Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats //

Vulnerability Management

News & Commentary
Get Organized Like a Villain
Rob Ragan & Alex DeFreese, Principal Security Researcher & Managing Security Associate at Bishop FoxCommentary
What cybercrime group FIN7 can teach us about using agile frameworks.
By Rob Ragan & Alex DeFreese Principal Security Researcher & Managing Security Associate at Bishop Fox, 12/12/2019
Comment0 comments  |  Read  |  Post a Comment
Intel's CPU Flaws Continue to Create Problems for the Tech Community
Irfan Ahmed, Assistant Professor in the Department of Computer Science at Virginia Commonwealth UniversityCommentary
We can't wait out this problem and hope that it goes away. We must be proactive.
By Irfan Ahmed Assistant Professor in the Department of Computer Science at Virginia Commonwealth University, 12/10/2019
Comment1 Comment  |  Read  |  Post a Comment
Deliver a Deadly Counterpunch to Ransomware Attacks: 4 Steps
Mathew Newfield, Chief Information Security Officer at UnisysCommentary
You can't prevent all ransomware attacks. However, it's possible to ensure that if a breach happens, it doesn't spread, affect business, and become a newsworthy event.
By Mathew Newfield Chief Information Security Officer at Unisys, 12/10/2019
Comment1 Comment  |  Read  |  Post a Comment
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, GigamonCommentary
This gridiron-inspired advice will guarantee your digital transformation success and keep your data safe.
By Shane Buckley President & Chief Operating Officer, Gigamon, 12/9/2019
Comment1 Comment  |  Read  |  Post a Comment
Success Enablers or Silent Killers?
Douglas Ferguson, Founder & CTO, Pharos SecurityCommentary
These five success enablers will help CISOs report, measure, and demonstrate ROI to the C-suite.
By Douglas Ferguson Founder & CTO, Pharos Security, 12/6/2019
Comment0 comments  |  Read  |  Post a Comment
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLCCommentary
Assessments can be used against your company in court proceedings. Here's how to mitigate this potential risk.
By Beth Burgin Waller Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC, 12/5/2019
Comment1 Comment  |  Read  |  Post a Comment
Application & Infrastructure Risk Management: You've Been Doing It Backward
John Worrall, Chief Executive Officer at ZeroNorthCommentary
Before getting more scanning tools, think about what's needed to defend your organization's environment and devise a plan to ensure all needed tools can work together productively.
By John Worrall Chief Executive Officer at ZeroNorth, 12/4/2019
Comment0 comments  |  Read  |  Post a Comment
What Security Leaders Can Learn from Marketing
Christopher Kenessey, Chief Executive Officer at NetMotion SoftwareCommentary
Employees can no longer be pawns who must be protected all the time. They must become partners in the battle against threats.
By Christopher Kenessey Chief Executive Officer at NetMotion Software, 12/3/2019
Comment0 comments  |  Read  |  Post a Comment
How to Get Prepared for Privacy Legislation
Tony Anscombe, Global Security Evangelist & Industry Partnership Ambassador at ESETCommentary
All the various pieces of legislation, both in the US and worldwide, can feel overwhelming. But getting privacy basics right is a solid foundation.
By Tony Anscombe Global Security Evangelist & Industry Partnership Ambassador at ESET, 11/27/2019
Comment9 comments  |  Read  |  Post a Comment
Practical Principles for Security Metrics
Nik Whitfield, Computer Scientist & Security Technology EntrepreneurCommentary
A proactive approach to cybersecurity requires the right tools, not more tools.
By Nik Whitfield Computer Scientist & Security Technology Entrepreneur, 11/27/2019
Comment0 comments  |  Read  |  Post a Comment
DDoS: An Underestimated Threat
Marc Wilczek, Digital Strategist & CIO AdvisorCommentary
Distributed denial-of-service (DDoS) attacks have become more common, more powerful, and more useful to attackers. Here's how to fight back.
