X (Formerly Twitter): Notifications can mark as read by CSRF

If a website use this code, visitor's Twitter notifications will be marked as read. You can easily check it locally, I'm not uploading any proof or file...

X (Formerly Twitter): XSS via Fabrico Account Name

O.S: Windows 8 Browser: Google Chrome Steps to reproduce: 1 Inject This Payload while Signing Up your account at fabrico " 2 After the Confirmation, Activate your account That's it Pop Will indicate XSS vulnerability...

i-Ftp 2.20 Buffer Overflow

!/usr/bin/python Exploit Title:i-FTP Buffer Overflow SEH Homepage:http://www.memecode.com/iftp.php Software Link:www.memecode.com/data/iftp-win32-v220.exe Version:i.Ftp v2.20 Win32 Release Vulnerability discovered:26.10.2014 Description:Simple portable cross platform FTP/SFTP/HTTP client. Tested...

X (Formerly Twitter): Option Method Enabled on web server

Vuln Details: I detected that OPTIONS method is allowed. This issue is reported as extra information. Impact: Information disclosed from this page can be used to gain additional information about the target system Remedy: Disable OPTIONS method in all production systems. POC: REQUEST: OPTIONS...

'The Hacker News' Celebrating its 4th Anniversary

Dear THN Readers, 'The Hacker News' is celebrating its 4th Anniversary today and we would like to thank every single Hacker, Researcher, Journalist, Enthusiast who has contributed to our phenomenal growth. When we began our journey 4 years back as a Small Local Community of few Hackers and Securi...

X (Formerly Twitter): Flaw in valid password policy.

Steps to reproduce 1. Go to twitter.com 2. Login with your existing password 3. Change your password from settings.Make 6 space character as your password. 4. After successful update of your password,logout from twitter.com 5. Now login from mobile.twitter.com with existing password which is 6 or...

X (Formerly Twitter): DOM Cross-Site Scripting ( XSS )

Hi, for me works on Firefox 32, tested on Mac OS X Mavericks and Windows 7 https://content.twitter.com/small-business-guide/ onmouseover=alert'XSS' Regards...

Twitter Launches Digits – A Password Free Login Service For App Developers

There’s a good news for app developers. On Wednesday at Twitter’s first annual developer conference Flight, the company announced a new tool for developers which will allow users to log-in to mobile applications using their phone numbers rather than a traditional username and password combination...

CVE-2014-6352

Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted...

X (Formerly Twitter): Singup Page HTML Injection Vulnerability

Information There's an HTML Injection Vulnerability exists in Twitter main signup page which can be used by attackers to display personally crafted messages to twitter users for different malicious purposes. Affected parameters invitecode= & invitename=. Steps to reproduce: 1. Refer to the main...

CVE-2014-4113

win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, a...

Twitter Files Suit Over Government Restrictions on National Security Letter Data

Twitter has filed a lawsuit in federal court asking that the United States Department of Justice’s prohibitions on publishing the number and kind of government requests for data the company receives be declared unconstitutional. The suit claims that the rules infringe on Twitter’s right to free...

X (Formerly Twitter): Profile Pic padding (Length-hiding) fails due to use of GZIP

Back in August, I noted that Twitter was appending anywhere from dozens to thousands of junk 0x20 bytes on the end of the JPEG and PNG files they serve for users’ profile images. It was suggested that, though invalid, they were doing this deliberately, as an information-hiding mechanism. The HTTP...

X (Formerly Twitter): Twitter Flight SSL 2.0 deprecated protocol vulnerability.

Twitterflight.com From Twitter Inc..I just checked it with whois Website service encrypts traffic using an old deprecated protocol with known weakness wich is obsolete and insecure, you should disable it. POC in the attachments...

Twitter's latest exploit: a hacker can traverse account delete credit card-vulnerability warning-the black bar safety net

Just this month beginning of the month, with other social networks, twitter also started a new vulnerability reward program, bonus reached$1 4 0+/vulnerabilities, you can say the reward is still very lucrative. Compared to our domestic manufacturers to say, I personally think that this is a netwo...

Twitter Vulnerability Allows Hacker to Delete Credit Cards from Any Twitter Account

At the beginning of this month, just like other social networks, Twitter also started paying individuals for any flaws they uncover on its service with a fee of $140 or more offered per flaw under its new Bug Bounty program, and here comes the claimant. An Egyptian Security Researcher, Ahmed...

X (Formerly Twitter): Cross site scripting on ads.twitter.com

Hi, Steps to reproduce the issue: 1 Go to this link https://ads.twitter.com/accounts/XXXX/tweets where is XXXX is your account id. 2 Click on Compose Tweet option and enter " 3 Click on "Tweet" Button now. You will prompt dialog box with "123" in it. POC video:...

X (Formerly Twitter): Stored xss

Hi! There's a stored xss on ads.twitter.com under "Add New App" section at https://ads.twitter.com/accounts/18ce53wsl3g/campaigns/newobjective/appinstalls. There's a option to add android application by Google play app id, so i searched for a app on play store with name " "" " and then i got this...

tinfoleak - Get detailed information about a Twitter user activity

tinfoleak is a simple Python script that allow to obtain: basic information about a Twitter user name, picture, location, followers, etc. devices and operating systems used by the Twitter user applications and social networks used by the Twitter user place and geolocation coordinates to generate ...

Design/Logic Flaw

The Twitter No Background aka com.wTwitternobackground application 0.85.13509.97828 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...