Dropbox Hacked — More Than 68 Million Account Details Leaked Online

Hackers have obtained credentials for more than 68 Million accounts for online cloud storage platform Dropbox from a known 2012 data breach. Dropbox has confirmed the breach and already notified its customers of a potential forced password resets, though the initial announcement failed to specify...

Phabricator: link reset problem

Hello, i found out about an issue in your password reset links and their expiration Steps to reproduce: Request a password reset link to an account Login to the account afterwards Logout and use the link to reset the password The link would not be expired Now i know that the links need to expire...

1.7 Million Opera Browser Users Told To Reset Passwords

Opera Software is warning 1.7 million users of its Opera web browser sync feature of a possible attack that exposes passwords to hackers. In a security bulletin posted on Friday, the company said its Opera sync system showed “signs of an attack” and asked users to change their Opera sync password...

Dropbox Forces Password Reset for Older Users

Online storage service Dropbox began notifying users over the weekend that if they haven’t updated their password since 2012, they’ll be prompted to update it the next time they log into their account. The company claims the move is “purely a preventative measure” and stressed that there’s no pro...

Opera Browser Sync Service Hacked; Users' Data and Saved Passwords Compromised

Opera has reset passwords of all users for one of its services after hackers were able to gain access to one of its Cloud servers this week. Opera Software reported a security breach last night, which affects all users of the sync feature of its web browser. So, if you’ve been using Opera’s Cloud...

Hacker reveals How He Could have Hacked Multiple Facebook Accounts

How to Hack a Facebook Account? That's possibly the most frequently asked question on the Internet today. Though the solution is hard to find, a white hat hacker has just proven how easy it is to hack multiple Facebook accounts with some basic computer skills. Your Facebook account can be hacked,...

Opera server breach incident

News Opera server breach incident Share August 26th, 2016 Earlier this week, we detected signs of an attack where access was gained to the Opera sync system. This attack was quickly blocked. Our investigations are ongoing, but we believe some data, including some of our sync users’ passwords and...

GTA Fan Forum Hacked: Old vBulletin Software To Blame

Outdated vBulletin forum software is being blamed for the breach of a Grand Theft Auto fan forum called GTAGaming. It marks the second time in two days a gaming forum has been targeted by hackers and that a SQL injection vulnerability is believed to have been exploited. The fan website notified...

Uber: Stealing users password (Limited Scenario)

Hello Team, Description : This is report is about an interesting scenario where an user's password can be steal while password reset process due to wired user controlled redirection take place after password reset process. By accepting the fact that URL redirect is not in scope for uber but this...

Security Advisory - Reset Password and Information Leak Vulnerabilities in Huawei UMA

The Unified Maintenance Audit UMA system provides a unified portal for O&M operations, controls and records users' O&M operations, and supports auditing by way of command display and video replay. The UMA has two security vulnerabilities. One vulnerability is due to insufficient parameter...

Nextcloud: Password Reset Link issue

Hello, i found out about an issue in your password reset links and their expiration Steps to reproduce: Request a password reset link to an account Login to the account afterwards Logout and use the link to reset the password The link would not be expired Now i know that the links need to expire...

Gratipay: Reset Link Issue

Hello, i found out about an issue in your password reset links and their expiration Steps to reproduce: Request a password reset link to an account Login to the account afterwards Logout and use the link to reset the password The link would not be expired Now i know that the links need to expire...

Multiple NUUO and NetGear Product Management Password Reset Vulnerability

NUUO NVRmini 2 is a network video recorder from NUUO.NetGear ReadyNAS Surveillance is a comprehensive IP video surveillance solution from NetGear that integrates video surveillance software, storage, switching and network management. An administrative password reset vulnerability exists in NUUO...

Unsafe Query Generation Risk in Active Record

There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing. This vulnerability is similar to CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155. Impact ------ Due to the way Active Record interprets parameters in combination with the way that JSON parameters are...

Instacart: Host Header Injection/Redirection in: https://www.instacart.com/

Hi, Your website is vulnerable to Host Header Injection because the host header can be changed to something outside the target domain In many cases, developers are trusting the HTTP Host header value and using it to generate links, import scripts and even generate password resets links with its...

NUUO NVRmini 2 / NETGEAR ReadyNAS Surveillance Default Configuration Load and Administrator Password Reset

The NVRmini 2 Network Video Recorded and the ReadyNAS Surveillance application are vulnerable to an administrator password reset on the exposed web management interface. Note that this only works for unauthenticated attackers in earlier versions of the Nuuo firmware before v1.7.6, otherwise you...

Yahoo Investigates 200 Million Alleged Accounts For Sale On Dark Web

Yahoo says it is investigating reports of 200 million user credentials advertised for sale on the Dark Web by a hacker that goes by the handle “peaceofmind”. The Yahoo credentials, according to the site listing the database for sale, includes usernames, passwords hashed using the MD5 algorithm,...

Datadog Forces Password Reset Following Breach

Datadog, a software-as-a service-based provider of IT infrastructure monitoring and analytics services, has forced a password reset on all of its user and admin accounts following a breach last Friday. “We have detected unauthorized activity associated with a handful of production infrastructure...

BMW Client-Side Cross Site Scripting

Document Title: =============== BMW - Token Client Side Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1737 Release Date: ============= 2016-07-06 Vulnerability Laboratory ID VL-ID: ====================================...

BMW - (Token) Client Side Cross Site Scripting Vulnerability

Document Title: =============== BMW - Token Client Side Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1737 Vulnerability Magazine:...