Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary 2 Google Drive or 3 Dropbox...

CVE-2013-0300

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary 2 Google Drive or 3 Dropbox...

CVE-2013-0300

CVE-2013-0300 affects ownCloud 4.5.x (before 4.5.7) and related versions, introducing multiple CSRF vulnerabilities in endpoints such as apps/calendar/ajax/changeview.php, apps/files_external/ajax/, and apps/user_webdavauth/settings.php. The flaws allow remote attackers to hijack user authenticat...

CVE-2013-0300

Multiple cross-site request forgery CSRF vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that 1 change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary 2 Google Drive or 3 Dropbox...

Dropbox Updates Privacy Policy in Response to Surveillance

The online storage service Dropbox has amended its privacy policy at least in part to better address increased concerns regarding how the service perceives, responds to, and handles government requests for user-data. The new government data requests principles come as part of broader and fairly...

My PDF Creator DE DM 1.4 iOS - Multiple Vulnerabilities

My PDF Creator DE DM 1.4 iOS - Multiple Vulnerabilities Document Title: =============== My PDF Creator & DE DM v1.4 iOS - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1201 Release Date: ============= 2014-02-16 Vulnerability...

Dropbox Publishes 2013 Transparency Report

Dropbox yesterday released a new set of principles that explain how it deals with government requests for customer data. The principles were a companion to its 2013 Transparency Report, which for the first time included National Security Letter requests made to the file hosting service. “We belie...

The Android framework layer vulnerability-Fragment injection-vulnerability warning-the black bar safety net

Original: A New Vulnerability in the Android Framework: Fragment Injection Source: http://securityintelligence.com/new-vulnerability-android-framework-fragment-injection/comments Author: Roee Hay,IBM's Application Security Research Team Time: 2013.12.10 Recently we to the Android security team ha...

OliveOffice Mobile Suite 2.0.3 iOS - File Include Vulnerability

Document Title: =============== OliveOffice Mobile Suite 2.0.3 iOS - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1110 Release Date: ============= 2013-10-13 Vulnerability Laboratory ID VL-ID:...

Internet Bug Bounty: TLS Virtual Host Confusion

I am a security researcher at INRIA Paris in team PROSECCO http://prosecco.inria.fr We have been investigating a new class of attacks against the deployment of TLS on the Web. The main idea behind these attacks is that when two servers host different domains but share the same certificate which...

Fake Dropbox Password Reset Spam Leads to Malware

A new spam campaign has been circulating over the last few weeks aiming to dupe users of the popular cloud storage service Dropbox. The e-mails purport to come from the service but instead lead those who click through to a malware landing page. Some of the emails start off fairly convincingly:...

OliveOffice Mobile Suite 2.0.3 iOS - Local File Inclusion

OliveOffice Mobile Suite 2.0.3 iOS - Local File Inclusion Document Title: =============== OliveOffice Mobile Suite 2.0.3 iOS - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1110 Release Date: ============= 2013-10-13...

OliveOffice Mobile Suite 2.0.3 iOS - File Include Vulnerability

Document Title: =============== OliveOffice Mobile Suite 2.0.3 iOS - File Include Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1110 Release Date: ============= 2013-10-12 Vulnerability Laboratory ID VL-ID:...

Byword 2.x File Overwrite Vulnerability

The Metaclassy Byword app 2.x before 2.1 for iOS does not require confirmation of Replace file actions, which allows remote attackers to overwrite arbitrary files via the name and text parameters in a byword://replace URL. Affected Vendor: http://metaclassy.com/ - Affected Software: Byword for iO...

[CVE-2013-5725] - Byword for iOS Data Destruction Vulnerability

Affected Vendor: http://metaclassy.com/ - Affected Software: Byword for iOS - Affected Version: 2.x prior to 2.1 - Issue Type: Lack of validation/user confirmation leading to destruction of data - Release Date: 29 Sept 2013 - Discovered by: Guillaume Ross - CVE Identifier: CVE-2013-5725 - Issue...

CVE-2013-5963

Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload plugin before 1.8.8.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/wpdb/...

Unrestricted file upload

Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload plugin before 1.8.8.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/wpdb/...

CVE-2013-5963

Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload plugin before 1.8.8.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/wpdb/...

CVE-2013-5963

CVE-2013-5963 affects the WordPress plugin Simple Dropbox Upload (multi.php). The vulnerability allows an attacker to upload a file with an executable extension to the plugin’s wp-content/uploads/wpdb/ path and then access it via a direct request, enabling remote code execution. Impact is describ...

Law Enforcement Requests Report: No Skype Data Turned Over

Microsoft’s report on compliance with law enforcement requests for data demonstrates a status quo for the software giant from the last reporting period. While the number of requests from law enforcement dropped worldwide in the first six months of 2013, Microsoft complied with 79 percent of...