Dropbox client - Multiple Vulnerabilities - SA-CONTRIB-2016-027

This module enables you to view dropbox files in your Drupal site. The module doesn't sufficiently sanitize filenames when displaying them to users or administrators leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must be able to...

Dropbox: Lack of account link warning enables dropbox hijacking

When I install dropbox on linux via the CLI, I get given a URL containing a token: https://www.dropbox.com/clilinknonce?nonce=blah I can give this token to another user and pretend it's a link to a dropbox file. If they aren't logged in when they click it, they will land on the login page. If the...

Dropbox: Dropbox apps Server side request forgery

Hi, SSRF is a vulnerability that appears when an attacker has the ability to create requests from the vulnerable server. Usually, Server Side Request Forgery SSRF attacks target internal systems behind the firewall that are normally inaccessible from the outside world but using SSRF it’s possible...

Dropbox Acquisitions: Session hacking

I hereby want to report a vulnerability i.e. Session hacking. Summary ======== Attacker can still do activities in browser with user's account if user changed his/her password in another browser. Detail ===== If user logged in account in two or more browsers and he has changed password in one of...

Dropbox: No Rate Limiting while sending the feedback under Dropbox Help Centre

The original report allows repeatedly giving "not helpful" as feedback for a help article. Observation:- It was observed that there is no rate limiting in placed for all the endpoint which looks like as below:- Vulnerable URL:- https://www.dropbox.com/helpajax/articles/274/feedback/unhelpful...

GC Plugin for Dropbox - Suspicious files, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application GC Plugin for Dropbox published at the 'play' market has multiple vulnerabilities...

Dropbox: Possible SQL injection can cause denial of service attack

Hi there, The https://www.dropbox.com// Double slash request returns Internal Server Error 500 Error and doesn't returns 404 so i believe it may be an injection. https://www.dropbox.com//shell.php any text added after the double slash will cause the same thing . It is a valid bug an should be...

China APT Gang Targets Hong Kong Media via Dropbox

An APT gang linked to China and alleged to be responsible for targeted attacks against foreign governments and ministries, has now pointed its focus inward at China’s autonomous territory Hong Kong. An August attack against several media companies in Hong Kong was carried out shortly after a...

China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets

FireEye Threat Intelligence analysts identified a spear phishing campaign carried out in August 2015 targeting Hong Kong-based media organizations. A China-based cyber threat group, which FireEye tracks as an uncategorized advanced persistent threat APT group and other researchers refer to as...

China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets

FireEye Threat Intelligence analysts identified a spear phishing campaign carried out in August 2015 targeting Hong Kong-based media organizations. A China-based cyber threat group, which FireEye tracks as an uncategorized advanced persistent threat APT group and other researchers refer to as...

Dropbox FinderLoadBundle OS X Local Root Exploit

!/bin/bash Dropbox FinderLoadBundle OS X local root exploit by cenobyte 2015 - vulnerability description: The setuid root FinderLoadBundle that was included in older DropboxHelperTools versions for OS X allows loading of dynamically linked shared libraries that are residing in the same directory...

Dropbox < 3.3.x - OSX FinderLoadBundle Privilege Escalation

!/bin/bash Exploit Title: Dropbox FinderLoadBundle OS X local root exploit Google Dork: N/A Date: 29/09/15 Exploit Author: cenobyte Vendor Homepage: https://www.dropbox.com Software Link: N/A Version: Dropbox 1.5.6, 1.6-7., 2.1-11., 3.0., 3.1., 3.3. Tested on: OS X Yosemite 10.10.5 CVE: N/A Dropb...

Dropbox 3.3.x - OSX FinderLoadBundle Privilege Escalation

Dropbox 3.3.x - OSX FinderLoadBundle Privilege Escalation !/bin/bash Exploit Title: Dropbox FinderLoadBundle OS X local root exploit Google Dork: N/A Date: 29/09/15 Exploit Author: cenobyte Vendor Homepage: https://www.dropbox.com Software Link: N/A Version: Dropbox 1.5.6, 1.6-7., 2.1-11., 3.0.,...

When a 'Hacker News' Reader Tricked Me into visiting this Amazing Site (Don't Click at Work)

My usual bed routine is to check comments under my articles before I go to sleep. The same I was doing last night, but something weird happened to me. Someone posted a mysterious short link without any text below one of my articles on our official 'The Hacker News' Facebook Page, and with the...

Dropbox Login Detection (deprecated)

Binary data 8872.prm...

Mail.ru: Vulnerability :- "XSS vulnerability"

Hello mail.ru Security Team, I have found XSS vulnerability On your WEBSITE :- http://corp.mail.ru/en/jobs/feedback/ My Payload is this :- '" Vulnerability :- "XSS vulnerability" Vulnerable Fields : "Social Network fields" Cross-Site Scripting XSS vulnerabilities are a type of computer security...

MGASA-2015-0314 Updated owncloud package fixes security vulnerabilities

In ownCloud before 6.0.8 and 8.0.4, a bug in the SDK used to connect ownCloud against the Dropbox server might allow the owner of "Dropbox.com" to gain access to any files on the ownCloud server if an external Dropbox storage was mounted CVE-2015-4715. In ownCloud before 6.0.8 and 8.0.4, the...

Updated owncloud package fixes security vulnerabilities

In ownCloud before 6.0.8 and 8.0.4, a bug in the SDK used to connect ownCloud against the Dropbox server might allow the owner of "Dropbox.com" to gain access to any files on the ownCloud server if an external Dropbox storage was mounted CVE-2015-4715. In ownCloud before 6.0.8 and 8.0.4, the...

Tango DropBox ActiveX Control Heap Buffer Overflow Vulnerability

Etonica Tango DropBox is a suite of free FTP applications that offer features such as uploading files and folders, intermittent transfers and browsing remote folders. A remote heap buffer overflow vulnerability exists in the Etonica Tango DropBox ActiveX control, which allows remote attackers to...

ThisData: Xss via Dropbox

ThisData formerly Revert provides the ability to backup Dropbox files. File names were rendered within the app in an unescaped manner, meaning if you could get Dropbox to accept a file with a name like ".png you could XSS Revert's backup rendering screen...