#windows

The Ewon Cosy+ is a VPN gateway used for remote access and maintenance in industrial environments. If login against the FTP service of the Cosy+ fails, the submitted username is saved in a log. This log is included in the Cosy+ web interface without neutralizing the content. As a result, an unauthenticated attacker is able to inject HTML/JavaScript code via the username of an FTP login attempt.

Lawyer CMS version 1.6 suffers from an ignored default credential vulnerability.

Karya Online Shopping Portal version 2.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

JobSeeker CMS version 1.5 suffers from an ignored default credential vulnerability.

Jobs Finder System version 1.0 suffers from a remote SQL injection vulnerability.

Human Resource Management System 2024 version 1.0 suffers from an ignored default credential vulnerability.

Hotel Management System version 1.0 suffers from a cross site request forgery vulnerability.

Bhojon Restaurant Management System version 3.0 suffers from an ignored default credential vulnerability.

Accounting Journal Management System version 1.0 suffers from a cross site request forgery vulnerability.

A new type of malware called UULoader is being used by threat actors to deliver next-stage payloads like Gh0st RAT and Mimikatz. The Cyberint Research Team, which discovered the malware, said it's distributed in the form of malicious installers for legitimate applications targeting Korean and Chinese speakers. There is evidence pointing to UULoader being the work of a Chinese speaker due to the