Code injection

The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the 1 "post to twitter" permission or change the options...

CVE-2015-7229

The Drupal Twitter module vulnerability CVE-2015-7229 affects Drupal sites using the Twitter submodule (6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, 7.x-6.x before 7.x-6.0). The root cause is improper access checks, allowing remote authenticated users with the post to twitter, add twitter acco...

CVE-2015-7229

The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the 1 "post to twitter" permission or change the options...

CVE-2015-7229: Undefined Security Weakness

The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the 1 "post to twitter" permission or change the options...

Pair of Drupal Modules Patch Access Bypass Flaws

A pair of modules included in the Drupal content management system have been updated to fix access bypass vulnerabilities that could allow an attacker to take actions on the behalf of some users. One of the modules fixed is the Twitter module, which allows users to take a variety of actions,...

Twitter - Moderately Critical - Access bypass - SA-CONTRIB-2015-146

This module enables you to pull in public tweets from Twitter accounts, post messages to Twitter to announce content changes, and authenticate using Twitter. The module doesn't sufficiently check for access when using the Twitter Post submodule to post messages to Twitter and allows a tweet to be...

Twitter Open Sources 'Diffy' that Automatically Catches Potential Bugs in Code

After, Facebook open sourced Thrift Technology an internally used tool by Facebook in 2007, rival entity Twitter brings Diffy, an internal Twitter service to the world. Yesterday, Twitter introduced "Diffy," an open source tool, acting as a helping hand for the software developers to catch bugs,...

X (Formerly Twitter): XSS on OAuth authorize/authenticate endpoint

Hi, I would like to report an issue where certain endpoints on twitter.com and api.twitter.com is vulnerable to XSS. Detail The redirection page after authorization/authentication does not sanitize the oauthcallback parameter. PoC 1. Go to http://innerht.ml/pocs/twitter-oauth-xss Please use IE or...

X (Formerly Twitter): Highly wormable clickjacking in player card

Hi, I would like to report an issue where player card is vulnerable to clickjacking in certain browsers. This may result in something similar to XSS worm and many other critical damages. Details Twitter Player Card allows a website to embed a custom playerhtml into an iframe in a tweet. There are...

Dennis Fisher and Mike Mimoso on the Ashley Madison Breach and the Wyndham Data Breach Decision

Dennis Fisher and Mike Mimoso discuss the quasi-interesting fallout from the Ashley Madison hack, the appeals court decision about the Wyndham data breaches, and Charlie Miller leaving Twitter. Download: digitalunderground217.mp3 Music by Chris Gonsalves...

X (Formerly Twitter): XSS and cache poisoning via upload.twitter.com on ton.twitter.com

Hi, I would like to report an issue where attackers can bypass the upload restriction on upload.twitter.com to cause XSS on ton.twitter.com and cache poisoning. Detail When using upload.twitter.com to upload audience data, it checks if the file type is allowed and rejects any harmful files e.g...

Charlie Miller to Leave Twitter Security Team

Charlie Miller, one of the more respected and accomplished security researchers in the industry, is leaving Twitter’s security team after three years. Miller said on Monday that he is leaving the company at the end of this week and that he plans to announce his new job next week. Miller joined...

Geotweet - Social engineering tool for human hacking

Another way to use Twitter and instagram. Geotweet is an osint application that allows you to track tweets and instagram and trace geographical locations and then export to google maps. Allows you to search on tags, world zones and user info and timeline. Requirements Python 2.7 PyQt4, tweepy,...

live.airtelworld.com Open Redirect vulnerability

Vulnerable URL: http://live.airtelworld.com/twitter/hash.html?redirectUrl=https://www.xssposed.org/search/?search=test=host=TNW=4-N-V Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| Open Redirect Vulnerability status:| Publicly disclosed...

MASM321 11 Quick Editor '.qeditor' 4.0g - '.qse' File Buffer Overflow (SEH) (ASLR + SafeSEH Bypass)

!/usr/bin/env python Exploit Title: MASM32 quick editor .QSE SEH Based Buffer Overflow ASLR & SAFESEH bypass Date: 2015-08-15 Exploit Author: St0rn Twitter: st0rnpentest Vendor Homepage: http://www.masm32.com/ Software Link: http://www.masm32.com/masmdl.htm Version: MASM32 11 qeditor 4.0g Tested...

Microsoft Windows HTA (HTML Application) - Remote Code Execution Exploit

Microsoft Windows HTA HTML Application remote code execution exploit that leverages MS14-064. !/usr/bin/php poc'."\n\n"; $reza = socketcreateAFINET, SOCKSTREAM, 0 or die'Failed to create socket!'; socketbind$reza, 0,$port; socketlisten$...

Twitter Adds Email Privacy Data to Transparency Report

The number of information requests Twitter is receiving from the United States government is increasing steadily, having risen roughly 50 percent in the first six months of this year compared to the last six months of 2014. In its latest transparency report, Twitter said that it received 2,436...

Gratipay: Possible SQL injection on "Jump to twitter"

The https://gratipay.com/on/twitter/' single-quote at the end request returns 500 Error, but https://gratipay.com/on/twitter/" returns 404 so i believe it may be an injection. To find the url, go to /search and jump to ' twitter...

Model S has a security vulnerability? Tesla Fury dig Google head of security-vulnerability warning-the black bar safety net

Earlier today broke the Tesla Model S model electric car, there may be hackers exploit major security vulnerability through this vulnerability hackers can remotely control cars, and even let the car flameout, the media reported this message and of the electric car's safety questioned. Tesla in...

New Hammertoss Espionage Tool Tied to MiniDuke Gang

The espionage gang behind the MiniDuke backdoor uncovered by Kaspersky Lab and CrySys Lab in 2013 has surfaced again with a new backdoor and attack platform that is used sparingly against only high-value targets. The new data theft tool, called Hammertoss, is a study not only in espionage...