Application Security

News & Commentary
Who Gets Targeted Most in Cyberattack Campaigns
Dark Reading Staff, Quick Hits
Attackers are changing both their tactics and targets in an attempt to remain criminally successful, Proofpoint's study found.
By Dark Reading Staff , 4/22/2019
Comment0 comments  |  Read  |  Post a Comment
Free Princeton Application Provides IoT Traffic Insight
Dark Reading Staff, Quick Hits
The application developed by a research group allows users to spot possible IoT security problems.
By Dark Reading Staff , 4/19/2019
Comment1 Comment  |  Read  |  Post a Comment
Third-Party Cyber-Risk by the Numbers
Ericka Chickowski, Contributing Writer, Dark Reading
Recent stats show that the state of third-party cyber risk and vendor risk management remains largely immature at most organizations.
By Ericka Chickowski Contributing Writer, Dark Reading, 4/19/2019
Comment0 comments  |  Read  |  Post a Comment
Cisco Issues 31 Mid-April Security Alerts
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
Among them, two are critical and six are of high importance.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 4/18/2019
Comment0 comments  |  Read  |  Post a Comment
How to Raise the Level of AppSec Competency in Your Organization
Sammy Migues, Principal Scientist, SynopsysCommentary
Improving processes won't happen overnight, but it's not complicated either.
By Sammy Migues Principal Scientist, Synopsys, 4/18/2019
Comment0 comments  |  Read  |  Post a Comment
Legacy Apps: The Security Risk Lurking in Dusty Corners
Tim Buntel, VP, Application Security Products, Threat StackCommentary
Four best practices to keep old code from compromising your enterprise environment.
By Tim Buntel VP, Application Security Products, Threat Stack, 4/17/2019
Comment1 Comment  |  Read  |  Post a Comment
Ever-Sophisticated Bad Bots Target Healthcare, Ticketing
Robert Lemos, Technology Journalist/Data ResearcherNews
From criminals to competitors, online bots continue to scrape information from sites and pose as legitimate users.
By Robert Lemos Technology Journalist/Data Researcher, 4/17/2019
Comment0 comments  |  Read  |  Post a Comment
Security Audit Shows Gains, Though Privacy Lags
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
The 2018 Online Trust Audit shows that "encryption everywhere" is improving security, while fuzzy language is slowing privacy gains.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 4/16/2019
Comment0 comments  |  Read  |  Post a Comment
Data on Thousands of Law Enforcement Personnel Exposed in Breach
Dark Reading Staff, Quick Hits
Unknown hackers broke into databases of nonprofit and have posted online personal info on FBI, Secret Service, Capitol Police, US Park Police, others.
By Dark Reading Staff , 4/15/2019
Comment0 comments  |  Read  |  Post a Comment
The Single Cybersecurity Question Every CISO Should Ask
Arif Kareem, CEO, ExtraHopCommentary
The answer can lead to a scalable enterprise security solution for years to come.
By Arif Kareem CEO, ExtraHop, 4/15/2019
Comment1 Comment  |  Read  |  Post a Comment
CERT, CISA Warn of Vuln in at Least 4 Major VPNs
Dark Reading Staff, Quick Hits
VPN products by Cisco, Palo Alto Networks, F5 Networks, Pulse Secure, insecurely store session cookies.
By Dark Reading Staff , 4/12/2019
Comment1 Comment  |  Read  |  Post a Comment
Romanians Convicted in Cybertheft Scheme
Dark Reading Staff, Quick Hits
Working out of Bucharest since 2007, a pair of criminals infected and controlled more than 400,000 individual computers, mostly in the US.
By Dark Reading Staff , 4/12/2019
Comment1 Comment  |  Read  |  Post a Comment
In Security, All Logs Are Not Created Equal
Joe Partlow, Chief Technology Officer, ReliaQuestCommentary
Prioritizing key log sources goes a long way toward effective incident response.
By Joe Partlow Chief Technology Officer, ReliaQuest, 4/11/2019
Comment0 comments  |  Read  |  Post a Comment
Senate Bill Would Ban Social Networks' Social Engineering Tricks
Dark Reading Staff, Quick Hits
Bill takes aim at tactics used to convince people to give up their personal data, designing games that addict kids, and more.
By Dark Reading Staff , 4/10/2019
Comment0 comments  |  Read  |  Post a Comment
Safe Harbor Programs: Ensuring the Bounty Isn't on White Hat Hackers' Heads
Matt Honea, Director of Cyber, Guidewire SoftwareCommentary
As crowdsourced security-testing surges in popularity, companies need to implement safe harbor provisions to protect good-faith hackers -- and themselves.
By Matt Honea Director of Cyber, Guidewire Software, 4/10/2019
Comment0 comments  |  Read  |  Post a Comment
Microsoft Patch Tuesday Fixes Windows Bugs Under Attack
Kelly Sheridan, Staff Editor, Dark ReadingNews
The April release of security updates patches 74 vulnerabilities, two of which are being exploited in the wild.
By Kelly Sheridan Staff Editor, Dark Reading, 4/9/2019
Comment0 comments  |  Read  |  Post a Comment
A New Approach to Application Security Testing
Manish Gupta, CEO of ShiftLeftCommentary
If the appsec industry were to develop a better AST solution from scratch, what would it look like?
By Manish Gupta CEO of ShiftLeft, 4/9/2019
Comment1 Comment  |  Read  |  Post a Comment
Craigslist Founder Funds Security Toolkit for Journalists, Elections
Curtis Franklin Jr., Senior Editor at Dark ReadingNews
The free tools will be developed by the Global Cyber Alliance to monitor election infrastructure and processes in the runup to the 2020 Presidential election.
By Curtis Franklin Jr. Senior Editor at Dark Reading, 4/9/2019
Comment0 comments  |  Read  |  Post a Comment
British Hacker Jailed for Role in Russian Crime Group
Dark Reading Staff, Quick Hits
According to authorities, Zain Qaiser would pose as a legitimate ad broker to buy online advertising unit from pornographic websites.
By Dark Reading Staff , 4/9/2019
Comment1 Comment  |  Read  |  Post a Comment
Phishing Campaign Targeting Verizon Mobile Users
Steve Zurier, Freelance WriterNews
Lookout Phishing AI, which discovered the attack, says it has been going on since late November.
By Steve Zurier Freelance Writer, 4/5/2019
Comment1 Comment  |  Read  |  Post a Comment
More Stories
Current Conversations
Posted by brucewinters
Current Conversations What is the question?  :-)
In reply to: One Question?
Post Your Own Reply
More Conversations
PR Newswire
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Why We Need a 'Cleaner Internet'
Darren Anstee, Chief Technology Officer at Arbor Networks,  4/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7303
PUBLISHED: 2019-04-23
A vulnerability in the seccomp filters of Canonical snapd before version 2.37.4 allows a strict mode snap to insert characters into a terminal on a 64-bit host. The seccomp rules were generated to match 64-bit ioctl(2) commands on a 64-bit platform; however, the Linux kernel only uses the lower 32 b...
CVE-2019-7304
PUBLISHED: 2019-04-23
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root. This issue affects: Canonical snapd versions prior to 2.37.1.
CVE-2019-0223
PUBLISHED: 2019-04-23
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1...
CVE-2017-12619
PUBLISHED: 2019-04-23
Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone".
CVE-2018-1317
PUBLISHED: 2019-04-23
In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.