Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Vulnerability Management

News & Commentary
Securing the Internet of Things in the Age of Quantum Computing
Dr. Charles Grover, Cryptography Researcher, Crypto QuantiqueCommentary
Internet security, privacy, and authentication aren't new issues, but IoT presents unique security challenges.
By Dr. Charles Grover Cryptography Researcher, Crypto Quantique, 5/6/2021
Comment0 comments  |  Read  |  Post a Comment
Will 2021 Mark the End of World Password Day?
Jake Madders, Director, Hyve Managed HostingCommentary
We might be leaving the world of mandatory asterisks and interrobangs behind for good.
By Jake Madders Director, Hyve Managed Hosting, 5/5/2021
Comment0 comments  |  Read  |  Post a Comment
Apple Issues Patches for Webkit Security Flaws
Dark Reading Staff, Quick Hits
The vulnerabilities may already be under active attack, Apple says in an advisory.
By Dark Reading Staff , 5/4/2021
Comment0 comments  |  Read  |  Post a Comment
Can Organizations Secure Remote Workers for the Long Haul?
Ian Pratt, Global head of Security for Personal Systems at HP Inc.Commentary
By focusing on protection instead of detection, organizations can defend against targeted attacks without compromising security or productivity.
By Ian Pratt Global head of Security for Personal Systems at HP Inc., 5/4/2021
Comment0 comments  |  Read  |  Post a Comment
It's Time to Ditch Celebrity Cybersecurity
Mieng Lim, VP of Product Management at Digital Defense By HelpSystemsCommentary
High-profile attacks and solutions are shiny objects that can distract from the defenses that afford the greatest protection.
By Mieng Lim VP of Product Management at Digital Defense By HelpSystems, 5/4/2021
Comment0 comments  |  Read  |  Post a Comment
Researchers Explore Active Directory Attack Vectors
Kelly Sheridan, Staff Editor, Dark ReadingNews
Incident responders who investigate attacks targeting Active Directory discuss methods used to gain entry, elevate privileges, and control target systems.
By Kelly Sheridan Staff Editor, Dark Reading, 5/3/2021
Comment0 comments  |  Read  |  Post a Comment
Researchers Find Bugs Using Single-Codebase Inconsistencies
Robert Lemos, Contributing WriterNews
A Northeastern University research team finds code defects -- and some vulnerabilities -- by detecting when programmers used different code snippets to perform the same functions.
By Robert Lemos Contributing Writer, 5/3/2021
Comment0 comments  |  Read  |  Post a Comment
Stopping the Next SolarWinds Requires Doing Something Different
Tony Cole, CTO at Attivo NetworksCommentary
Will the SolarWinds breach finally prompt the right legislative and regulatory actions on a broader, more effective scale?
By Tony Cole CTO at Attivo Networks, 5/3/2021
Comment2 comments  |  Read  |  Post a Comment
New Threat Group Carrying Out Aggressive Ransomware Campaign
Jai Vijayan, Contributing WriterNews
UNC2447 observed targeting now-patched vulnerability in SonicWall VPN.
By Jai Vijayan Contributing Writer, 4/30/2021
Comment0 comments  |  Read  |  Post a Comment
The Ticking Time Bomb in Every Company's Code
Pedro Fortuna, CTO and Co-Founder of JscramblerCommentary
Developers must weigh the benefits and risks of using third-party code in Web apps.
By Pedro Fortuna CTO and Co-Founder of Jscrambler, 4/30/2021
Comment0 comments  |  Read  |  Post a Comment
Researchers Connect Complex Specs to Software Vulnerabilities
Robert Lemos, Contributing WriterNews
Following their release of 70 different vulnerabilities in different implementations of TCP/IP stacks over the past year, two companies find a common link.
By Robert Lemos Contributing Writer, 4/29/2021
Comment0 comments  |  Read  |  Post a Comment
The Challenge of Securing Non-People Identities
Eric Kedrosky, Chief Information Security Officer at Sonrai SecurityCommentary
Non-people identities, which can act intelligently and make decisions on behalf of a person's identity, are a growing cybersecurity risk.
