Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

News & Commentary
Human Nature vs. AI: A False Dichotomy?
John McClurg, Sr. VP & CISO, BlackBerryCommentary
How the helping hand of artificial intelligence allows security teams to remain human while protecting themselves from their own humanity being used against them.
By John McClurg Sr. VP & CISO, BlackBerry, 11/18/2019
Comment0 comments  |  Read  |  Post a Comment
Facebook Discloses WhatsApp MP4 Video Vulnerability
Dark Reading Staff, Quick Hits
A stack-based buffer overflow bug can be exploited by sending a specially crafted video file to a WhatsApp user.
By Dark Reading Staff , 11/18/2019
Comment0 comments  |  Read  |  Post a Comment
Quantum Computing Breakthrough Accelerates the Need for Future-Proofed PKI
Kevin von Keyserling & JD Kilgallin, Co-Founder & Chief Strategy officer; Senior Integration Engineer at KeyfactorCommentary
Public key infrastructure is a foundational security tool that has evolved to become a critical base for future advancements. Today's generation of PKI can be coupled with quantum-resistant algorithms to extend the lifespan of digital certificates for decades.
By Kevin von Keyserling & JD Kilgallin Co-Founder & Chief Strategy officer; Senior Integration Engineer at Keyfactor, 11/18/2019
Comment0 comments  |  Read  |  Post a Comment
Illegal Booter Connected with DDoSes Sentenced to Prison, Fine
Dark Reading Staff, Quick Hits
The Illinois-based man operated a criminal service that launched millions of DDoS attacks and brought in hundreds of thousands of dollars.
By Dark Reading Staff , 11/15/2019
Comment0 comments  |  Read  |  Post a Comment
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing WriterNews
Based on penetration tests and vulnerability assessments, attackers' costs to compromise a company's network increases significantly when security is continuously tested, a report finds.
By Robert Lemos Contributing Writer, 11/15/2019
Comment1 Comment  |  Read  |  Post a Comment
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at NetskopeCommentary
There's a skills and resources gap industrywide, but a DevSecOps approach can go a long way toward closing that gap.
By Lamont Orange Chief Information Security Officer at Netskope, 11/15/2019
Comment2 comments  |  Read  |  Post a Comment
Symantec, McAfee Patch Privilege Escalation Bugs
Jai Vijayan, Contributing WriterNews
All versions of endpoint protection software from both vendors were susceptible to near identical issue, SafeBreach says.
By Jai Vijayan Contributing Writer, 11/14/2019
Comment0 comments  |  Read  |  Post a Comment
BSIMM10 Shows Industry Vertical Maturity
Sammy Migues, BSIMM Co-Author and Principal Scientist at SynopsysCommentary
The Building Security In Maturity Model is the only detailed measuring stick for software security initiatives, and it continues to evolve.
By Sammy Migues BSIMM Co-Author and Principal Scientist at Synopsys, 11/14/2019
Comment0 comments  |  Read  |  Post a Comment
Capture the Flag Planned to Find Missing Persons Information
Dark Reading Staff, Quick Hits
The competition, launched by SANS and Trace Labs, will put to use open source information in search of new clues.
By Dark Reading Staff , 11/14/2019
Comment0 comments  |  Read  |  Post a Comment
Attacks on Healthcare Jump 60% in 2019 - So Far
Robert Lemos, Contributing WriterNews
Well-known Trojans Emotet and Trickbot are cybercriminals' favorite weapons in their campaigns.
By Robert Lemos Contributing Writer, 11/14/2019
Comment0 comments  |  Read  |  Post a Comment
5 Cybersecurity CISO Priorities for the Future
Paul Shomo, Cybersecurity AnalystCommentary
Seven chief information security officers share their pain points and two-year spending plans.
By Paul Shomo Cybersecurity Analyst, 11/14/2019
Comment0 comments  |  Read  |  Post a Comment
US-CERT Warns of Remotely Exploitable Bugs in Medical Devices
Dark Reading Staff, Quick Hits
Vulnerabilities in key surgical equipment could be remotely exploited by a low-skill attacker.
