#windows

Computer Laboratory Management System version 1.0 suffers from an incorrect access control that allows for privilege escalation.

Leads Manager Tool suffers from remote SQL injection and cross site scripting vulnerabilities.

Appointment Scheduler version 3.0 suffers from an insecure direct object reference vulnerability.

AccPack Cop version 1.0 suffers from a cross site request forgery vulnerability.

AccPack Buzz version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

Cybersecurity researchers have discovered a previously undocumented Windows backdoor that leverages a built-in feature called Background Intelligent Transfer Service (BITS) as a command-and-control (C2) mechanism. The newly identified malware strain has been codenamed BITSLOTH by Elastic Security Labs, which made the discovery on June 25, 2024, in connection with a cyber attack targeting an

Cybersecurity companies are warning about an uptick in the abuse of Clouflare's TryCloudflare free service for malware delivery. The activity, documented by both eSentire and Proofpoint, entails the use of TryCloudflare to create a one-time tunnel that acts as a conduit to relay traffic from an attacker-controlled server to a local machine through Cloudflare's infrastructure. Attack chains

A malvertising campaign uses phishing to steal legitimate account pages, with the endgame of delivering the Lumma stealer.

The lesson for users, especially if you’re a private company that primarily uses GitHub, is just to understand the inherent dangers of using open-source software.

ShadowPad, widely considered the successor of PlugX, is a modular remote access trojan (RAT) only seen sold to Chinese hacking groups.