X (Formerly Twitter): ads.twitter.com xss

Cross-Site Scripting vulnerability exists in cardname parameter when creating/cloning a card via script https://ads.twitter.com/accounts/18ce53wrkma/cards/new?cardtype=7. Here is the simple test vector: alertdocument.cookie After the card is created XSS becomes persistent and can be triggered via...

X (Formerly Twitter): password sent over HTTP

URL: http://lb.vine.co/login you need to use HTTPS and enforce it :...