By Dark Reading Staff , 11/14/2019
Comment0 comments  |  Read  |  Post a Comment
How Does Your Cyber Resilience Measure Up?
Troy Mattern, Vice President for Product and Services Cybersecurity at Motorola SolutionsCommentary
The security measures companies take today may not be enough for tomorrow's cyber assault, but switching to a proactive, risk-based framework may better protect your organization.
By Troy Mattern Vice President for Product and Services Cybersecurity at Motorola Solutions, 11/14/2019
Comment0 comments  |  Read  |  Post a Comment
Self-Cleaning Payment Card-Skimmer Infects E-Commerce Sites
Jai Vijayan, Contributing WriterNews
'Pipka' JavaScript skimmer has infected at least 16 e-commerce websites so far, according to Visa's Payment Fraud Disruption Group.
By Jai Vijayan Contributing Writer, 11/13/2019
Comment0 comments  |  Read  |  Post a Comment
Cybersecurity: An Organizationwide Responsibility
Guy Bunker, CTO of ClearswiftCommentary
C-suite execs must set an example of good practices while also supporting the IT department with enough budget to protect the organization from next-generation cyberattacks.
By Guy Bunker CTO of Clearswift, 11/13/2019
Comment0 comments  |  Read  |  Post a Comment
The Ripple Effect of Data Breaches: How Damage Spreads
Kelly Sheridan, Staff Editor, Dark ReadingNews
The financial loss from so-called 'ripple events' is thirteen times greater than the cost of single-party security incidents.
By Kelly Sheridan Staff Editor, Dark Reading, 11/13/2019
Comment0 comments  |  Read  |  Post a Comment
Breaches Are Inevitable, So Embrace the Chaos
Ariel Zeitlin, Chief Technology Officer & Co-Founder, GuardicoreCommentary
Avoid sinking security with principles of shipbuilding known since the 15th century.
By Ariel Zeitlin Chief Technology Officer & Co-Founder, Guardicore, 11/13/2019
Comment1 Comment  |  Read  |  Post a Comment
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLensCommentary
Perfection is impossible, and pretending otherwise just makes things worse. Instead, make risk-based decisions.
By Jack Freund Director, Risk Science at RiskLens, 11/13/2019
Comment1 Comment  |  Read  |  Post a Comment
Microsoft Patches IE Zero-Day Among 74 Vulnerabilities
Kelly Sheridan, Staff Editor, Dark ReadingNews
The November Patch Tuesday update fixed 13 critical flaws, including a zero-day bug in Internet Explorer.
By Kelly Sheridan Staff Editor, Dark Reading, 11/12/2019
Comment0 comments  |  Read  |  Post a Comment
The Myths of Multifactor Authentication
Franois Amigorena, Founder & CEO, IS DecisionsCommentary
Organizations without MFA are wide open to attack when employees fall for phishing scams or share passwords. What's holding them back?
By Franois Amigorena Founder & CEO, IS Decisions, 11/12/2019
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by robertmbaker
Current Conversations hi
In reply to: thank pro
Post Your Own Reply
Posted by ronaldjeichner
Current Conversations thank so much
In reply to: thank pro
Post Your Own Reply
More Conversations
PR Newswire
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5102
PUBLISHED: 2019-11-18
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by per...
CVE-2019-5688
PUBLISHED: 2019-11-18
NVIDIA NVFlash, NVUFlash Tool prior to v5.588.0 and GPUModeSwitch Tool prior to 2019-11, NVIDIA kernel mode driver (nvflash.sys, nvflsh32.sys, and nvflsh64.sys) contains a vulnerability in which authenticated users with administrative privileges can gain access to device memory and registers of othe...
CVE-2011-5330
PUBLISHED: 2019-11-18
Distributed Ruby (aka DRuby) 1.8 mishandles the sending of syscalls.
CVE-2011-5331
PUBLISHED: 2019-11-18
Distributed Ruby (aka DRuby) 1.8 mishandles instance_eval.
CVE-2019-5101
PUBLISHED: 2019-11-18
An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by per...