Dropbox hit by security bug