Yahoo Hires Bob Lord as CISO

Yahoo has filled the vacancy in its CISO office, today announcing the hiring of former Twitter and Rapid7 security executive Bob Lord. Lord starts in his new role Nov. 9. He was most recently Rapid7’s CISO-in-residence; he has spent much of the last two decades in high-profile security positions...

X (Formerly Twitter): CSRF on cards API

Hi, I would like to report an CSRF issue on the cards API endpoint /i/cards/api/v1.json. Detail Currently the endpoint is responsible for poll cards maybe more to come. When a user votes, a request will be sent to this endpoint to record the user's selected choice. By default there's a CSRF...

X (Formerly Twitter): Following a User Actually Follows Another User

I can display a web intent page to a victim that appears to prompt them to follow one user, but actually ends up following a completely different user when they click "follow". The following is a proof of concept:...

X (Formerly Twitter): XSS in the "Poll" Feature on Twitter.com

I have found an XSS on the "Poll" feature on Twitter.com. Payload Example: Screenshot: I have attached a screenshot in this submission in order to demonstrate the issue. Best, Mazin...

High school Student Hacked Into CIA Director's Personal Email Account

A self-described teenage hacker has claimed to have hacked into personal AOL email account of Central Intelligence Agency CIA Director John Brennan and swiped sensitive top-secret data. It's Really a major embarrassment for Brennan as well as the CIA. The hacker, who describes himself as an...

Twittor - A fully featured backdoor that uses Twitter as a C&C server

A stealthy Python based backdoor that uses Twitter Direct Messages as a command and control server This project has been inspired by Gcat which does the same but using a Gmail account. Setup For this to work you need: A Twitter account Use a dedicated account! Do not use your personal one! Regist...

JScript 5.7 RegExpBase::FBadHeader Use-After-Free

Recompiling the regular expression pattern during a replace can cause the code to reuse a freed string, but only if the string is freed from the cache by allocating and freeing a number of strings of certain size. CVE-2015-2482: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2482...

WordPress JM Twitter Cards Plugin <= 6.1 - Full Path Disclosure

Because of this vulnerability, attackers can discover the full path to the WordPress installation on the server, which they could use to assist in other attacks. Solution Update this plugin...

Breaking: Edward Snowden Joins Twitter & Only Follows ‘NSA’

Whistleblower Edward Snowden just joined Twitter, and his first tweet seems to be directed at the US National Security Agency NSA. Yes, the world's most popular whistleblower and data privacy advocate has finally joined Twitter just two hours ago, and his first tweet came, “Can you hear me now?”...

X (Formerly Twitter): Tweetdeck (twitter owned app) not revoked

I've noticed an issue in tweetdeck & twitter. If you try to revoke tweet deck, no matter what you do, if anyone else is logged in on your account through tweetdeck, they will still be able to use your account. This doesn't properly revoke users, so therefore I thought this as is a bug/problem e.g...

Drupal Twitter Module Security Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP. The Drupal Twitter module failed to properly check access permissions, allowing a remote attacker to post tweets to arbitrary accounts with the 'post to twitter' permission...

CVE-2015-7229

The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the 1 "post to twitter" permission or change the options...

Code injection

The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the 1 "post to twitter" permission or change the options...

CVE-2015-7229

The Drupal Twitter module vulnerability CVE-2015-7229 affects Drupal sites using the Twitter submodule (6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, 7.x-6.x before 7.x-6.0). The root cause is improper access checks, allowing remote authenticated users with the post to twitter, add twitter acco...

CVE-2015-7229

The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the 1 "post to twitter" permission or change the options...

Pair of Drupal Modules Patch Access Bypass Flaws

A pair of modules included in the Drupal content management system have been updated to fix access bypass vulnerabilities that could allow an attacker to take actions on the behalf of some users. One of the modules fixed is the Twitter module, which allows users to take a variety of actions,...

Twitter - Moderately Critical - Access bypass - SA-CONTRIB-2015-146

This module enables you to pull in public tweets from Twitter accounts, post messages to Twitter to announce content changes, and authenticate using Twitter. The module doesn't sufficiently check for access when using the Twitter Post submodule to post messages to Twitter and allows a tweet to be...

Twitter Open Sources 'Diffy' that Automatically Catches Potential Bugs in Code

After, Facebook open sourced Thrift Technology an internally used tool by Facebook in 2007, rival entity Twitter brings Diffy, an internal Twitter service to the world. Yesterday, Twitter introduced "Diffy," an open source tool, acting as a helping hand for the software developers to catch bugs,...

X (Formerly Twitter): XSS on OAuth authorize/authenticate endpoint

Hi, I would like to report an issue where certain endpoints on twitter.com and api.twitter.com is vulnerable to XSS. Detail The redirection page after authorization/authentication does not sanitize the oauthcallback parameter. PoC 1. Go to http://innerht.ml/pocs/twitter-oauth-xss Please use IE or...

X (Formerly Twitter): Highly wormable clickjacking in player card

Hi, I would like to report an issue where player card is vulnerable to clickjacking in certain browsers. This may result in something similar to XSS worm and many other critical damages. Details Twitter Player Card allows a website to embed a custom playerhtml into an iframe in a tweet. There are...