Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

News & Commentary
NSA Alerted Microsoft to New Exchange Server Vulnerabilities
Kelly Sheridan, Staff Editor, Dark ReadingNews
Microsoft today patched 114 CVEs to address the Exchange Server flaws, more than 50 remote code execution vulnerabilities, and one zero-day.
By Kelly Sheridan Staff Editor, Dark Reading, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
Dark Reading to Upgrade Site Design, Performance
Tim Wilson, Editor in Chief, Dark Reading, Commentary
Improvements will make site content easier to navigate, faster, and more functional.
By Tim Wilson, Editor in Chief, Dark Reading , 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
5 Objectives for Establishing an API-First Security Strategy
Ryan Nolette, Technical Security Lead at PostmanCommentary
With APIs predicted to be the most common attack vector by 2022, an API-first security strategy is critical now more than ever.
By Ryan Nolette Technical Security Lead at Postman, 4/13/2021
Comment0 comments  |  Read  |  Post a Comment
New Malware Downloader Spotted in Targeted Campaigns
Jai Vijayan, Contributing WriterNews
Saint Bot is being used to drop stealers on compromised systems but could be used to deliver any malware.
By Jai Vijayan Contributing Writer, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Wake Up and Smell the JavaScript
Deepika Gajaria, VP of Products, Tala SecurityCommentary
The SolarWinds attack showed the true meaning of a supply chain breach. And it's the canary in the coal mine for sensitive data on the Web.
By Deepika Gajaria VP of Products, Tala Security, 4/12/2021
Comment0 comments  |  Read  |  Post a Comment
Unofficial Android App Store APKPure Infected With Malware
Dark Reading Staff, Quick Hits
The APKPure app store was infected with malware that can download Trojans to other Android devices, researchers report.
By Dark Reading Staff , 4/9/2021
Comment0 comments  |  Read  |  Post a Comment
Cring Ransomware Used in Attacks on European Industrial Firms
Dark Reading Staff, Quick Hits
Attackers exploited a vulnerability in Fortigate VPN servers to gain access to target networks, researchers report.
By Dark Reading Staff , 4/7/2021
Comment0 comments  |  Read  |  Post a Comment
Cartoon Caption Winner: Something Seems Afoul
John Klossner, CartoonistCommentary
And the winner of Dark Readings's March cartoon caption contest is ...
By John Klossner Cartoonist, 4/7/2021
Comment0 comments  |  Read  |  Post a Comment
Security Falls Short in Rapid COVID Cloud Migration
Dark Reading Staff, Quick Hits
The quick pivot to the cloud for remote support also ushered in risks.
By Dark Reading Staff , 4/6/2021
Comment0 comments  |  Read  |  Post a Comment
Crime Service Gives Firms Another Reason to Purge Macros
Robert Lemos, Contributing WriterNews
Recent Trickbot campaigns and at least three common banking Trojans all attempt to infect systems using malicious macros in Microsoft Office documents created using EtterSilent.
By Robert Lemos Contributing Writer, 4/6/2021
Comment0 comments  |  Read  |  Post a Comment
NFT Thefts Reveal Security Risks in Coupling Private Keys & Digital Assets
Pratik Savla, Lead Security Engineer at VenafiCommentary
Compromised NFT accounts highlight security concerns inherent in the design of centralized systems.
By Pratik Savla Lead Security Engineer at Venafi, 4/6/2021
Comment0 comments  |  Read  |  Post a Comment
LinkedIn Phishing Ramps Up With More-Targeted Attacks
Robert Lemos, Contributing WriterNews
Seeking to take advantage of out-of-work users, malware groups continue to use LinkedIn and business services to offer fictional jobs and deliver infections instead.
By Robert Lemos Contributing Writer, 4/5/2021
Comment0 comments  |  Read  |  Post a Comment
Kaspersky Uncovers New APAC Cyberespionage Campaign
Dark Reading Staff, Quick Hits
A group related to Chinese-speaking threat group Cycldek is targeting government and military organizations in Vietnam.
By Dark Reading Staff , 4/5/2021
Comment0 comments  |  Read  |  Post a Comment
NIST Publishes Guide for Securing Hotel Property Management Systems
Dark Reading Staff, Quick Hits
These sensitive systems store guests' personal data and payment-card information.
By Dark Reading Staff , 4/1/2021
Comment0 comments  |  Read  |  Post a Comment
The Role of Visibility in Securing Cloud Applications
Praveen Patnala, Co-Founder, ValtixCommentary
Traditional data center approaches aren't built for securing modern cloud applications.
By Praveen Patnala Co-Founder, Valtix, 4/1/2021
Comment0 comments  |  Read  |  Post a Comment
3 Ways Vendors Can Inspire Customer Trust Amid Breaches
James Pleger, Manager, SpecOps, at Sumo LogicCommentary
As customers rely more on cloud storage and remote workforces, the probability of a breach increases.
By James Pleger Manager, SpecOps, at Sumo Logic, 3/31/2021
Comment0 comments  |  Read  |  Post a Comment
What We Know (and Don't Know) So Far About the 'Supernova' SolarWinds Attack
Kelly Jackson Higgins, Executive Editor at Dark ReadingNews
A look at the second elusive attack targeting SolarWinds software that researchers at Secureworks recently cited as the handiwork of Chinese nation-state hackers.
By Kelly Jackson Higgins Executive Editor at Dark Reading, 3/30/2021
Comment1 Comment  |  Read  |  Post a Comment
In the Rush to Embrace Hybrid Cloud, Don't Forget About Security
Ganesh Pai, CEO, UptycsCommentary
Cloud service providers typically only secure the infrastructure itself, while customers are responsible for their data and application security.
By Ganesh Pai CEO, Uptycs, 3/30/2021
Comment0 comments  |  Read  |  Post a Comment
Manufacturing Firms Learn Cybersecurity the Hard Way
Robert Lemos, Contributing WriterNews
Although 61% of smart factories have experienced a cybersecurity incident, IT groups and operational technology groups still don't collaborate enough on security.
By Robert Lemos Contributing Writer, 3/29/2021
Comment0 comments  |  Read  |  Post a Comment
4 Open Source Tools to Add to Your Security Arsenal
Maggie Jauregui & Brian Delgado, Security Researcher, Programmable Solutions Group at Intel / Red Team Lead, Programmable Services Group at Intel Commentary
Open source solutions can offer an accessible and powerful way to enhance your security-testing capabilities.
By Maggie Jauregui & Brian Delgado Security Researcher, Programmable Solutions Group at Intel / Red Team Lead, Programmable Services Group at Intel , 3/29/2021
Comment1 Comment  |  Read  |  Post a Comment
More Stories
Current Conversations
More Conversations
PR Newswire
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29370
PUBLISHED: 2021-04-13
A UXSS was discovered in the Thanos-Soft Cheetah Browser in Android 1.2.0 due to the inadequate filter of the intent scheme. This resulted in Cross-site scripting on the cheetah browser in any website.
CVE-2021-3460
PUBLISHED: 2021-04-13
The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could lead to the communication channel being accessible by an attacker.
CVE-2021-3462
PUBLISHED: 2021-04-13
A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unauthorized access to the driver's device object.
CVE-2021-3463
PUBLISHED: 2021-04-13
A null pointer dereference vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could cause systems to experience a blue screen error.
CVE-2021-3471
PUBLISHED: 2021-04-13
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.