1051 matches found
Legal Robot: Account profile shows encryption recovery box for all users
A security researcher discovered that the encryption recovery section on the Legal Robot account profile page was shown to all users, even those that were not using the feature. There was no security impact from any user seeing or using the feature - quite the opposite, in fact. However, when...
Legal Robot: Enhancement: email confirmation for 2FA recovery
While searching for other issues, a security researcher proposed an enhancement to our 2FA account recovery: require email verification for 2FA recovery use. We implemented this change and thank @goodhackonly for an excellent suggestion that makes Legal Robot even more secure...
Legal Robot: 2FA user enumeration via password reset
While going live with additional 2FA options, a security researcher discovered that during password reset, users that had enabled 2FA were prompted for a second factor. This made the password reset more difficult, and could have allowed enumeration of users that had enabled 2FA. To some degree, 2...
Legal Robot: Missing link to TOTP manual enroll option
While going live with additional 2FA options, a security researcher discovered that during TOTP enrollment, only a barcode was displayed to users, no TOTP manual enroll option with a printed base32 secret was provided for non-smartphone users...
ALPINE-CVE-2017-9347
In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/asn1/ros/packet-ros-template.c by validating an OID...
Watch Hackers Sabotage an Industrial Robot Arm
Researchers were able to take control of a 220-pound robotic arm to damage the products it manufactures---or the person that operates it. The post Watch Hackers Sabotage an Industrial Robot Arm appeared first on WIRED...
Weblate: 7BO: Binary Option Robot URL should be HTTPS
SUMMARY This is just for the awareness to use HTTPS everywhere, even for outgoing links - where it's possible. Treat this report with some salt, not as in hashes. Not really a security bug, but I think will be a good idea to add HTTPS on 7BO: Binary Option Robot Button. Navigate this URL:...
CVE-2016-1148
CVE-2016-1148 affects Akerun – Smart Lock Robot App for iOS prior to v1.2.4, where the iOS app fails to verify SSL server certificates. This undermines TLS trust and can enable a man-in-the-middle attack to eavesdrop on encrypted traffic. The issue is documented in multiple sources (including JVN...
CVE-2016-1148
Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates...
Legal Robot: Big XSS vulnerability!
Here you can see that XSS but which is openly redirectable.. Plz fix it and pay me bounty...
Legal Robot: sql injection vulnerablity found
a Blind Text Injection Differential vulnerablity was found on your site in the url :https://www.legalrobot.com/assets/icons a GET request made on GET /assets/icons/?v=9wr1emhXD568%3B'%20UNION%20SELECT%208%2C%20tablename%2C%20'vega'%20FROM%20informationschema.tables%20WHERE%20tablename%20like'%25...
Robots Rife With Cybersecurity Holes
Robots with inadequate security could be hacked and cause physical harm or be used to spy on unsuspecting owners in the near future. Researchers at IOActive Labs released a report Wednesday warning that consumer, industrial and service robots in use today have serious security vulnerabilities...
Legal Robot: S3 ACL misconfiguration
Summary: Legal Robot's s3 bucket legalrobot.com is misconfigured. The ACL allows me to access and copy all files. This means that I could go through and copy all the media files on the s3 bucket. I did not attempt to delete any files as I did not want to go too far and affect your operations. Ste...
Legal Robot: Missing restriction on string size in profile fields
Security researcher reported that there was no restriction on the amount of text that could be inserted into a user's profile field. The researcher also demonstrated that when the text size was large enough the service was restarted, resulting in a momentary outage in our non-production environme...
Google Explorer - Google Mass Explorer
+Google Mass Explorer This is a automated robot for google search engine. Make a google search, and parse the results for a especific exploit you define. The options can be listed with --help parameter. Intro: This project is a main project that i will keep upgrading when new exploits are...
Legal Robot: Bypass 8 chars password complexity with 6 chars only due to insecure password reset functionaliy
While password complexity requirements were implemented in the original signup page, these were not added to the password reset page. Thanks to this security researcher's efforts, we've added this functionality there as well...
Legal Robot: Information Disclosure on rate limit defense mechanism
Security researcher showed that we were returning the number of seconds to wait between attempts. While this can be helpful for legitimate users, it's more likely to be exploited by attackers that simply need to set a timer for the number of seconds we return in the error message...
Legal Robot: Cloudflare issue: Error 521 Ray ID: 2e7ea7f706ea4056 • 2016-09-25 12:59:55 UTC Web server is down
Error 521 Ray ID: 2e7ea7f706ea4056 • 2016-09-25 12:59:55 UTC Web server is down Cloudflare issue : http://legalrobot-uat.com/ https://tools.pingdom.com/!/dJuXU5/http://legalrobot-uat.com/...
Legal Robot: Near-duplicate accounts allowed with ignored email mutations
A security researcher discovered that near-duplicate accounts like [email protected], [email protected], and [email protected] were all treated as separate accounts, while some email services, like gmail and google apps, treat these as the same account. This issue could lead to excess ema...