Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Vulnerability Management

News & Commentary
WannaCry Has IoT in Its Crosshairs
Ed Koehler, Distinguished Principal Security Engineer, Office of CTO, at Extreme NetworkCommentary
The wide variety of devices attached to the Internet of Things offers a rich target for purveyors of ransomware.
By Ed Koehler Distinguished Principal Security Engineer, Office of CTO, at Extreme Network, 9/25/2020
Comment0 comments  |  Read  |  Post a Comment
Bluetooth Security Weaknesses Pile Up, While Patching Remains Problematic
Robert Lemos, Contributing WriterNews
Turns out, creating wireless ecosystems for a vast number of different architectures, configurations, and use cases is hard.
By Robert Lemos Contributing Writer, 9/24/2020
Comment0 comments  |  Read  |  Post a Comment
7 Non-Technical Skills Threat Analysts Should Master to Keep Their Jobs
Dov Lerner, Security Research Lead, SixgillCommentary
It's not just technical expertise and certifications that enable analysts to build long-term careers in cybersecurity.
By Dov Lerner Security Research Lead, Sixgill, 9/23/2020
Comment0 comments  |  Read  |  Post a Comment
Time for CEOs to Stop Enabling China's Blatant IP Theft
Eric Noonan, CEO, CyberSheathCommentary
Protecting intellectual property in the name of US economic and national security should be part of every company's fiduciary duty.
By Eric Noonan CEO, CyberSheath, 9/17/2020
Comment0 comments  |  Read  |  Post a Comment
Struggling to Secure Remote IT? 3 Lessons from the Office
Chris Hallenbeck, CISO for the Americas at TaniumCommentary
The great remote work experiment has exacerbated existing challenges and exposed new gaps, but there are things to be learned from office challenges.
By Chris Hallenbeck CISO for the Americas at Tanium, 9/17/2020
Comment0 comments  |  Read  |  Post a Comment
CISA Joins MITRE to Issue Vulnerability Identifiers
Robert Lemos, Contributing WriterNews
The Cybersecurity and Infrastructure Security Agency will become a peer of MITRE in the CVE program, likely leading to continued increases in disclosed vulnerabilities.
By Robert Lemos Contributing Writer, 9/16/2020
Comment0 comments  |  Read  |  Post a Comment
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVistaCommentary
While the demand for cybersecurity talent rebounds, organizations will need to focus on cyber-enabled roles to fill immediate skills gaps.
By Simone Petrella Chief Executive Officer, CyberVista, 9/16/2020
Comment2 comments  |  Read  |  Post a Comment
Simplify Your Privacy Approach to Overcome CCPA Challenges
Hilary Wandall, Senior Vice President, Privacy Intelligence and General Counsel at TrustArcCommentary
By building a privacy-forward culture from the ground up and automating processes, organizations can simplify their approach to privacy and be prepared for any upcoming regulations.
By Hilary Wandall Senior Vice President, Privacy Intelligence and General Counsel at TrustArc, 9/15/2020
Comment0 comments  |  Read  |  Post a Comment
More Printers Could Mean Security Problems for Home-Bound Workers
Robert Lemos, Contributing WriterNews
Tricked-out home offices have led to an influx in printers, many of which have not been set up securely, leaving workers and their companies vulnerable.
By Robert Lemos Contributing Writer, 9/14/2020
Comment0 comments  |  Read  |  Post a Comment
Fraud Prevention During the Pandemic
Doug Clare, Vice President, Fraud, Compliance, and Security Solutions at FICOCommentary
When the economy is disrupted, fraud goes up, so let's not ignore the lessons we can learn from previous downturns.
By Doug Clare Vice President, Fraud, Compliance, and Security Solutions at FICO, 9/11/2020
Comment0 comments  |  Read  |  Post a Comment
Ripple20 Malware Highlights Industrial Security Challenges
Paul Lariviere, Technical Director, Security CompassCommentary
Poor security practices allowed software vulnerabilities to propagate throughout industrial and IoT products for more than 20 years.
