Twitter Denies Intelligence Community Fire Hose Access Via Dataminr

A Twitter business partner, whose service sifts through Twitter’s so-called fire hose of tweets as well as data from other sources to ascertain patterns in breaking news events, has been told to no longer provide its services to the U.S. intelligence community. The Wall Street Journal on Sunday...

A Cyber Revolution: Advanced Attacks Increasing in EMEA Reflect Political Tension

Financial, geopolitical and economical changes made 2015 a very busy year for the Europe, Middle East and Africa EMEA region, particularly in the cyber realm. FireEye has been monitoring these shifting cyber trends and has identified considerable evolutions to the EMEA threat landscape when...

A Cyber Revolution: Advanced Attacks Increasing in EMEA Reflect Political Tension

Financial, geopolitical and economical changes made 2015 a very busy year for the Europe, Middle East and Africa EMEA region, particularly in the cyber realm. FireEye has been monitoring these shifting cyber trends and has identified considerable evolutions to the EMEA threat landscape when...

X (Formerly Twitter): [Critical] - Steal OAuth Tokens

Hi, This bug is caused because of the same mis-configuration as 128119. Only this time Microsoft Outlook auth is vulnerable instead of Facebook. this time I will try to be as clear as possible. after sign up of Twitter, Twitter asks users to import contacts and it only requires on authorization -...

X (Formerly Twitter): xss in DM group name in twitter

hi, found a xss on twitter Steps 1. Create a DM group with payload alert1;// 2. Whenever anybody shares a tweet via DM, XSS will popup POC https://youtu.be/P2Ram2FBAS4...

Hootsuite for Twitter & Social - Base64 encoded String, Customized SSL, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Hootsuite for Twitter & Social published at the 'play' market has multiple vulnerabilities...

TweetCaster for Twitter - Customized SSL, Exported ContentProvider, Insecure KeyStore vulnerabilities

HackApp vulnerability scanner discovered that application TweetCaster for Twitter published at the 'play' market has multiple vulnerabilities...

Metal for Facebook & Twitter - Customized SSL, MIT license, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Metal for Facebook & Twitter published at the 'play' market has multiple vulnerabilities...

X (Formerly Twitter): XSS using javascript:alert(8007)

I want to report a xss bug. On apps.twitter.com I logged in and start with new app. In new app there is a feild: website: where user has to gave website of app. I just put javascript:alert8007 pay load and popup appears...

PHP 5.5.33 Invalid Memory Write

Exploit Title: Invalid memory write in phar on filename with \0 in name Date: 2016-03-19 Exploit Author: @vah13 Vendor Homepage: https://secure.php.net/ Software Link: https://github.com/php/php-src Version: 5.5.33 Tested on: Linux Test script: --------------- cat test.php ------------------- ';...

Snapchat: XSS found on Snapchat website

Hi Snapchat Team, I've found a reflected XSS vulnerability on this page: https://www.snapchat.com/add/snapchat Example: https://www.snapchat.com/add/%22%3E%3Ch1%3EXSS%3C%2Fh1%3E Note: you should visit the page with a mobile user-agent since the server displays different information based on the...

Microsoft's Artificial Intelligence Tay Became a 'Racist Nazi' in less than 24 Hours

Tay, Microsoft’s new Artificial Intelligence AI chatbot on Twitter had to be pulled down a day after it launched, following incredibly racist comments and tweets praising Hitler and bashing feminists. Microsoft had launched the Millennial-inspired artificial intelligence chatbot on Wednesday,...

CoolPlayer (Standalone) build 2.19 - '.m3u' Stack Overflow

Exploit for windows platform in category local exploits Exploit Title: CoolPlayer Standalone build 2.19 - .m3u Stack Overflow Date: 22-03-2016 Software Link: https://sourceforge.net/projects/coolplayer/files/Coolplayer/219/CoolPlayer219Bin.zip Exploit Author: Charley Celice stmerry Contact:...

Faraday 1.0.17 - Collaborative Penetration Test and Vulnerability Management Platform

Faraday introduces a new concept - IPE Integrated Penetration-Test Environment a multiuser Penetration test IDE. Designed for distribution, indexation and analysis of the generated data during the process of a security audit. The first of many releases in 2016, Faraday v.1.0.17 Community, Pro &...

X (Formerly Twitter): Sub-Domain Takeover

Hey ! Your subdomain web.mopub.com is pointing to DYN but you have not claimed it on DYN end. So what happens here is actually that, since web.mopub.com is pointing to DYN, DYNis actually checking if there's a host with that name. Which in this case was not true. So I was able to claim the domain...

JSN PowerAdmin 2.3.0 Code Exection / CSRF / XSS

--------------------------------------------------------- RatioSec Research Security Advisory RS-2016-001 --------------------------------------------------------- JSN PowerAdmin Joomla! Extension Remote Command Execution Via CSRF and XSS vulnerabilities...

Network Scanner 4.0.0.0 SEH Crash Proof Of Concept

-- coding: utf-8 -- Exploit Title: Network Scanner Version 4.0.0.0 SEH Crash POC POC Dork: N/A Date: 2016-02-15 Author: INSECT.B Twitter : @INSECT.B Facebook : https://www.facebook.com/B.INSECT00 Blog : http://binsect00.tistory.com Vendor Homepage: http://www.mitec.cz/ Software Link:...

Investors Application - Client Side Cross Site Vulnerability

Document Title: =============== Investors Application - Client Side Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1540 Facebook Security ID: 246414938 Release Date: ============= 2016-02-12 Vulnerability Laboratory ID VL-ID:...

MyScript Memo v3.0 iOS - (Mail) Persistent Vulnerability

Document Title: =============== MyScript Memo v3.0 iOS - Mail Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1706 Release Date: ============= 2016-02-10 Vulnerability Laboratory ID VL-ID: ==================================== 170...

X (Formerly Twitter): CSRF in twitterflightschool.com ( CAN POST ON TIMELINE WITHOUT USER PERMISSION)

Hi, 1 Go to twitterflightschool.com and start intercepting every request . 2 No csrf tokens are present in the requests 3 Even in account settings there are no csrf tokens Attacker could post on twitter timeline of user https://twitterflightschool.com/module/twitter-for-executives/chapter/final T...