Mailchimp breach feels like deja vu

A threat actor successfully used compromised employee credentials to gain access to 133 accounts on Mailchimp, the mainstream Intuit-owned email marketing platform, in a security incident that recently came to light. "On January 11, the Mailchimp Security team identified an unauthorized actor...

Intuit phish says “we have put a temporary hold on your account”

Intuit released a warning about a phishing email being sent to its customers. The phishing emails tell recipients that their account has been put on hold, and try to trick users into “validating their account” to release it again. Intuit Intuit Inc. is an American business software company that...

Attackers Target Intuit Users by Threatening to Cancel Tax Accounts

Just in time for tax season, Intuit is warning customers of a phishing campaign that threatens to close user accounts if they don’t click on a malicious link. The attacks on the accounting-software specialist that many people use for filing U.S. income tax forms comes as phishers overall are...

Intuit to Share Payroll Data from 1.4M Small Businesses With Equifax

Financial services giant Intuit this week informed 1.4 million small businesses using its QuickBooks Online Payroll and Intuit Online Payroll products that their payroll information will be shared with big-three consumer credit bureau Equifax starting later this year unless customers opt out by t...

quickbooks.intuit.com Cross Site Scripting vulnerability OBB-1339510

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault associated with a NULL pointer dereference leading to a denial of service in the intuit_diff_type function in pch.c aka a "mangled rename" issue.

...

CVE-2018-14833

Intuit Lacerte 2017 has Incorrect Access Control...

CVE-2018-14833

Intuit Lacerte 2017 has Incorrect Access Control...

Improper access control

Intuit Lacerte 2017 has Incorrect Access Control...

CVE-2018-14833

CVE-2018-14833 concerns Intuit Lacerte 2017 with an improper access control vulnerability. The connected records describe a client/server scenario where the server transmits the entire customer list in cleartext over SMB after authentication, enabling an attacker on the network to sniff sensitive...

CVE-2018-14833

Intuit Lacerte 2017 has Incorrect Access Control...

Intuit Quicken Deluxe 2018 for Mac Password Protection Authentication Bypass Vulnerability

Summary An exploitable information disclosure vulnerability exists in the password protection functionality of Quicken Deluxe 2018 for Mac version 5.2.2. A specially crafted sqlite3 request can cause the removal of the password protection, allowing an attacker to access and modify the data withou...

Intuit Lacerte 2017 for Windows Information Disclosure Vulnerability

Intuit Lacerte 2017 for Windows is a tax filing software package from Intuit, USA. The software features automatic calculations, automatic diagnostics, and more. A security vulnerability exists in Intuit Lacerte 2017 for Windows, which originates in a client/server environment where the program...

Design/Logic Flaw

Intuit Lacerte 2017 for Windows in a client/server environment transfers the entire customer list in cleartext over SMB, which allows attackers to 1 obtain sensitive information by sniffing the network or 2 conduct man-in-the-middle MITM attacks via unspecified vectors. The customer list contains...

CVE-2018-11338

Intuit Lacerte 2017 for Windows in a client/server environment transfers the entire customer list in cleartext over SMB, which allows attackers to 1 obtain sensitive information by sniffing the network or 2 conduct man-in-the-middle MITM attacks via unspecified vectors. The customer list contains...

CVE-2018-11338

Intuit Lacerte 2017 for Windows in a client/server environment transfers the entire customer list in cleartext over SMB, which allows attackers to 1 obtain sensitive information by sniffing the network or 2 conduct man-in-the-middle MITM attacks via unspecified vectors. The customer list contains...

CVE-2018-11338

CVE-2018-11338 affects Intuit Lacerte 2017 for Windows in a client/server setup where the server sends the entire customer list in cleartext over SMB after client authentication. The exposed data includes full names, SSNs, addresses, job titles, phone numbers, emails, spouse contact details, and ...

PT-2018-10495 · Intuit · Intuit Lacerte

Name of the Vulnerable Software and Affected Versions: Intuit Lacerte version 2017 Intuit Lacerte versions prior to 2017 Description: The software transfers the entire customer list in cleartext over SMB, allowing attackers to obtain sensitive information by sniffing the network or conduct...

June 5, 2018—KB4338548 (OS Build 17134.83)

None None...

intuit.glance.net XSS vulnerability

Open Bug Bounty ID: OBB-626183 Description| Value ---|--- Affected Website:| intuit.glance.net Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...