#windows

A legitimate Windows search feature is being exploited by malicious actors to download arbitrary payloads from remote servers and compromise targeted systems with remote access trojans such as AsyncRAT and Remcos RAT. The novel attack technique, per Trellix, takes advantage of the "search-ms:" URI protocol handler, which offers the ability for applications and HTML links to launch custom local

Hello everyone! This episode will be about Microsoft Patch Tuesday for July 2023, including vulnerabilities that were added between June and July Patch Tuesdays. Alternative video link (for Russia): https://vk.com/video-149273431_456239131 As usual, I use my open source Vulristics project to analyse and prioritize vulnerabilities. Vulristics improvements I optimized the detection of the vulnerable product and the type […]

Categories: Podcast This week on Lock and Code, we speak with Thomas Reed about how Apple was able to previously address a security loophole that still persists on Windows, and what both companies get wrong (and right) about security. (Read more...) The post How Apple fixed what Microsoft hasn't, with Thomas Reed: Lock and Code S04E16 appeared first on Malwarebytes Labs.

A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.

Red Hat Security Advisory 2023-4226-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.13.6.

XLAgenda version 4.4 suffers from a cross site request forgery vulnerability.

WonderCMS version 0.6-Beta suffers from a password disclosure vulnerability.

xForUp Simple File Uploader version 1.0 suffers from a remote SQL injection vulnerability.

B-OBEC version V.092019 suffers from a remote SQL injection vulnerability.

BMIT BMS version 2.1 suffers from a remote SQL injection vulnerability that allows for authentication bypass.