By Paul Lariviere Technical Director, Security Compass, 9/10/2020
Comment0 comments  |  Read  |  Post a Comment
The Hidden Security Risks of Business Applications
Brian Tremblay, Compliance Practice Leader at OnapsisCommentary
Today's enterprises depend on mission-critical applications to keep them productive, help better serve customers, and keep up with demand. It's important that they also know the risks.
By Brian Tremblay Compliance Practice Leader at Onapsis, 9/4/2020
Comment0 comments  |  Read  |  Post a Comment
Fake Data and Fake Information: A Treasure Trove for Defenders
Carolyn Crandall, Chief Deception Officer at Attivo NetworksCommentary
Cybersecurity professionals are using false data to deceive cybercriminals, enabling them to protect networks in new and innovative ways.
By Carolyn Crandall Chief Deception Officer at Attivo Networks, 9/3/2020
Comment0 comments  |  Read  |  Post a Comment
5 Tips for Triaging Risk from Exposed Credentials
Jai Vijayan, Contributing Writer
Not all exposed usernames and passwords present a threat. Here's how to quickly identify the ones that do.
By Jai Vijayan Contributing Writer, 9/2/2020
Comment1 Comment  |  Read  |  Post a Comment
Testing & Automation Pay Off for NSA's DevSecOps Project
Robert Lemos, Contributing WriterNews
Communication with stakeholders, extensive testing, and robust automation pays dividends for military intelligence agency, one of several presenters at GitLab's virtual Commit conference.
By Robert Lemos Contributing Writer, 8/31/2020
Comment0 comments  |  Read  |  Post a Comment
From Defense to Offense: Giving CISOs Their Due
Marc Wilczek, Digital Strategist & COO of Link11Commentary
In today's unparalleled era of disruption, forward-thinking CISOs can become key to company transformation -- but this means resetting relationships with the board and C-suite.
By Marc Wilczek Digital Strategist & COO of Link11, 8/31/2020
Comment5 comments  |  Read  |  Post a Comment
How CISOs Can Play a New Role in Defining the Future of Work
David Bradbury, CSO, OktaCommentary
Rather than just reacting to security issues in the COVID-19 era, CISOs are now in a position to be change agents alongside their C-suite peers.
By David Bradbury CSO, Okta, 8/27/2020
Comment1 Comment  |  Read  |  Post a Comment
The Fatal Flaw in Data Security
Ayal Yogev, CEO & Cofounder, AnjunaCommentary
Simply stated: No matter how sophisticated your security software is, data cannot be simultaneously used and secured. But that may be changing soon.
By Ayal Yogev CEO & Cofounder, Anjuna, 8/25/2020
Comment0 comments  |  Read  |  Post a Comment
Average Cost of a Data Breach in 2020: $3.86M
Marc Wilczek, Digital Strategist & COO of Link11Commentary
When companies defend themselves against cyberattacks, time is money.
By Marc Wilczek Digital Strategist & COO of Link11, 8/24/2020
Comment0 comments  |  Read  |  Post a Comment
Post-Pandemic Digitalization: Building a Human-Centric Cybersecurity Strategy
Nasser Al-Nasser & Dr. Guy Diedrich, Chair of the B20 Digitalization Taskforce and CEO of Saudi Telecom Company / Co-Chair of the B20 Digitalization Taskforce and Vice President and Global Innovation Officer of Cisco SystemsCommentary
COVID-19 won't be the last major disruption of its kind. Instead, it is a glimpse into what may be to come as digitalization continues to affect all aspects of our lives.
By Nasser Al-Nasser & Dr. Guy Diedrich Chair of the B20 Digitalization Taskforce and CEO of Saudi Telecom Company / Co-Chair of the B20 Digitalization Taskforce and Vice President and Global Innovation Officer of Cisco Systems, 8/21/2020
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by nobesityahmedabad
Current Conversations Very useful information
In reply to: Re: Chart
Post Your Own Reply
More Conversations
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15208
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
CVE-2020-15209
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
CVE-2020-15210
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
CVE-2020-15211
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
CVE-2020-15212
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...