CVE-2013-5114

LastPass prior to 2.5.1 allows secure wipe bypass...

CVE-2013-5113

LastPass prior to 2.5.1 has an insecure PIN implementation...

Information disclosure

LastPass prior to 2.5.1 has an insecure PIN implementation...

Design/Logic Flaw

LastPass prior to 2.5.1 allows secure wipe bypass...

CVE-2013-5113

CVE-2013-5113 concerns LastPass versions prior to 2.5.1 and an insecure PIN implementation. The vulnerability affects PIN handling in the affected LastPass release(s) and has associated CVSS scores indicating low (2.0) and medium (3.1) impact metrics in different schemes, with local/physical expo...

CVE-2013-5113

LastPass prior to 2.5.1 has an insecure PIN implementation...

CVE-2013-5114

The core CVE-2013-5114 issue is described across multiple connected sources as affecting LastPass before version 2.5.1 and enabling a secure wipe bypass. The available documents confirm the affected software/version and the impact (bypass of secure wipe), but do not provide technical details on r...

CVE-2013-5114

LastPass prior to 2.5.1 allows secure wipe bypass...

LastPass Fixes Bug That Leaks Credentials

LastPass has patched a bug that could potentially allow malicious websites to access a web user’s credentials from a previously visited site. Tavis Ormandy, a vulnerability researcher from Google Project Zero, discovered the flaw in the LastPass password manager and published it on the project’s...

LastPass Credential Leak From Previous Site Vulnerability

LastPass suffers from an issue where bypassing dopopupregister leaks credentials from the previous site. lastpass: bypassing dopopupregister leaks credentials from previous site I noticed that you can create a popup without calling dopopupregister by iframing popupfilltab.html i.e. via...

CVE-2019-16371

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because dopopupregister can be bypassed via clickjacking...

CVE-2019-16371

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because dopopupregister can be bypassed via clickjacking...

Design/Logic Flaw

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because dopopupregister can be bypassed via clickjacking...

CVE-2019-16371

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because dopopupregister can be bypassed via clickjacking...

CVE-2019-16371

CVE-2019-16371 affects LogMeIn LastPass prior to version 4.33.0. The issue arises from a vulnerability where a crafted website can bypass do_popupregister via clickjacking, enabling credential harvesting for accounts on previously visited sites. This is documented across multiple sources (NVD and...

LastPass Credential Leak From Previous Site

lastpass: bypassing dopopupregister leaks credentials from previous site I noticed that you can create a popup without calling dopopupregister by iframing popupfilltab.html i.e. via moz-extension, ms-browser-extension, chrome-extension, etc. It's a valid webaccessibleresource. Because...

Unspecified Vulnerability in LogMeIn LastPass

LogMeIn LastPass is a cross-platform online password management tool from LogMeIn USA. A security vulnerability exists in LogMeIn LastPass versions prior to 4.33.0. An attacker could exploit the vulnerability by building a specially crafted website to capture credentials for user accounts...

A week in security (November 19 – 25)

Last week on Malwarebytes Labs, we took a look at a devastating business email compromise attack, web skimming antics, and the fresh perils of Deepfakes. We also checked out some Chrome bug issues, and took the deepest of deep dives into DNA testing. Other cybersecurity news Adobe Flash bug—get...

LogMeIn LastPass Denial of Service Vulnerability

LogMeIn LastPass is a free, cross-platform online password management tool from LogMeIn USA. The tool can be integrated with browsers and provides them with password management, autofill forms and other features, supporting random password generation, import and export passwords, multiple...

CVE-2018-10193

LogMeIn LastPass through 4.15.0 allows remote attackers to cause a denial of service browser hang via an HTML document because the resource consumption of onloadwff.js grows with the number of INPUT elements...