WordPress Tutor LMS plugin <= 2.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by lucy in WordPress Tutor LMS plugin versions = 2.0.9. Solution Update the WordPress Tutor LMS plugin to the latest available version at least 2.0.10...

WordPress NextCellent Gallery plugin <= 1.9.35 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by lucy in WordPress NextCellent Gallery plugin versions = 1.9.35. Solution Deactivate and delete. This plugin has been closed as of June 1, 2022 and is not available for download. This closure is temporary, pending a full...

CVE-2021-28132

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool in the Support section allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI...

Remote code execution

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool in the Support section allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI...

CVE-2021-28132

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool in the Support section allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI...

CVE-2021-28132

CVE-2021-28132 affects LUCY Security Awareness Software up to version 4.7.x. The root cause is in the Migration Tool (Support section) which permits uploading PHP files inside a system.tar.gz. The uploaded PHP can be accessed via a public/system/static URI, enabling unauthenticated remote code ex...

CVE-2021-28132

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool in the Support section allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI...

LUCY Security Awareness Software 操作系统命令注入漏洞

LUCY Security Awareness Software is an application from LUCY Switzerland. the industry-leading real-time operating system for building embedded devices and systems. A security vulnerability exists in LUCY Security Awareness Software through 4.7.x that allows unauthenticated remote code execution...

‘Black Rose Lucy’ is Back, Now Pushing Ransomware

Cybercriminals behind the Android-based dropper malware Black Rose Lucy have shifted attacks from info-stealing to ransomware – with a sextortion twist. The malware family, operated by the Lucy Gang, encrypts targeted Android devices and delivers a spoofed FBI message. The ransom note claims the...

Lucy Gang Debuts with Unusual Android MaaS Package

There’s a fresh bloom in the malware-as-a-service garden: Researchers have uncovered a new Russian-speaking threat actor hawking a proprietary cyber-weapon dubbed “Black Rose Lucy.” The offering is a malware-as-a-service MaaS bundle with two parts, consisting of a controlling web interface which...

CVE-2009-4619

SQL injection vulnerability in the Lucy Games comlucygames component 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gameid parameter in a game action to index.php. NOTE: some of these details are obtained from third party information...

Sql injection

SQL injection vulnerability in the Lucy Games comlucygames component 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gameid parameter in a game action to index.php. NOTE: some of these details are obtained from third party information...

CVE-2009-4619

CVE-2009-4619 describes a SQL injection in the Lucy Games (com_lucygames) Joomla! extension version 1.5.4. The vulnerability exists in the game action to index.php where the gameid parameter is used, allowing remote attackers to manipulate SQL commands. The affected component is specifically Lucy...

CVE-2009-4619

SQL injection vulnerability in the Lucy Games comlucygames component 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gameid parameter in a game action to index.php. NOTE: some of these details are obtained from third party information...