Dropbox: `account_info.read` scope OAuth app access token can change token owner's account name.

Previously, Dropbox API was split between App Folder and Full Dropbox apps. After the recent introduction of Scoped Access apps, which use OAuth scopes, a number of routes meant specifically for internal use were neither restricted to internal apps nor were they annotated with required scopes. A...

LEPTON ma*** function has a heap out-of-bounds write vulnerability

LEPTON is a new lossless compression algorithm open-sourced by Dropbox, capable of lossless compression of JPEG images by an average of 22%. A heap out-of-bounds write vulnerability exists in the LEPTON ma function. An attacker can exploit this vulnerability to cause a program crash...

Fake COVID-19 survey hides ransomware in Canadian university attack

This post was authored by Jérôme Segura with contributions from Hossein Jazi, Hasherezade and Marcelo Rivero. In recent weeks, weve observed a number of phishing attacks against universities worldwide which we attributed to the Silent Librarian APT group. On October 19, we identified a new phishi...

Biden Campaign Staffers Targeted in Cyberattack Leveraging Antivirus Lure, Dropbox Ploy

Hackers sent Joe Biden’s presidential campaign staffers malicious emails that impersonated anti-virus software company McAfee, and used a mix of legitimate services such as Dropbox to avoid detection. The emails were an attempt to steal staffers’ credentials and infect them with malware. The...

Dropbox, Linkedin hacker sentenced to 7 years in prison

By Deeba Ahmed Yevgeniy Nikulin aka Linkedin hacker, a Russian national was found guilty of hacking into LinkedIn, Dropbox, and Formspring. This is a post from HackRead.com Read the original post: Dropbox, Linkedin hacker sentenced to 7 years in prison...

Russian Who Hacked LinkedIn, Dropbox Sentenced to 7 Years in Prison

A Russian hacker who was found guilty of hacking LinkedIn, Dropbox, and Formspring over eight years ago has finally been sentenced to 88 months in United States prison, that's more than seven years by a federal court in San Francisco this week. Yevgeniy Aleksandrovich Nikulin, 32, of Moscow hacke...

Russian Who Hacked LinkedIn, Dropbox Sentenced to 7 Years in Prison

A Russian hacker who was found guilty of hacking LinkedIn, Dropbox, and Formspring over eight years ago has finally been sentenced to 88 months in United States prison, that's more than seven years by a federal court in San Francisco this week. Yevgeniy Aleksandrovich Nikulin , 32, of Moscow hack...

CVE-2020-12759

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

CVE-2020-12759

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

Cross site scripting

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

CVE-2020-12759

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

CVE-2020-12759

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

CVE-2020-12759

CVE-2020-12759 affects Zulip Server prior to 2.1.5, with a reflected XSS vulnerability via the Dropbox webhook. Public records across NVD/Red Hat OSV/CVE entries confirm the issue in Zulip Server before 2.1.5 and indicate the root cause as unsafe handling of the webhook payload leading to cross-s...

PT-2020-13249

Name of the Vulnerable Software and Affected Versions Zulip Server versions prior to 2.1.5 Description The issue allows for reflected XSS via the Dropbox webhook. Recommendations For versions prior to 2.1.5, update to version 2.1.5 or later to resolve the issue...

Zulip Server Cross-Site Scripting Vulnerability (CNVD-2020-49009)

Zulip is a powerful open source group chat application that combines the immediacy of live chat with the productivity benefits of threaded conversations.Zulip Server is the Zulip server. A reflective cross-site scripting vulnerability exists in Zulip Server versions prior to 2.1.5. An attacker ca...

CVE-2020-12759: Improper Neutralization of Input During Web Page Generation

Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook...

Dropbox: User has Sender permission can Get Team information

A security researcher was able to leverage a user with a sender role to view all team information by issuing a crafted POST request to portal.helloworks.com/editteam which provided information disclosure team's primary contact, whereas accessing the URL is forbidden based on the sender role. The...

Internet Bug Bounty: Uncovering file quarantine and UX security issues in macOS apps ( .terminal, .fileloc and .url)

Slides : https://docs.google.com/presentation/d/19WeQbqcOKnrSv1I3Z4sm-oNAf6IVzHwRyQP4i9BvY/editslide=id.g758ad3e04223231 See Blogpost for more details - https://medium.com/@metnew/exploiting-popular-macos-apps-with-a-single-terminal-file-f6c2efdfedaa Summary Popular macOS apps with a file-sharing...

Dropbox: Server Side Request Forgery (SSRF) at app.hellosign.com leads to AWS private keys disclosure

The report details about a Server Side Request Forgery vulnerability that was present on the document upload through integrations feature in the HelloSign application. The vulnerability was caused due to an unvalidated external file upload through our various integration partners. The attacker...

SendPress Newsletter < 1.20.7.13 - Authenticated Stored Cross-Site Scripting (XSS)

Multiple Stored Cross-Site Scripting within SendPress Newsletter Settings due to improper input sanitation. The vulnerable fields are: - From Name - From Email - Where to send Test Email https://www.dropbox.com/s/slnc6oj1ryssvuz/sendpress-xss.mp4?dl=0 Payloads - v alert1337/// - v 1.20.7.13: "...