WordPress Inline Tweet Sharer – Twitter Sharing Plugin Plugin <= 2.5.3 is vulnerable to Cross Site Scripting (XSS)

Software Inline Tweet Sharer – Twitter Sharing Plugin Type Plugin Vulnerable versions = 2.5.3 Fixed in 2.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-24005 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID dfc715a3d8ea...

WordPress Better Click To Tweet plugin <= 5.10.1 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress Better Click To Tweet plugin versions = 5.10.1. Solution Update the WordPress Better Click To Tweet plugin to the latest available version at least 5.10.2...

WordPress Tweet Old Custom Post plugin <= 19.0.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Tweet Old Custom Post plugin versions = 19.0.1. Solution No patched version available...

WordPress Tweet Old Custom Post plugin <= 19.0.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Tweet Old Custom Post plugin versions = 19.0.1. Solution No patched version available...

Child Tweets Gibberish from U.S. Nuke Account

A nonsense tweet sent out from the official account of U.S. Strategic Command is no reason for alarm, according to the department. The social media manager’s kid found an open laptop, pounded on a few random keys and sent the tweet, which read, “;l;;gmlxzssaw” last Sunday. The tweets were met wit...

A child sent out gibberish tweet from official US Nuclear-agency account

By Deeba Ahmed A Child’s Gibberish Tweet from US Nuclear-agency Account Sends Twitter into Frenzy - Sparks Debates on National Security. This is a post from HackRead.com Read the original post: A child sent out gibberish tweet from official US Nuclear-agency account...

tweet-per-sec.com Cross Site Scripting vulnerability OBB-1460680

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

tweet-per-sec.com Cross Site Scripting vulnerability OBB-1365241

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

X (Formerly Twitter): Denial of Service | twitter.com & mobile.twitter.com

Hi Team, Detail: I found a DoS that works on twitter.com and mobile.twitter.com, but it doesn't work on the mobile app. The user only needs to view the message or tweet in order to be exposed to this DoS. As far as I can remember, a report similar to this report has been sent to you before, but I...

h1-ctf: [H1-2006 2020] Bounty Pay CTF challenge

H1-2006 2020 Bounty Pay CTF challenge Hi there! This is my H1-2006 CTF writeup submission. First of all, thanks for the great challenge! This was my first H1 CTF that I played. I really enjoyed doing it and I learned new things solving this challenge. In my case, it was the demonstration that I...

Latest Apple Text-Bomb Crashes iPhones via Message Notifications

Apple devices are vulnerable to a “text bomb” attack where simply looking at messages or posts containing characters in the Sindhi language can crash devices. Sindhi is an official language used in Pakistan. The bug affects iPhone, iPad, Macs and Apple Watches, and arises from macOS and iOS faili...

X (Formerly Twitter): http request smuggling in twitter.com

Summary: the same vulnerability reported in other domain , see this report here Description: the Description of HTTP request smuggling attacks : here Detect HTTP request smuggling attack subdomains vulnerable: -to detect HTTP request smuggling attack with add header Transfer-Encoding: chunked and...

CVE-2016-10986

The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumerkey, consumersecret, accesstoken, and accesstokensecret...

CVE-2016-10986

The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumerkey, consumersecret, accesstoken, and accesstokensecret...

CVE-2016-10986

The tweet-wheel plugin before 1.0.3.3 for WordPress has XSS via consumerkey, consumersecret, accesstoken, and accesstokensecret...

CVE-2016-10986

CVE-2016-10986 concerns the Tweet Wheel WordPress plugin prior to version 1.0.3.3, which is vulnerable to reflected Cross-Site Scripting (XSS) via the OAuth parameters consumer_key, consumer_secret, access_token, and access_token_secret. The issue is documented across multiple feeds (NVD, Red Hat...

50m-ctf: CTF Writeup - c8889970d9fb722066f31e804e351993

CTF Code: c8889970d9fb722066f31e804e351993 HackerOne $50M CTF Write-Up ============ I came across this tweet announcing the HackerOne CTF for invitations to the HackerOne event in Vegas during DEFCON. I tried searching for a URL for the CTF, but couldn't find anything online, so I assumed that th...

50m-ctf: CTF write-up: c8889970d9fb722066f31e804e351993

So the CTF starts with this tweet. F434370 The first image is about the 50 million in bounties but the second one looks related to the CTF. The first thing that comes to mind when relating CTFs and images is "steganography". Using the all purpose steg tool zsteg as our first resort, we discover...

X (Formerly Twitter): Protected tweets exposure through the URL

Summary Leaking sensitive information from protected tweets via a prepared website. This vulnerability could lead to exposure of information such as credit card numbers, bank account numbers, phone numbers, tokens, specific words or even the whole phrases but also the exposure of any additional...

WSJ Webpage Defaced to Support PewDiePie

UPDATE A webpage owned by the Wall Street Journal was hacked on Monday, in an attempt to promote YouTube celebrity “PewDiePie.” The incident comes on the heels of a separate hack relating to the Swedish YouTuber, comedian and video game commentator, whose given name is Felix Kjellberg. Over the...