Lenovo ID flaw allowed hackers to break into 5,000 Dropbox accounts

🕵️ RESEARCH & DEEP DIVES

• Masteriyo LMS WordPress plugin through 2.2.0 exposes unauthenticated arbitrary course progress deletion
  The Masteriyo LMS WordPress plugin is vulnerable to unauthenticated arbitrary data deletion due to a missing capability check.

  • Affects WordPress sites running the Masteriyo LMS plugin versions 2.2.0 and below.
  • The 'delete_item_permissions_check' function in CourseProgressItemsController lacks a capability check, allowing unauthorized data deletion.
  • Unauthenticated attackers can exploit the missing authorization to delete arbitrary course progress data.
  Sources 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• Out-of-bounds vulnerability found in markdown md.c lds function up to commit 058cab0cb7
  An out-of-bounds vulnerability was identified in the lds function of the md.c file in the 92181 markdown project.

  • Affects the 92181 markdown project up to commit 058cab0cb7fb245a0ccc6b8446963ff8d573558f
  • The flaw resides in the lds function of the md.c file
  • Executing a manipulation can lead to an out-of-bounds condition
  Sources 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• MISP missing authorization in cryptographic key view exposes signing keys
  MISP fails to enforce parent-event visibility when serving cryptographic keys, exposing signing keys to unauthorized users.

  • Affects MISP users; vulnerable CryptographicKeysController::view() handler queried CryptographicKey directly without checking parent-event access permissions
  • Missing authorization lets unauthorized users retrieve cryptographic signing keys for events they cannot view
  • No CVE ID assigned yet
  Sources 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• FreeIPA flaw lets unauthenticated LDAP client obtain administrator credentials
  A FreeIPA flaw in the self-managed OTP token ACI allows an unauthenticated LDAP client to obtain administrator credentials.

  • Affects FreeIPA deployments using self-managed OTP token authentication
  • The OTP token ACI does not require authentication and does not restrict attributes added alongside the token entry
  • An unauthenticated LDAP client can exploit this to obtain administrator credentials
  Sources 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

• Lenovo ID login flaw allowed hackers to break into 5,000 linked Dropbox accounts
  A flaw in Lenovo's login system let hackers access around 5,000 Dropbox accounts.

  • Users who linked their Dropbox account to a Lenovo ID were affected, often for easier login on Lenovo laptops.
  • Attackers exploited a hole in Lenovo's login system to gain access to roughly 5,000 Dropbox accounts.
  Sources 📎 Coverage: bitdefender.com · 👁 via Graham Cluley

• Roundcube Webmail patches 12 flaws across 1.6 LTS and 1.7 branches, including zero-click XSS and SSRF bypass
  Roundcube Webmail has released updates fixing 12 security vulnerabilities in its 1.6 LTS and 1.7 branches.

  • Applies to users of Roundcube Webmail 1.6 LTS and 1.7 branches.
  • The 12 flaws enable cross-site scripting, email header injection, cross-user data access, remote-content bypasses, and server-side request forgery attacks.
  • Fixed in new releases Roundcube 1.6.19 and 1.7.4, addressing how the open-source webmail platform processes email.
  Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

📋 ADVISORIES

• 📄 Source for User Profile Builder plugin (<=3.15.7) hit by unauthenticated stored XSS via Biographical Info field — wordfence.com

• Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits — SecurityWeek

• North Korean Hackers Deploy New Linux Espionage Toolkit — SecurityWeek

• OpenAI Agents Hijack Another Victim Website — SecurityWeek

• Modified ScreenConnect Clients Used in Worm-Like Campaign — SecurityWeek

• Mathspace discloses data breach affecting over 1 million people — BleepingComputer

• Trezor data breach impact now reaches 81,000 customers — BleepingComputer

• Your Cloud Security Checklist Doesn't Work the Way You Think It Does — The Hacker News

• Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts — The Hacker News

• Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released — The Hacker News

• Automobile Camouflage to Hide from Flock Cameras — Schneier on Security

• ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicati... — CVE ThreatInt

• MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions an... — CVE ThreatInt

• Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Applicat... — CVE ThreatInt

• MISP Dashboard Button Widget Allows Stored XSS via Unsafe javascript: and Bac... — CVE ThreatInt

• MISP Insufficient Outbound URL Validation Allows SSRF and Credential Disclosu... — CVE ThreatInt

• OTP Bypass in Bahçelievler Muncipality's BiHayat AppImproper restriction of e... — CVE ThreatInt

• Otter Blocks through 3.1.7 - Missing Authorization to Unauthenticated Purchase Ver... — CVE ThreatInt

• Flamingo through 2.6.2 - Authenticated (Contributor+) Missing Authorization to Una... — CVE ThreatInt

• ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Acti... — CVE ThreatInt

• MISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Un... — CVE ThreatInt

• Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.... — CVE ThreatInt

• MISP Dashboard Template REST API Exposes Template Owner Email Addresses to Un... — CVE ThreatInt

• Freeipa: idm: freeipa: idp-add eval() reachable before authorization check al... — CVE ThreatInt

• • Kimsuky Hackers Use OpenCode AI Agent to Mass-Produce Phishing Decoys in LNK Attacks (5