility. If you don't, who will?
By Dan Hubbard CEO at Lacework, 9/29/2020
Comment0 comments  |  Read  |  Post a Comment
Ivanti Acquires Two Security Companies
Dark Reading Staff, Quick Hits
Purchase of MobileIron and Pulse Secure announced simultaneously.
By Dark Reading Staff , 9/28/2020
Comment0 comments  |  Read  |  Post a Comment
Safeguarding Schools Against RDP-Based Ransomware
James Lui, Ericom Group CTO, AmericasCommentary
How getting online learning right today will protect schools, and the communities they serve, for years to come.
By James Lui Ericom Group CTO, Americas, 9/28/2020
Comment1 Comment  |  Read  |  Post a Comment
MFA-Minded Attackers Continue to Figure Out Workarounds
Robert Lemos, Contributing WriterNews
While MFA can improve overall security posture, it's not a "silver bullet" -- and hacks continue.
By Robert Lemos Contributing Writer, 9/28/2020
Comment0 comments  |  Read  |  Post a Comment
6 Things to Know About the Microsoft 'Zerologon' Flaw
Jai Vijayan, Contributing WriterNews
Until all domain controllers are updated, the entire infrastructure remains vulnerable, the DHS' CISA warns.
By Jai Vijayan Contributing Writer, 9/25/2020
Comment0 comments  |  Read  |  Post a Comment
Navigating the Asia-Pacific Threat Landscape: Experts Dive In
Kelly Sheridan, Staff Editor, Dark ReadingNews
At next week's virtual Black Hat Asia, threat intelligence pros will discuss the threats local organizations should prioritize and how they can prepare.
By Kelly Sheridan Staff Editor, Dark Reading, 9/25/2020
Comment0 comments  |  Read  |  Post a Comment
Getting Over the Security-to-Business Communication Gap in DevSecOps
Ericka Chickowski, Contributing WriterNews
Application security in a DevOps world takes more than great teamwork among security, developers, and operations staff.
By Ericka Chickowski Contributing Writer, 9/25/2020
Comment0 comments  |  Read  |  Post a Comment
WannaCry Has IoT in Its Crosshairs
Ed Koehler, Distinguished Principal Security Engineer, Office of CTO, at Extreme NetworkCommentary
The wide variety of devices attached to the Internet of Things offers a rich target for purveyors of ransomware.
By Ed Koehler Distinguished Principal Security Engineer, Office of CTO, at Extreme Network, 9/25/2020
Comment0 comments  |  Read  |  Post a Comment
Bluetooth Security Weaknesses Pile Up, While Patching Remains Problematic
Robert Lemos, Contributing WriterNews
Turns out, creating wireless ecosystems for a vast number of different architectures, configurations, and use cases is hard.
By Robert Lemos Contributing Writer, 9/24/2020
Comment0 comments  |  Read  |  Post a Comment
Critical Instagram Flaw Could Let Attackers Spy on Victims
Kelly Sheridan, Staff Editor, Dark ReadingNews
A now-patched remote code execution vulnerability could be exploited with a specially sized image file, researchers report.
By Kelly Sheridan Staff Editor, Dark Reading, 9/24/2020
Comment0 comments  |  Read  |  Post a Comment
Solving the Problem With Security Standards
Adam Shostack, Consultant, Entrepreneur, Technologist, Game DesignerCommentary
More explicit threat models can make security better and open the door to real and needed innovation.
By Adam Shostack Consultant, Entrepreneur, Technologist, Game Designer, 9/24/2020
Comment0 comments  |  Read  |  Post a Comment
CrowdStrike Agrees to Acquire Preempt Security for $96M
Dark Reading Staff, Quick Hits
CrowdStrike plans to use Preempt Security's conditional access technology to strengthen its Falcon platform.
By Dark Reading Staff , 9/24/2020
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
9 Tips to Prepare for the Future of Cloud & Network Security
Kelly Sheridan, Staff Editor, Dark Reading,  9/28/2020
Attacker Dwell Time: Ransomware's Most Important Metric
Ricardo Villadiego, Founder and CEO of Lumu,  9/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15488
PUBLISHED: 2020-09-30
Re:Desk 2.3 allows insecure file upload.
CVE-2020-15849
PUBLISHED: 2020-09-30
Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates() method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for a...
CVE-2020-14375
PUBLISHED: 2020-09-30
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region of memory accessible by from both the virtual machine and the host. An attacker in a VM can change the contents of the memory after vhost_crypto has validated ...
CVE-2020-14376
PUBLISHED: 2020-09-30
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copying iv_data from the VM guest memory into host memory can lead to a large buffer overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...
CVE-2020-14377
PUBLISHED: 2020-09-30
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A complete lack of validation of attacker-controlled parameters can lead to a buffer over read. The results of the over read are then written back to the guest virtual machine memory. This vulnerability can be used by an attack...