Application Security //

Database Security

News & Commentary
Oracle Fixes 20 Remotely Exploitable Java SE Vulns
Jai Vijayan, Freelance writerNews
Quarterly update for October is the smallest of the year: only 252 flaws to fix! Oracle advises to apply patches 'without delay.'
By Jai Vijayan Freelance writer, 10/18/2017
Comment0 comments  |  Read  |  Post a Comment
Reuters: Microsoft's 2013 Breach Hit Bug Repository, Insiders Say
Dark Reading Staff, Quick Hits
Five anonymous former Microsoft employees tell Reuters that Microsoft's database of internally discovered vulnerabilities was compromised in 2013, but Microsoft will not confirm it occurred.
By Dark Reading Staff , 10/17/2017
Comment0 comments  |  Read  |  Post a Comment
Unstructured Data: The Threat You Cannot See
Charles Fullwood, Software Practice Director at Force 3Commentary
Why security teams needs to take a cognitive approach to the increasing volumes of data flowing from sources they don't control.
By Charles Fullwood Software Practice Director at Force 3, 10/10/2017
Comment0 comments  |  Read  |  Post a Comment
Rise in Insider Threats Drives Shift to Training, Data-Level Security
Tom Thomassen, Senior Staff Engineer of Security, MarkLogicCommentary
As the value and volume of data grows, perimeter security is not enough to battle internal or external threats.
By Tom Thomassen Senior Staff Engineer of Security, MarkLogic, 10/6/2017
Comment2 comments  |  Read  |  Post a Comment
Ransomware Will Target Backups: 4 Ways to Protect Your Data
Rod Mathews, Senior VP and General Manager of Data ProtectionCommentary
Backups are the best way to take control of your defense against ransomware, but they need protecting as well.
By Rod Mathews Senior VP and General Manager of Data Protection, 10/4/2017
Comment1 Comment  |  Read  |  Post a Comment
Equifax CEO Retires in Wake of Breach
Dark Reading Staff, Quick Hits
After the company's CIO and CSO resigned Sep. 14, Chairman and CEO Richard F. Smith follows them out the door.
By Dark Reading Staff , 9/26/2017
Comment1 Comment  |  Read  |  Post a Comment
FBI's Freese Shares Risk Management Tips
Dawn Kawamoto, Associate Editor, Dark ReadingNews
Deputy Assistant Director Donald Freese advises enterprises to lead with a business case and not fear addressing the C-suite on risk management.
By Dawn Kawamoto Associate Editor, Dark Reading, 9/26/2017
Comment0 comments  |  Read  |  Post a Comment
If Blockchain Is the Answer, What Is the Security Question?
Duncan Jones, Head of Skunkworks, Thales e-SecurityCommentary
Like any technology, blockchain has its strengths and weaknesses. But debunking three common myths can help you cut through the hype.
By Duncan Jones Head of Skunkworks, Thales e-Security, 9/8/2017
Comment0 comments  |  Read  |  Post a Comment
GDPR Compliance Preparation: A High-Stakes Guessing Game
Peter Merkulov, VP, Product Strategy & Technology AlliancesCommentary
It's difficult to tell if your company is meeting the EU's data privacy and security standards -- or US standards, for that matter.
By Peter Merkulov VP, Product Strategy & Technology Alliances, 8/24/2017
Comment2 comments  |  Read  |  Post a Comment
Dino Dai Zovi Dives Into Container Security, SecDevOps
Sara Peters, Senior Editor at Dark ReadingCommentaryVideo
Dino Dai Zovi discusses the under-explored security aspects of Docker, data center orchestration, and containers.
By Sara Peters Senior Editor at Dark Reading, 8/23/2017
Comment0 comments  |  Read  |  Post a Comment
Are Third-Party Services Ready for the GDPR?
Hadar Blutrich, CEO of Source DefenseCommentary
Third-party scripts are likely to be a major stumbling block for companies seeking to be in compliance with the EU's new privacy rules. Here's a possible work-around.
By Hadar Blutrich CEO of Source Defense, 8/4/2017
Comment0 comments  |  Read  |  Post a Comment
8 Things Every Security Pro Should Know About GDPR
Jai Vijayan, Freelance writer
Organizations that handle personal data on EU citizens will soon need to comply with new privacy rules. Are you ready?
By Jai Vijayan Freelance writer, 6/30/2017
Comment1 Comment  |  Read  |  Post a Comment
Mobile App Back-End Servers, Databases at Risk
Ericka Chickowski, Contributing Writer, Dark ReadingNews
Mobile app developers'casual use of back-end technology like Elasticsearch without security-hardening puts unsuspecting enterprises at grave risk of exposure.
By Ericka Chickowski Contributing Writer, Dark Reading, 5/31/2017
Comment0 comments  |  Read  |  Post a Comment
Going Beyond Checkbox Security
InformationWeek Staff, CommentaryVideo
Terry Barbounis, cybersecurity evangelist for CenturyLink, stops by the InformationWeek News Desk.
By InformationWeek Staff , 5/24/2017
Comment0 comments  |  Read  |  Post a Comment
UK Loan Firm Wonga Suffers Financial Data Breach
Dark Reading Staff, Quick Hits
Customers in the UK and Poland may have had their bank account details compromised.
By Dark Reading Staff , 4/11/2017
Comment1 Comment  |  Read  |  Post a Comment
11 UK Charities Punished for Violating Data Privacy Law
Dark Reading Staff, Quick Hits
Organizations fined between 6,000 and 18,000 by UKs Information Commissioners Office.
By Dark Reading Staff , 4/6/2017
Comment0 comments  |  Read  |  Post a Comment
To Attract and Retain Better Employees, Respect Their Data
Brian Vecci, Technical Evangelist, Varonis SystemsCommentary
A lack of privacy erodes trust that employees should have in management.
By Brian Vecci Technical Evangelist, Varonis Systems, 4/3/2017
Comment3 comments  |  Read  |  Post a Comment
ERP Attack Risks Come into Focus
Ericka Chickowski, Contributing Writer, Dark ReadingNews
New highly critical SAP vulnerability highlights dangers against critical business software.
By Ericka Chickowski Contributing Writer, Dark Reading, 3/16/2017
Comment0 comments  |  Read  |  Post a Comment
How to Secure Hyperconverged Infrastructures & Why It Is Different
Liviu Arsene, Senior E-threat Analyst, Bitdefender
The next-generation datacenter requires new security practices, but that doesnt mean everything we learned about datacenter security becomes obsolete.
By Liviu Arsene Senior E-threat Analyst, Bitdefender, 2/23/2017
Comment0 comments  |  Read  |  Post a Comment
Harvest Season: Why Cyberthieves Want Your Compute Power
Dave Klein, Regional Director of Sales Engineering & Architecture, GuardiCoreCommentary
Attackers are hijacking compute power in order to pull off their other crimes.
By Dave Klein Regional Director of Sales Engineering & Architecture, GuardiCore, 2/9/2017
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
Hyatt Hit With Another Credit Card Breach
Dark Reading Staff 10/13/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.