Free Twitter Follower Coupon - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Free Twitter Follower Coupon published at the 'play' market has multiple vulnerabilities...

X (Formerly Twitter): Remote Unrestricted file Creation/Deletion and Possible RCE.

Hello Gents, During my research on Twitter BBP, I found below domain name: Reverb.twitter.com Background: We worked with Twitter to develop TwitterReverb, an application that reveals how conversations arise and reverberate across the entire Twitter landscape. The custom application allows visitor...

NetGear R series multi-router remote command injection vulnerability analysis-vulnerability warning-the black bar safety net

Two days before the NTP just doing the complete thing, the NetGear routerNETGEAR routerand to engage in things of T. T. The current CERT in the last week, five have issued a notice,“if the user comes to the router, it is recommended to stop use until the official release of the patch repair.” Thi...

WordPress Twitter Cards Meta plugin <= 2.4.5 - Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) Vulnerabilities

WordPress Twitter Cards Meta plugin Cross-Site Request Forgery CSRF/Cross-Site Scripting XSS were found in 2.4.5 version. When the plugins settings are saved to the database and outputted there is no escaping done. Also, it's missing a nonce to check the request after saving the plugin's settings...

DailyMotion Hack Leaks Emails, Passwords of 87M Users

DailyMotion, a popular video sharing website, said Tuesday it recently suffered an “external security problem” resulting in the compromise of an unspecified number of its users’ data. LeakedSource.com, a repository of breached data, added DailyMotion to its list of “Hacked Sites” on Monday. The...

Disk Savvy Enterprise 9.1.14 Buffer Overflow

!/usr/bin/python print "Disk Savvy Enterprise 9.1.14 Login Buffer Overflow" print "Author: Tulpa / tulpaattulpa-securitydotcom" Author website: www.tulpa-security.com Author twitter: @tulpasecurity Exploit will land you NT AUTHORITY\SYSTEM You do not need to be authenticated, password below is...

Disk Sorter Enterprise 9.1.12 - Buffer Overflow Exploit

Exploit for windows platform in category remote exploits !/usr/bin/python print "Disk Sorter Enterprise 9.1.12 Login Buffer Overflow" print "Author: Tulpa / tulpaattulpa-securitydotcom" Author website: www.tulpa-security.com Author twitter: @tulpasecurity Exploit will land you NT AUTHORITY\SYSTEM...

Dup Scout Enterprise 9.1.14 Buffer Overflow

!/usr/bin/python print "Dup Scout Enterprise 9.1.14 Login Buffer Overflow" print "Author: Tulpa / tulpaattulpa-securitydotcom" Author website: www.tulpa-security.com Author twitter: @tulpasecurity Exploit will land you NT AUTHORITY\SYSTEM You do not need to be authenticated, password below is...

X (Formerly Twitter): Twitter for android is exposing user's location to any installed android app

Hi, I have noticed that while a user is using the location feature in twitter's android application twitter is sending the user's location to all other locally installed applications without verifying the possible malicious receivers By sending a broadcast. As a poc I have created an application...

Microsoft Internet Explorer 8 MSHTML Ptls5::LsFindSpanVisualBoundaries Memory Corruption

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the fifteenth entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these throug...

Server Side Bruteforce Module: brut3k1t

Server Side Bruteforce Module brut3k1t is a server-side bruteforce module that supports dictionary attacks for several protocols. The current protocols that are complete and in support are: ssh ftp smtp XMPP instagram facebook There will be future implementations of different protocols and servic...

brut3k1t - Server-side Brute-force Module (ssh, ftp, smtp, facebook, and more)

Server-side brute-force module. Brute-force dictionary attack, jk attack that supports multiple protocols and services. 1. Introduction brut3k1t is a server-side bruteforce module that supports dictionary attacks for several protocols. The current protocols that are complete and in support are:...

X (Formerly Twitter): [IDOR][translate.twitter.com] Opportunity to change any comment at the forum

POC: https://translate.twitter.com/forum/getting-started/topics/7037/posts/43287/edit Steps to reproduce: 1 Go to any forums topic for example: https://translate.twitter.com/forum/getting-started/topics/7037 2 View source code of the page and take post id screenshot "idor edit.jpg" 3 Append...

Russian Court bans LinkedIn in Russia; Facebook and Twitter Could be Next

As reported late October, the world's largest online professional network LinkedIn is going to ban in Russia beginning Monday following a Moscow court decision this week that found Microsoft-owned LinkedIn to be in violation of the country's data protection laws. Here's why LinkedIn is facing ban...

Facebook Bug Declares Millions of Users Dead, Including Zuckerberg!

Last night, Facebook declared everyone dead, including the company's CEO Mark Zuckerberg, in a massive memorial 'remembering' profile glitch. Well, that's awkward. Despite being very much alive, Facebook users, when logged on to their accounts on Friday afternoon, found their accounts turned to a...

iOS WebView auto-dial vulnerability-vulnerability warning-the black bar safety net

Vulnerability overview Security research experts found that iOS WebViews Assembly in the presence of the vulnerability, an attacker or may exploit this vulnerability to control the target phone to automatically dial a number you can control. In this attack scenario, the attacker can in a short...

pertino.com XSS vulnerability

Vulnerable URL: http://pertino.com/assets/templates/pertino/php/twitter-api.php?jsoncallback=prompt/OPENBUGBOUNTY/...

iOS WebView Problem Allows Attackers to Initiate Phone Calls

iOS developers who have embedded Apple’s WebView into mobile apps need to be aware of an exploitable issue that could allow phone calls to a number of the attacker’s choosing. Researcher Collin Mulliner said the vulnerability is trivial to exploit, requiring at a minimum one line of HTML code. Th...

Microsoft Internet Explorer 10 MSHTML CElement::GetPlainTextInScope Out-Of-Bounds Read

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the third entry in that series. The below information is also available on my blog at http://blog.skylined.nl/20161103001.html. There you can find a repro that trigger...

How Twitter, Amazon, and others were impacted by last Friday's DDOS attack - and what you might want to do about it.

Our partner, Chertoff Group issued the following advisory. Client Advisory: October 21 distributed denial of service DDoS attack. A major distributed denial of service DDoS attack recently 10/21/16 disrupted Internet communications throughout parts of the United States in several waves, and there...