By Eric Kedrosky Chief Information Security Officer at Sonrai Security, 4/29/2021
Comment0 comments  |  Read  |  Post a Comment
74% of Financial Institutions See Spike in COVID-Related Threats
Dark Reading Staff, Quick Hits
Financial losses have also increased among organizations in the last year, with the average cost reaching $720,000.
By Dark Reading Staff , 4/28/2021
Comment0 comments  |  Read  |  Post a Comment
US Urges Organizations to Implement MFA, Other Controls to Defend Against Russian Attacks
Jai Vijayan, Contributing WriterNews
Actors working for Moscow's Foreign Intelligence Service are actively targeting organizations in government and other sectors, FBI and DHS say.
By Jai Vijayan Contributing Writer, 4/26/2021
Comment0 comments  |  Read  |  Post a Comment
Apple Patches Serious MacOS Security Flaw
Dark Reading Staff, Quick Hits
The bug can put Mac users at "grave risk" as it allows attackers to bypass Apple's security mechanisms, a researcher reports.
By Dark Reading Staff , 4/26/2021
Comment0 comments  |  Read  |  Post a Comment
Shift Left: From Concept to Practice
Mackenzie Jackson, Developer Advocate at GitGuardianCommentary
By moving security into development, your team can find and fix vulnerabilities before they become expensive, difficult, and publicly embarrassing problems.
By Mackenzie Jackson Developer Advocate at GitGuardian, 4/26/2021
Comment0 comments  |  Read  |  Post a Comment
Insider Data Leaks: A Growing Enterprise Threat
Dark Reading Staff, Quick Hits
Report finds 85% of employees are more likely to leak sensitive files now than before the COVID-19 pandemic.
By Dark Reading Staff , 4/23/2021
Comment0 comments  |  Read  |  Post a Comment
Prometei Botnet Adds New Twist to Exchange Server Attacks
Dark Reading Staff, Quick Hits
Attackers are using the well-known Microsoft Exchange Server flaw to add machines to a cryptocurrency botnet, researchers say.
By Dark Reading Staff , 4/22/2021
Comment0 comments  |  Read  |  Post a Comment
Improving the Vulnerability Reporting Process With 5 Steps
Bas Alberts, Principal Security Researcher, GitHub Security LabCommentary
Follow these tips for an effective and positive experience for both the maintainer and external vulnerability reporter.
By Bas Alberts Principal Security Researcher, GitHub Security Lab, 4/22/2021
Comment0 comments  |  Read  |  Post a Comment
University Suspends Project After Researchers Submitted Vulnerable Linux Patches
Robert Lemos, Contributing WriterNews
A Linux maintainer pledges to stop taking code submissions from the University of Minnesota after a research team purposely submitted vulnerabilities to show software supply chain weaknesses.
By Robert Lemos Contributing Writer, 4/22/2021
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by etaymaor
Current Conversations Good read
In reply to: Good read!
Post Your Own Reply
More Conversations
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-36124
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by XML External Entity (XXE) injection. An authenticated attacker can compromise the private keys of a JWT token and reuse them to manipulate the access tokens to access the platform as any desired user (clients and administrators).
CVE-2020-36125
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control where password revalidation in sensitive operations can be bypassed remotely by an authenticated attacker through requesting the endpoint directly.
CVE-2020-36126
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by incorrect access control that can lead to remote privilege escalation. PAXSTORE marketplace endpoints allow an authenticated user to read and write data not owned by them, including third-party users, application and payment term...
CVE-2020-36127
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by an information disclosure vulnerability. Through the PUK signature functionality, an administrator will not have access to the current p12 certificate and password. When accessing this functionality, the administrator has the opt...
CVE-2020-36128
PUBLISHED: 2021-05-07
Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by a token spoofing vulnerability. Each payment terminal has a session token (called X-Terminal-Token) to access the marketplace. This allows the store to identify the terminal and make available the applications distributed by its ...