Authorization Bypass

Moodle is vulnerable to authorization bypass. A malicious user can access the contents of another logged out user's dropbox through the dropbox repository file picker as long as the browser session is continued...

Cross site scripting

Cross-site scripting XSS vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress...

CVE-2014-9310

Cross-site scripting XSS vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress...

CVE-2014-9310

Cross-site scripting XSS vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress...

CVE-2014-9310

CVE-2014-9310 is a XSS vulnerability in the WordPress Backup to Dropbox plugin for WordPress, exposed in versions before 4.1. The issue is categorized as a reflected XSS (per WPVulnDB) where unsanitized/reflected user input can be returned in responses. Impact: user sessions/credentials could be ...

For many well-known companies impact of Oracle Responsys local file inclusion vulnerability-vulnerability warning-the black bar safety net

Today I want to show you is, how do I find the Oracle Responsys cloud service system in a local file inclusion vulnerabilities LFI Airport. Due to the current commercial sales, network storage and social relationships companies are using the Oracle Responsys cloud solution, so that the...

LinkedIn Hacker, Wanted by US & Russian, Can be Extradited to Either State

The alleged Russian hacker, who was arrested by the Czech police in Prague last October on suspicion of massive 2012 data breach at LinkedIn, can be extradited to either the United States or Russia, a Czech court ruled on Tuesday. Yevgeniy Aleksandrovich Nikulin, a 29-years-old Russian national, ...

Dropbox Lepton Denial of Service Vulnerability (CNVD-2017-08238)

Dropbox Lepton is a set of tools for lossless compression of JPEG format files. A denial of service vulnerability exists in Dropbox Lepton version 1.2.1, which can be exploited by an attacker to perform a DoS SEGV and application crash via an incorrectly formatted lepton file...

CVE-2017-8891

Dropbox Lepton 1.2.1 allows DoS SEGV and application crash via a malformed lepton file because the code does not ensure setup of a correct number of threads...

Code injection

Dropbox Lepton 1.2.1 allows DoS SEGV and application crash via a malformed lepton file because the code does not ensure setup of a correct number of threads...

CVE-2017-8891

Dropbox Lepton 1.2.1 allows DoS SEGV and application crash via a malformed lepton file because the code does not ensure setup of a correct number of threads...

UBUNTU-CVE-2017-8891

Dropbox Lepton 1.2.1 allows DoS SEGV and application crash via a malformed lepton file because the code does not ensure setup of a correct number of threads...

CVE-2017-8891

Dropbox Lepton 1.2.1 allows DoS SEGV and application crash via a malformed lepton file because the code does not ensure setup of a correct number of threads...

CVE-2017-8891

Technical details (affected product versions, root cause specifics, exploits) are not publicly disclosed in the provided documents; monitor for updates.

CVE-2017-8891

Dropbox Lepton 1.2.1 allows DoS SEGV and application crash via a malformed lepton file because the code does not ensure setup of a correct number of threads...

Dropbox: SSL Key Certificate expires

The report points out that the certificate for https://www.dropboxpartners.com had expired. We closed the issue as informative because we were already working on shutting down the site. The site became unavailable within a few days of the report being filed...

Dropbox: Dropbox Paper - Markdown XSS

Hello, Today I took a look at Dropbox Paper and noticed there is an option to export/download the project as a Markdown or word docx document. I noticed it doesn't filter any kind of Markdown escaping, meaning when parsed after download will let us execute client side code. equivallent to arbrita...

Dropbox Lepton Denial of Service Vulnerability

Dropbox Lepton is a set of tools for lossless compression of JPEG format files. A security vulnerability exists in the allocatechannelframebuffer function in the uncompressedcomponents.hh file in Dropbox Lepton version 1.2.1. A remote attacker can exploit this vulnerability to cause a denial of...

Facebook and Dropbox in the CSRF vulnerability analysis-vulnerability warning-the black bar safety net

Facebook provides the user with a very handy feature, and the user can pass this option directly from the Dropbox account to load file: ! This feature will allow the user directly in the browser window to view and upload to the Dropbox account in the file: ! This functional integration is through...

CSRF in Facebook/Dropbox - "Mallory added a file using Dropbox"

tl;dr Facebook Groups offers the option to upload files directly from the Dropbox account. This integration is done using the OAuth 2.0 protocol and suffered from a variant of the classic OAuth CSRF defined by Egor Homakov as the the Most Common OAuth2 Vulnerability, see video below: Introduction...