X (Formerly Twitter): Flaw in valid password policy.

Steps to reproduce 1. Go to twitter.com 2. Login with your existing password 3. Change your password from settings.Make 6 space character as your password. 4. After successful update of your password,logout from twitter.com 5. Now login from mobile.twitter.com with existing password which is 6 or...

X (Formerly Twitter): DOM Cross-Site Scripting ( XSS )

Hi, for me works on Firefox 32, tested on Mac OS X Mavericks and Windows 7 https://content.twitter.com/small-business-guide/ onmouseover=alert'XSS' Regards...

Twitter Launches Digits – A Password Free Login Service For App Developers

There’s a good news for app developers. On Wednesday at Twitter’s first annual developer conference Flight, the company announced a new tool for developers which will allow users to log-in to mobile applications using their phone numbers rather than a traditional username and password combination...

CVE-2014-6352

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted...

X (Formerly Twitter): Singup Page HTML Injection Vulnerability

Information There's an HTML Injection Vulnerability exists in Twitter main signup page which can be used by attackers to display personally crafted messages to twitter users for different malicious purposes. Affected parameters invitecode= & invitename=. Steps to reproduce: 1. Refer to the main...

CVE-2014-4113

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, a...

Twitter Files Suit Over Government Restrictions on National Security Letter Data

Twitter has filed a lawsuit in federal court asking that the United States Department of Justice’s prohibitions on publishing the number and kind of government requests for data the company receives be declared unconstitutional. The suit claims that the rules infringe on Twitter’s right to free...

X (Formerly Twitter): Profile Pic padding (Length-hiding) fails due to use of GZIP

Back in August, I noted that Twitter was appending anywhere from dozens to thousands of junk 0x20 bytes on the end of the JPEG and PNG files they serve for users’ profile images. It was suggested that, though invalid, they were doing this deliberately, as an information-hiding mechanism. The HTTP...

X (Formerly Twitter): Twitter Flight SSL 2.0 deprecated protocol vulnerability.

Twitterflight.com From Twitter Inc..I just checked it with whois Website service encrypts traffic using an old deprecated protocol with known weakness wich is obsolete and insecure, you should disable it. POC in the attachments...

Twitter's latest exploit: a hacker can traverse account delete credit card-vulnerability warning-the black bar safety net

Just this month beginning of the month, with other social networks, twitter also started a new vulnerability reward program, bonus reached$1 4 0+/vulnerabilities, you can say the reward is still very lucrative. Compared to our domestic manufacturers to say, I personally think that this is a netwo...

Twitter Vulnerability Allows Hacker to Delete Credit Cards from Any Twitter Account

At the beginning of this month, just like other social networks, Twitter also started paying individuals for any flaws they uncover on its service with a fee of $140 or more offered per flaw under its new Bug Bounty program, and here comes the claimant. An Egyptian Security Researcher, Ahmed...

X (Formerly Twitter): Cross site scripting on ads.twitter.com

Hi, Steps to reproduce the issue: 1 Go to this link https://ads.twitter.com/accounts/XXXX/tweets where is XXXX is your account id. 2 Click on Compose Tweet option and enter " 3 Click on "Tweet" Button now. You will prompt dialog box with "123" in it. POC video:...

X (Formerly Twitter): Stored xss

Hi! There's a stored xss on ads.twitter.com under "Add New App" section at https://ads.twitter.com/accounts/18ce53wsl3g/campaigns/newobjective/appinstalls. There's a option to add android application by Google play app id, so i searched for a app on play store with name " "" " and then i got this...

tinfoleak - Get detailed information about a Twitter user activity

tinfoleak is a simple Python script that allow to obtain: basic information about a Twitter user name, picture, location, followers, etc. devices and operating systems used by the Twitter user applications and social networks used by the Twitter user place and geolocation coordinates to generate ...

Design/Logic Flaw

The Twitter No Background aka com.wTwitternobackground application 0.85.13509.97828 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5753

The Twitter No Background aka com.wTwitternobackground application 0.85.13509.97828 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5753

CVE-2014-5753 affects the Android app com.wTwitternobackground (version 0.85.13509.97828). The root cause is the app’s failure to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted certificates. No exploit...

X (Formerly Twitter): ads.twitter.com xss

Cross-Site Scripting vulnerability exists in cardname parameter when creating/cloning a card via script https://ads.twitter.com/accounts/18ce53wrkma/cards/new?cardtype=7. Here is the simple test vector: alertdocument.cookie After the card is created XSS becomes persistent and can be triggered via...

PHP Stock Management System 1.02 - Multiple Vulnerabilty

Exploit for php platform in category web applications Exploit Title: PHP Stock Management System 1.02 - Multiple Vulnerabilty Date : 9-9-2014 Author : jsass ​ Vendor Homepage: ​http://www.posnic.com/​ Software Link:​ http://sourceforge.net/projects/stockmanagement/ Version: ​1.02 Tested on: kali...

CVE-2014-5753: Undefined Security Weakness

The Twitter No Background aka com.wTwitternobackground application 0.85.13509.97828 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...