WordPress Twitter 2.37 Cross Site Scripting Vulnerability

WordPress Twitter plugin version 2.37 suffers from a cross site scripting vulnerability. WordPress Twitter 2.37 Cross Site Scripting Vulnerability Effected Version : 2.36 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical...

WordPress Social Essentials Social Stats And Sharing Buttons 1.3.1 XSS

Plugin Name : Social Essentials Social Stats and Sharing Buttons Effected Version : 1.3.1 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : Th...

WordPress Twitter 2.37 Cross Site Scripting

Effected Version : 2.36 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : In the following fields put the payload as below...

Twitter State-Sponsored Attack Notification

Update A relatively small number of Twitter users, including a few connected to security and privacy advocacy, have been informed that their accounts have been targeted by state-sponsored hackers. Notifications began appearing in the inboxes of affected users two days ago, with very little concre...

Shopify: shopifyapps.com XSS on sales channels via currency formatting

pinterest, twitter, buy button and facebook sales channels vulnerable to xss via currency formatting. steps to reproduce: - remove pinterest, twitter, buy button and facebook sales channels at .myshopify.com/admin/channels - go to .myshopify.com/admin/settings/general - change currency formating ...

Tor Messenger - Chat over Tor, Easily

Tor Messenger is a cross-platform chat program that aims to be secure by default and sends all of its traffic over Tor. It supports a wide variety of transport networks, including Jabber XMPP , IRC , Google Talk , Facebook Chat , Twitter , Yahoo , and others; enables Off-the-Record OTR Messaging...

X (Formerly Twitter): Add tweet to collection CSRF

Hi Team, I have found a CSRF vulnerability which force victim to add tweets in his collection. HTML POC : Before using this POC change the Collection ID to your collection ID and you will see that tweet will be added into your collection.You can Also add so many tweets in one request by adding...

Anonymous Hacking Group Takes Down 20,000 ISIS Twitter accounts

In the wake of horrific terror attacks in Paris, the online Hacktivist group Anonymous last week declared "total war" against the Islamic State militant group ISIS that claimed responsibility for the attacks. While French, Russian, and US military are bombing ISIS from the sky, Anonymous members...

ISIS Calls Anonymous "IDIOTS" and Issues 5 Lame Tips for its Members to Avoid Getting Hacked

The Anonymous Hacking group on Sunday declared Total War against the ISIS, the Islamic State terror organization that claimed responsibility for the Paris attacks on Friday that killed 129 people and hundreds more injured. In a sinister video posted on YouTube, the Cyber Hacktivists said they wil...

X (Formerly Twitter): Urgent : Unauthorised Access to Media content of all Direct messages and protected tweets(Indirect object reference)

Hi Team, You can tweet from your ad account while creating a campaign.When you add a media content from your computer and upload it there is a Json request which gives you the link of your mediaPhotos to preview before Tweeting.This link is Vulnerable to IDOR Attack and it leads to disclose all t...

ISIS Supporter Hacks 54,000 Twitter Accounts and Posts Details of Heads of the CIA and FBI

ISIS hackers have hacked tens of thousands of Twitter accounts, including the accounts of the members of CIA and the FBI, in revenge for the US drone strike that killed a British ISIS extremist in August. The Cyber Caliphate, a hackers group set up by British ISIS member Junaid Hussain, urged its...

X (Formerly Twitter): Following a User After Favoriting Actually Follows Another User (related to #95243)

Hi, There appears to be a bug similar to 95243 which affects following a user after favoriting one of their tweets via an Intent dialog. The following is a proof of concept: https://twitter.com/intent/favorite/?tweetid=661625230297821184&screenname=ericrtest3 The screenname param submits with the...

Gold MP4 Player - '.swf' Local Overflow

!/usr/bin/python EXPLOIT TITLE: GOLD PLAYER Local Exploit AUTHOR: Vivek Mahajan - C3p70r Credits: Gabor Seljan Date of Testing: 30 October 2015 Download Link : http://download.cnet.com/GoldMP4Player/3000-21394-10967424.html Tested On : Windows 8.1 Pro and Windows 7 Ultimate Steps to Exploit Step ...

X (Formerly Twitter): Can see private tweets via keyword searches on tweetdeck

I'm not the best at finding "why" this happened, but I am pretty sure it's not supposed to. I was keyword searching "protonmail invite" and this came up even though the user was not on public nor did i follow him. I go to twitter.com and search for the exact same tweet, nothing comes up of his...

Keybase: Un-handled exception leads to Information Disclosure

Steps: 1. Login to https://keybase.io/ 2. Click on Me icon from top-right button https://keybase.io/username 3. Click on Edit picture button https://keybase.io/usernameedit-me 4. Intercept the traffic using proxy tool e,g, Burp Suite 5. Click on "Prove my Twitter identity" link 6. In the request,...

Yahoo Hires Bob Lord as CISO

Yahoo has filled the vacancy in its CISO office, today announcing the hiring of former Twitter and Rapid7 security executive Bob Lord. Lord starts in his new role Nov. 9. He was most recently Rapid7’s CISO-in-residence; he has spent much of the last two decades in high-profile security positions...

X (Formerly Twitter): CSRF on cards API

Hi, I would like to report an CSRF issue on the cards API endpoint /i/cards/api/v1.json. Detail Currently the endpoint is responsible for poll cards maybe more to come. When a user votes, a request will be sent to this endpoint to record the user's selected choice. By default there's a CSRF...

X (Formerly Twitter): Following a User Actually Follows Another User

I can display a web intent page to a victim that appears to prompt them to follow one user, but actually ends up following a completely different user when they click "follow". The following is a proof of concept:...

X (Formerly Twitter): XSS in the "Poll" Feature on Twitter.com

I have found an XSS on the "Poll" feature on Twitter.com. Payload Example: Screenshot: I have attached a screenshot in this submission in order to demonstrate the issue. Best, Mazin...

High school Student Hacked Into CIA Director's Personal Email Account

A self-described teenage hacker has claimed to have hacked into personal AOL email account of Central Intelligence Agency CIA Director John Brennan and swiped sensitive top-secret data. It's Really a major embarrassment for Brennan as well as the CIA. The hacker, who describes himself as an...