Legal Robot: No notification on change password feature

A security researcher discovered that Legal Robot did not send notifications on important account changes, like password changes. While there was no specific security vulnerability, we decided to add notifications for Password Change, TOTP Enable/Disable, U2F Enable/Disable, Recovery Code Use, an...

Legal Robot: Missing link to 2FA recovery code

While going live with additional 2FA options, a security researcher discovered that while we provide a TOTP fallback and Recovery code fallback for users that have enabled U2F, we neglected to do this for TOTP-only users. All users that have enabled TOTP or U2F 2FA should have been able to access...

UBUNTU-CVE-2015-8889

The aboot implementation in the Qualcomm components in Android before 2016-07-05 on Nexus 6P devices omits the recovery PIN feature, which has unspecified impact and attack vectors, aka Android internal bug 28822677 and Qualcomm internal bug CR804067...

OracleVM 3.1 : xen (OVMSA-2013-0043)

The remote OracleVM system is missing necessary patches to address critical security updates : - x86/xsave: properly check guest input to XSETBV Other than the HVM emulation path, the PV case so far failed to check that YMM state requires SSE state to be enabled, allowing for a GP to occur upon...

Microsoft Protects User Accounts with New Security Features

Microsoft announced yesterday that it will complement the two-factor authentication it enabled for account holders in April with additional security features designed to deny account hijacking and unauthorized access. Windows PC and mobile users, along with Outlook, SkyDrive, Xbox, Skype and othe...