WordPress Backup to Dropbox plugin cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.WordPress Backup to Dropbox is a plugin for backing up data to Dropbox. A cross-site scripting vulnerability exists in the WordPress Backup to Dropbox...

PDF Converter & Editor 2.1 iOS - File Include Vulnerability

Document Title: =============== PDF Converter & Editor 2.1 iOS - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1480 Release Date: ============= 2015-05-06 Vulnerability Laboratory ID VL-ID: ===================================...

Dropbox: XSS in dropbox main domain

Video POC: https://www.youtube.com/watch?v=qgeCfWO6VIU vuln link: https://www.dropbox.com/restore/xxxx%20Team%20Folder?prev=javascript:aler1;&subjectuid=412738972...

Dropbox: Race condition when redeeming coupon codes

Hello, there is a race condition when redeeming coupon codes in https://www.dropbox.com/coupons. Basically, it enables me to reuse one coupon code many times. Here are the steps to reproduce: 1. Get a coupon code. I bought mine on fiverr. 2. Go to https://www.dropbox.com/coupons and enter your co...

Dropbox: SSRF vulnerablity in app webhooks

Server Side Request Forgery SSRF is a vulnerabilty which allows an attacker to make web requests from the context of the server host machine to arbitrary URL's. This vulnerability can allow the attacker to access resources internal to the network, which would otherwise be inaccessible. This...

Dropbox: XSS in version history of an HTML file in a shared folder

Note, the shared folder part of this bug isn't necessary for this exploit, but shows a proof of concept on how you can exploit other users. This bug is a cross site scripting vulnerablity XSS, which allows arbitrary scripts commonly javascript supplied by an attacker to be run within the context ...

Dropbox Launches Bounty Program on HackerOne

Dropbox has become the latest high-profile Internet firm to start a bug bounty program, hooking up with HackerOne to provide rewards to security researchers who report vulnerabilities through the program. The new reward system from Dropbox covers a variety of the company’s offerings, including th...

Dropbox Acquisitions: XSS in https://hackpad.com/

Hi I found a XSS in your website in the following links.It is not very different from the last time which I reported.Rather it is on a same page...

Dropbox SDK for Android Security Bypass Vulnerability

Dropbox is an innovative online file storage, synchronization, and sharing service that offers free client software, is open source and cross-platform, and runs on Windows, Mac OS X, and Linux operating systems. A security bypass vulnerability exists in Dropbox SDK for Android. An attacker can...

Dropbox SDK for Android account spoofing

It's possible to spoof account via OAuth...

Vulnerability in the Dropbox SDK for Android (CVE-2014-8889)

Hi, We have recently discovered a vulnerability in the Dropbox SDK for Android. This vulnerability may enable theft of sensitive information from apps that use the vulnerable Dropbox SDK both locally by malware and also remotely by using drive-by exploitation techniques. The vulnerability is...

Dropbox Acquisitions: unknow files Upload in profile photo

hi user can upload any formate files in https://hackpad.com/ep/profile/ click on change profile photo pop up box is open hear you can upload php, xml,html what ever you want i think it's not gud hop u soon fix this Thank you...

The Dropbox SDK, there is a remote exploit, has been an emergency fix-bug warning-the black bar safety net

! The Dropbox developers recently fixed the Android version of the Dropbox SDK to store the application on a remote exploitation vulnerability, an attacker exploit the vulnerability without user consent directly to the app and the Dropbox account is connected. As long as the user installed...

Dropbox Patches Remotely Exploitable Vulnerability in SDK

Developers at Dropbox recently fixed a remotely exploitable vulnerability in the Android SDK version of the storage app that enabled attackers to connect applications to a Dropbox account without the user’s consent. This could have opened users up to the theft of information from any app that use...

Dropbox: Create N Accounts In Dropbox Irrespective Of Domain

I've found a flaw which does not verify your email, when you sign up for a new account, irrespective of domain name we can create multiple accounts. So we can use fake emails to get as many dropbox accounts. PFA video and get back to me if there is anything else...

Dropbox: Unvalidated Redirects and Stored XSS

Hi, This bug might interest you. In the process of testing , I uploaded a file which contained the scripts: window.opener.location.replace'http://blackhorse.x10host.com/test.php'; alertdocument.domain alertdocument.cookie On opening of the uploaded file through the events section, the XSS pop-ups...

Dropbox: WP User Enumeration is possible at https://blog.dropbox.com

Hello security team. I like to report this bug I found. Here are some user ID's proofing user enumeration is possible. User ID 2 : drew User ID 4 : jon User ID 6 : arash User ID 9 : dan User ID 10 : arash-ferdowsi User ID 11 : dropbox-team User ID 13 : ivan It is recommended to rename the admin...

WordPress Backup to Dropbox 4.0 - Reflected XSS

The wordpress-backup-to-dropbox WordPress plugin was affected by a Reflected XSS security vulnerability...

Dropbox: [monitor.sjc.dropbox.com] CRLF Injection

PoC for any browser other than FireFox: https://monitor.sjc.dropbox.com/crlf%0dSet-Cookie:test=test;domain=.dropbox.com HTTP Response: HTTP/1.1 301 Moved Permanently\r\n Date: Sat, 13 Dec 2014 10:05:12 GMT\r\n Server: Apache\r\n Location: https://monitor.dropbox.com//crlf\r injectoin...

Dropbox Denies Hack, Says 'Your Stuff is Safe'

Dropbox officials on Monday said that a large cache of usernames and passwords posted online and alleged to have come from the company’s users are not related to Dropbox customer accounts. A spate of media reports reported yesterday that attackers had stolen several million sets of credentials fr...