Application Security

News & Commentary
Healthcare.gov FFE Breach Compromises 75K Users' Data
Dark Reading Staff, Quick Hits
Attackers broke into a sign-up system used by healthcare insurance agents and brokers to help consumers apply for coverage.
By Dark Reading Staff , 10/22/2018
Comment0 comments  |  Read  |  Post a Comment
Gartner Experts Highlight Tech Trends And Their Security Risks
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
Security must be built into systems and applications from the beginning of the design process, they agreed.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 10/22/2018
Comment0 comments  |  Read  |  Post a Comment
WSJ Report: Facebook Breach the Work of Spammers, Not Nation-State Actors
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
A report by the Wall Street Journal points finger at group that is known to Facebook Security.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 10/19/2018
Comment2 comments  |  Read  |  Post a Comment
How to Get Consumers to Forgive You for a Breach
Dark Reading Staff, Quick Hits
It starts with already-established trust, a new survey shows.
By Dark Reading Staff , 10/18/2018
Comment0 comments  |  Read  |  Post a Comment
7 Ways A Collaboration System Could Wreck Your IT Security
Curtis Franklin Jr., Senior Editor at Dark Reading
The same traits that make collaboration systems so useful for team communications can help hackers, too.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 10/18/2018
Comment0 comments  |  Read  |  Post a Comment
Apache Access Vulnerability Could Affect Thousands of Applications
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
A recently discovered issue with a common file access method could be a major new attack surface for malware authors.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 10/18/2018
Comment0 comments  |  Read  |  Post a Comment
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CACommentary
Websites can avoid the negative consequences of a "not secure" label from Google Chrome 68 by following four AOSSL best practices.
By Tim Callan Senior Fellow, Comodo CA, 10/18/2018
Comment1 Comment  |  Read  |  Post a Comment
Oracle Issues Massive Collection of Critical Security Updates
Dark Reading Staff, Quick Hits
The software updates from Oracle address a record number of vulnerabilities.
By Dark Reading Staff , 10/17/2018
Comment0 comments  |  Read  |  Post a Comment
Cybercrime-as-a-Service: No End in Sight
Marc Wilczek, Digital Strategist & CIO AdvisorCommentary
Cybercrime is easy and rewarding, making it a perfect arena for criminals everywhere.
By Marc Wilczek Digital Strategist & CIO Advisor, 10/17/2018
Comment0 comments  |  Read  |  Post a Comment
A Cybersecurity Weak Link: Linux and IoT
Migo Kedem, Senior Director of Products and Marketing at SentinelOneCommentary
Linux powers many of the IoT devices on which we've come to rely -- something that enterprises must address.
By Migo Kedem Senior Director of Products and Marketing at SentinelOne, 10/16/2018
Comment0 comments  |  Read  |  Post a Comment
Rapid7 Acquires tCell
Dark Reading Staff, Quick Hits
The purchase brings together a cloud security platform with a web application firewall.
By Dark Reading Staff , 10/16/2018
Comment0 comments  |  Read  |  Post a Comment
Spies Among Us: Tracking, IoT & the Truly Inside Threat
Amit Sethi, Senior Principal Consultant at SynopsysCommentary
In today's ultra-connected world, it's important for users to understand how to safeguard security while browsing the web and using electronic devices.
By Amit Sethi Senior Principal Consultant at Synopsys, 10/16/2018
Comment0 comments  |  Read  |  Post a Comment
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
Speaking at the Gartner Symposium/ITxpo, analyst Peter Firstbrook's list of trends is likely to inform executive committee conversations for the next 12 months.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 10/15/2018
Comment2 comments  |  Read  |  Post a Comment
Pair of Reports Paint Picture of Enterprise Security Struggling to Keep Up
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
Many organizations have yet to create an effective cybersecurity strategy and it's costing them millions.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 10/11/2018
Comment1 Comment  |  Read  |  Post a Comment
Most Malware Arrives Via Email
Dark Reading Staff, Quick Hits
Watch out for messages with the word "invoice" in the subject line, too.
By Dark Reading Staff , 10/11/2018
Comment1 Comment  |  Read  |  Post a Comment
Google Adds New Identity, Security Tools to Cloud Platform
Kelly Sheridan, Staff Editor, Dark ReadingNews
A wave of cloud news includes new tools for identity and access management and policies for stronger controls on cloud resources.
By Kelly Sheridan Staff Editor, Dark Reading, 10/11/2018
Comment0 comments  |  Read  |  Post a Comment
The Better Way: Threat Analysis & IIoT Security
Satish Gannu, Chief Security Officer, ABBCommentary
Threat analysis offers a more nuanced and multidimensional approach than go/no-go patching in the Industrial Internet of Things. But first, vendors must agree on how they report and address vulnerabilities.
By Satish Gannu Chief Security Officer, ABB, 10/11/2018
Comment0 comments  |  Read  |  Post a Comment
Google+ Vulnerability Hits Service, Leads to Shutdown
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
In response to the breach, Google is changing policies, modifying APIs, and shutting down Google+.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 10/9/2018
Comment0 comments  |  Read  |  Post a Comment
Git Gets Patched for Newly Found Flaw
Dark Reading Staff, Quick Hits
A vulnerability in Git could allow an attacker to place malicious, auto-executing code in a sub-module.
By Dark Reading Staff , 10/9/2018
Comment0 comments  |  Read  |  Post a Comment
Lessons Learned from the Facebook Breach: Why Logic Errors Are So Hard to Catch
Jerry Gamblin, Principal Security Engineer, Kenna SecurityCommentary
By ensuring that each layer of protection scours an application for unintended uses, you can find the flaws before the bad guys do.
By Jerry Gamblin Principal Security Engineer, Kenna Security, 10/9/2018
Comment1 Comment  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by MelissaCombs
Current Conversations great
In reply to: Re: Pending Review
Post Your Own Reply
More Conversations
PR Newswire
WSJ Report: Facebook Breach the Work of Spammers, Not Nation-State Actors
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/19/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
NC Water Utility Fights Post-Hurricane Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.