CVE-2014-5753

The Twitter No Background aka com.wTwitternobackground application 0.85.13509.97828 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5753

CVE-2014-5753 affects the Android app com.wTwitternobackground (version 0.85.13509.97828). The root cause is the app’s failure to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted certificates. No exploit...

X (Formerly Twitter): ads.twitter.com xss

Cross-Site Scripting vulnerability exists in cardname parameter when creating/cloning a card via script https://ads.twitter.com/accounts/18ce53wrkma/cards/new?cardtype=7. Here is the simple test vector: alertdocument.cookie After the card is created XSS becomes persistent and can be triggered via...

PHP Stock Management System 1.02 - Multiple Vulnerabilty

Exploit for php platform in category web applications Exploit Title: PHP Stock Management System 1.02 - Multiple Vulnerabilty Date : 9-9-2014 Author : jsass ​ Vendor Homepage: ​http://www.posnic.com/​ Software Link:​ http://sourceforge.net/projects/stockmanagement/ Version: ​1.02 Tested on: kali...

X (Formerly Twitter): Delete Credit Cards from any Twitter Account in ads.twitter.com [New Vulnerability]

i've found a new critical logical vulnerability that allow deleteing credit card of any twitter account in ads.twitter.com , the vulnerability affects the Dismiss functionality of credit cards in payments methods section the vulnerability is similair to the one i've reported earlier h1 report 272...

WordPress WP to Twitter Plugin - Authorization Bypass

WP to Twitter plugin is prone to an authorization BYPASS vulenrability that allows an attacker to bypass security restrictions and perform unauthorized actions. Solution Upgrade the plugin...

WordPress Plugin WP to Twitter - Authentication Bypass

WordPress Plugin WP to Twitter - Authentication Bypass source: https://www.securityfocus.com/bid/69741/info WP to Twitter Plugin for WordPress is prone to an authorization-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized...

WordPress Plugin Xhanch My Twitter - Cross-Site Request Forgery

WordPress Plugin Xhanch My Twitter - Cross-Site Request Forgery source: https://www.securityfocus.com/bid/69744/info Xhanch My Twitter plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform unauthorized...

WordPress Xhanch My Twitter Plugin - CSRF

Xhanch My Twitter plugin is prone to a cross-site request forgery vulnerability. It allows an attacker to gain unauthorized access to the affected application by performing certain actions in the context of an authorized user's session. Solution Upgrade the plugin...

WordPress Plugin WP to Twitter - Authentication Bypass

source: https://www.securityfocus.com/bid/69741/info WP to Twitter Plugin for WordPress is prone to an authorization-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. WP to...

WordPress Plugin Xhanch My Twitter - Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/69744/info Xhanch My Twitter plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected...

X (Formerly Twitter): Missing Rate Limiting on https://twitter.com/account/complete

The following link is missing rate limiting https://twitter.com/account/complete by which an attacker can get all the valid phone no. on twitters account. POC :- Screenshot attached...

Wordpress Huge-IT Image Gallery 1.0.1 Authenticated SQL Injection

No description provided by source. Exploit Title : Wordpress Huge-IT Image Gallery 1.0.1 Authenticated SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://huge-it.com/ Software Link : http://downloads.wordpress.org/plugin/gallery-images.zip Mirror Link :...

X (Formerly Twitter): Full path disclosure at ads.twitter.com

Hi there, I noticed a small information disclosure full path disclosure on ads.twitter.com. Steps to reproduce - 1. Login to ads.twitter.com - 2. Start to create a new twitter-follower campaign - 3. Choose to upload a new picture - 4. Turn on your intercepting proxy - 5. Upload a file - 6. You...

Twitter Launches Bug Bounty Program

Twitter is the latest major Internet company to establish a bug bounty program, and has put no upper limit on the bounty that a researcher can earn for reporting a vulnerability. The company announced on Wednesday that it will operate its bounty program through the HackerOne platform, a bug bount...

Mozilla to Support Key Pinning in Firefox 32

Mozilla is planning to add support for public-key pinning in its Firefox browser in an upcoming version. In version 32, which would be the next stable version of the browser, Firefox will have key pins for a long list of sites, including many of Mozilla’s own sites, all of the sites pinned in...

Sony PlayStation Network Back Online Following DDoS

Sony Corporation took its online gaming platform, the PlayStation Network PSN, offline over the weekend in the face of a distributed denial of service DDoS attack. As of Sunday, the company said the PSN is back online and that game play can resume. Sony is saying that it has seen no evidence of a...

Anonymous Hackers Claim to Identify the Cop Who killed Mike Brown in Ferguson

Members of the international hacker collective Anonymous have claimed they have identified the Ferguson, Missouri law enforcement officer involved in the fatal shooting of Michael Brown, an unarmed teenager killed on Saturday, which sparked days of protest and raised racial tensions. The hacktivi...

X (Formerly Twitter): User's DM won't deleted after logout from Twitter for iOS (com.atebits.xxx.application-state)

I would like to add an additional information regarding my previous report about "Unencrypted User's DM and Statuses on twitter.db at Twitter for iOS". I have already tried to logout from my Twitter apps including from built-in twitter apps for iOS, and then, I already reboot the iDevice too...

Twitter 'Weighing Legal Options' On Publishing National Security Requests Data

Twitter officials are pushing the United States government for more freedom to publish specific numbers about national security information requests, and said the company is considering its legal options if the government doesn’t allow more data to be made public. In its latest transparency repor...