692 matches found
Dropbox: Forum posts and private messages are poorly sanitized, allowing execution of arbitrary JavaScript
The reporter informed us of both stored XSS vulnerabilities as well as unsafe css attributes that were allowed in forum posts due to TinyMCE editor. An upgrade to lithium's forum platform appears to have mitigated these vulnerabilities...
Hacked Password Service Leakbase Goes Dark
Leakbase, a Web site that indexed and sold access to billions of usernames and passwords stolen in some of the world largest data breaches, has closed up shop. A source close to the matter says the service was taken down in a law enforcement sting that may be tied to the Dutch police raid of the...
DBC2 (DropboxC2) - A Modular Post-Exploitation Tool, Composed Of An Agent Running On The Victim'S Machine
DBC2 DropboxC2 is a modular post-exploitation tool, composed of an agent running on the victim's machine, a controler, running on any machine, powershell modules, and Dropbox servers as a means of communication. This project was initially inspired by the fantastic Empire framework, but also as an...
Dropbox: Dropbox employee benefits documents are available in a test Dropbox folder
This report pointed out that we had left a shared link to a copy of our employee benefits documentation in a particular iOS build. This link was likely used for ad-hoc testing at some point and accidentally left in the build. While there is little security risk here, we removed the link from...
Cloud Client Side File Encryption: Cryptomator
Multi-platform transparent client-side encryption of your files in the cloud. Cryptomator provides transparent, client-side encryption for your cloud. Protect your documents from unauthorized access. Cryptomator is free and open source software, so you can rest assured there are no backdoors...
Dropbox: Android - Access of some not exported content providers
The report indicates a flaw in our Android application that would allow a malicious app to gain read/write access to some cached files provided the attacker knows the name of the files and other minor pieces of information. The vulnerability was caused by not validating the package name of an...
CVE-2014-8889
Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by download attack...
CVE-2014-8889: Exposure of Sensitive Information to an Unauthorized Actor
Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by download attack...
Western Digital My Cloud Products Dropbox App RCE Vulnerability
The Dropbox App of Western Digital My Cloud products is prone to an unauthenticated remote command execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
CVE-2014-8889
Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or via a drive-by download attack...
CVE-2014-8889
CVE-2014-8889 affects the Dropbox SDK for Android prior to 1.6.2. The issue was an implementation flaw that could enable remote attackers to obtain sensitive information through crafted malware or drive-by exploitation by leaking the nonce used in OAuth authentication, effectively tying a victim ...
'HoeflerText' Popups Target Browsers With RAT and Locky Ransomware
A malware campaign utilizing bogus popups that alert users to a missing web-font is targeting Google Chrome and Firefox browser users. The popups contain a malicious JavaScript file that initiates the download of either the NetSupport Manager remote access tool RAT or Locky ransomware. The...
App Layering Recipe for Dropbox
...
August 1, 2017 – Morning Cyber Coffee Headlines – “August” Edition
Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 1, 2017 - Headlines Carbon Black in the News: Carbon Black Appoints Form...
Dropbox: Missing URL sanitization in comments can be leveraged for phishing
The report points out that a link in shared file's comments could say one thing in the text but actually point to another website. This is a risk we have always accepted: the document preview could also contain links, the legit links could point to shorteners. Additionally, Dropbox Paper supports...
DropboxC2C - A Post-Exploitation Agent Which Uses Dropbox Infrastructure For Command And Control Operations
DropboxC2C is a post-exploitation agent which uses Dropbox Infrastructure for command and control operations. DO NOT USE THIS FOR MALICIOUS PURPOSES. THE AUTHOR IS NOT RESPONSIBLE FOR ANY MISUSE OF THIS PROGRAM. Structure main.py - The "server" part which manages all the agents. agent.py - The...
Authorization Bypass
Moodle is vulnerable to authorization bypass. A malicious user can access the contents of another logged out user's dropbox through the dropbox repository file picker as long as the browser session is continued...
Cross site scripting
Cross-site scripting XSS vulnerability in the WordPress Backup to Dropbox plugin before 4.1 for WordPress...