By Marc Wilczek Digital Strategist & CIO Advisor, 11/26/2019
Comment7 comments  |  Read  |  Post a Comment
Time to Warn Users About Black Friday & Cyber Monday Scams
Michael Landewe, Chief Privacy Officer at AvananCommentary
Warn your employees to avoid the inevitable scams associated with these two "holidays," or you risk compromising your company's network.
By Michael Landewe Chief Privacy Officer at Avanan, 11/25/2019
Comment0 comments  |  Read  |  Post a Comment
The 5-Step Methodology for Spotting Malicious Bot Activity on Your Network
Avidan Avraham, Security Researcher at Cato NetworksCommentary
Bot detection over IP networks isn't easy, but it's becoming a fundamental part of network security practice.
By Avidan Avraham Security Researcher at Cato Networks, 11/22/2019
Comment1 Comment  |  Read  |  Post a Comment
3 Fundamentals for Better Security and IT Management
Chris Hallenbeck, CISO for the Americas at TaniumCommentary
Nail these security fundamentals, and your organization will be well-positioned to succeed next year and in the years to come.
By Chris Hallenbeck CISO for the Americas at Tanium, 11/21/2019
Comment1 Comment  |  Read  |  Post a Comment
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & PhelpsCommentary
A feature that's supposed to make your account more secure -- adding a cellphone number -- has become a vector of attack in SIM-swapping incidents. Here's how it's done and how you can protect yourself.
By Nicole Sette Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps, 11/19/2019
Comment4 comments  |  Read  |  Post a Comment
Quantum Computing Breakthrough Accelerates the Need for Future-Proofed PKI
Kevin von Keyserling & JD Kilgallin, Co-Founder & Chief Strategy officer; Senior Integration Engineer at KeyfactorCommentary
Public key infrastructure is a foundational security tool that has evolved to become a critical base for future advancements. Today's generation of PKI can be coupled with quantum-resistant algorithms to extend the lifespan of digital certificates for decades.
By Kevin von Keyserling & JD Kilgallin Co-Founder & Chief Strategy officer; Senior Integration Engineer at Keyfactor, 11/18/2019
Comment0 comments  |  Read  |  Post a Comment
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing WriterNews
Based on penetration tests and vulnerability assessments, attackers' costs to compromise a company's network increases significantly when security is continuously tested, a report finds.
By Robert Lemos Contributing Writer, 11/15/2019
Comment1 Comment  |  Read  |  Post a Comment
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at NetskopeCommentary
There's a skills and resources gap industrywide, but a DevSecOps approach can go a long way toward closing that gap.
By Lamont Orange Chief Information Security Officer at Netskope, 11/15/2019
Comment3 comments  |  Read  |  Post a Comment
BSIMM10 Shows Industry Vertical Maturity
Sammy Migues, BSIMM Co-Author and Principal Scientist at SynopsysCommentary
The Building Security In Maturity Model is the only detailed measuring stick for software security initiatives, and it continues to evolve.
By Sammy Migues BSIMM Co-Author and Principal Scientist at Synopsys, 11/14/2019
Comment0 comments  |  Read  |  Post a Comment
How Does Your Cyber Resilience Measure Up?
Troy Mattern, Vice President for Product and Services Cybersecurity at Motorola SolutionsCommentary
The security measures companies take today may not be enough for tomorrow's cyber assault, but switching to a proactive, risk-based framework may better protect your organization.
By Troy Mattern Vice President for Product and Services Cybersecurity at Motorola Solutions, 11/14/2019
Comment0 comments  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Lessons from the NSA: Know Your Assets
Robert Lemos, Contributing Writer,  12/12/2019
4 Tips to Run Fast in the Face of Digital Transformation
Shane Buckley, President & Chief Operating Officer, Gigamon,  12/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19797
PUBLISHED: 2019-12-15
read_colordef in read.c in Xfig fig2dev 3.2.7b has an out-of-bounds write.
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.