755 matches found
Dropbox: Dropbox Paper - Markdown XSS
Hello, Today I took a look at Dropbox Paper and noticed there is an option to export/download the project as a Markdown or word docx document. I noticed it doesn't filter any kind of Markdown escaping, meaning when parsed after download will let us execute client side code. equivallent to arbrita...
Dropbox Lepton Denial of Service Vulnerability
Dropbox Lepton is a set of tools for lossless compression of JPEG format files. A security vulnerability exists in the allocatechannelframebuffer function in the uncompressedcomponents.hh file in Dropbox Lepton version 1.2.1. A remote attacker can exploit this vulnerability to cause a denial of...
Facebook and Dropbox in the CSRF vulnerability analysis-vulnerability warning-the black bar safety net
Facebook provides the user with a very handy feature, and the user can pass this option directly from the Dropbox account to load file: ! This feature will allow the user directly in the browser window to view and upload to the Dropbox account in the file: ! This functional integration is through...
CSRF in Facebook/Dropbox - "Mallory added a file using Dropbox"
tl;dr Facebook Groups offers the option to upload files directly from the Dropbox account. This integration is done using the OAuth 2.0 protocol and suffered from a variant of the classic OAuth CSRF defined by Egor Homakov as the the Most Common OAuth2 Vulnerability, see video below: Introduction...
Dropbox: avrecode: global-buffer-overflow in get_neighbor()
Source: https://github.com/dropbox/avrecode Version: 2de743d Built using the Github instructions with afl-gcc and ASAN. Feeding this malformed .mp4 to recode triggers a global buffer overflow. ./recode roundtrip test003.mp4 mov,mp4,m4a,3gp,3g2,mj2 @ 0x61b00001f180 Protocol name not provided, cann...
UBUNTU-CVE-2017-7448
The allocatechannelframebuffer function in uncompressedcomponents.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a malformed JPEG image...
CVE-2017-7448
The allocatechannelframebuffer function in uncompressedcomponents.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a malformed JPEG image...
CVE-2017-7448
The allocatechannelframebuffer function in uncompressedcomponents.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a malformed JPEG image...
Denial of service
The allocatechannelframebuffer function in uncompressedcomponents.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a malformed JPEG image...
CVE-2017-7448
The allocatechannelframebuffer function in uncompressedcomponents.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a malformed JPEG image...
CVE-2017-7448
The allocatechannelframebuffer function in uncompressedcomponents.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a malformed JPEG image...
CVE-2017-7448
CVE-2017-7448 affects Dropbox Lepton 1.2.1. The vulnerability is in the allocate_channel_framebuffer function (uncompressed_components.hh) and can be triggered by a malformed JPEG image, enabling a remote attacker to cause a denial of service (divide-by-zero error and application crash). The avai...
CVE-2017-7448
The allocatechannelframebuffer function in uncompressedcomponents.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a malformed JPEG image...
PT-2017-17744
Name of the Vulnerable Software and Affected Versions Dropbox Lepton version 1.2.1 Description The issue allows remote attackers to cause a denial of service, resulting in a divide-by-zero error and application crash, via a malformed JPEG image. This is due to a problem in the allocate channel...
CVE-2017-7448: Divide By Zero
The allocatechannelframebuffer function in uncompressedcomponents.hh in Dropbox Lepton 1.2.1 allows remote attackers to cause a denial of service divide-by-zero error and application crash via a malformed JPEG image...
Dropbox - Customized SSL, Exported ContentProvider, Insecure KeyStore vulnerabilities
HackApp vulnerability scanner discovered that application Dropbox published at the 'play' market has multiple vulnerabilities...
Dropbox: CSV Injection with the CVS export feature
The report mentions a well known problem with any CSV export function. If the exported data has an Excel formula, the user will be warned and if the user clicks through a warning they might get some code execution. At the same time, fixing this bug means that the CSV data is no longer correct and...
Hacker Selling Over 1 Million Decrypted Gmail and Yahoo Passwords On Dark Web
Hardly a day goes without headlines about any significant data breach. In past year, billions of accounts from popular sites and services, including LinkedIn, Tumblr, MySpace, Last.FM, Yahoo!, VK.com were exposed on the Internet. Now, according to the recent news, login credentials and other...
Malware Hijacks Microphones to Spy On Ukrainian Businesses, Scientists and Media
Ukraine has once again been a target of a potential hacking attack that infected computer systems from dozens of Ukrainian businesses with highly sophisticated malware, allowing hackers to exfiltrate sensitive data and eavesdrop on their network. Late last year, the country also suffered a power...