Twitter Vulnerability Allows Hacker to Delete Credit Cards from Any Twitter Account

At the beginning of this month, just like other social networks, Twitter also started paying individuals for any flaws they uncover on its service with a fee of $140 or more offered per flaw under its new Bug Bounty program, and here comes the claimant. An Egyptian Security Researcher, Ahmed...

X (Formerly Twitter): Cross site scripting on ads.twitter.com

Hi, Steps to reproduce the issue: 1 Go to this link https://ads.twitter.com/accounts/XXXX/tweets where is XXXX is your account id. 2 Click on Compose Tweet option and enter " 3 Click on "Tweet" Button now. You will prompt dialog box with "123" in it. POC video:...

X (Formerly Twitter): Stored xss

Hi! There's a stored xss on ads.twitter.com under "Add New App" section at https://ads.twitter.com/accounts/18ce53wsl3g/campaigns/newobjective/appinstalls. There's a option to add android application by Google play app id, so i searched for a app on play store with name " "" " and then i got this...

tinfoleak - Get detailed information about a Twitter user activity

tinfoleak is a simple Python script that allow to obtain: basic information about a Twitter user name, picture, location, followers, etc. devices and operating systems used by the Twitter user applications and social networks used by the Twitter user place and geolocation coordinates to generate ...

Design/Logic Flaw

The Twitter No Background aka com.wTwitternobackground application 0.85.13509.97828 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5753

The Twitter No Background aka com.wTwitternobackground application 0.85.13509.97828 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5753

CVE-2014-5753 affects the Android app com.wTwitternobackground (version 0.85.13509.97828). The root cause is the app’s failure to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted certificates. No exploit...

X (Formerly Twitter): ads.twitter.com xss

Cross-Site Scripting vulnerability exists in cardname parameter when creating/cloning a card via script https://ads.twitter.com/accounts/18ce53wrkma/cards/new?cardtype=7. Here is the simple test vector: alertdocument.cookie After the card is created XSS becomes persistent and can be triggered via...

PHP Stock Management System 1.02 - Multiple Vulnerabilty

Exploit for php platform in category web applications Exploit Title: PHP Stock Management System 1.02 - Multiple Vulnerabilty Date : 9-9-2014 Author : jsass ​ Vendor Homepage: ​http://www.posnic.com/​ Software Link:​ http://sourceforge.net/projects/stockmanagement/ Version: ​1.02 Tested on: kali...

X (Formerly Twitter): Delete Credit Cards from any Twitter Account in ads.twitter.com [New Vulnerability]

i've found a new critical logical vulnerability that allow deleteing credit card of any twitter account in ads.twitter.com , the vulnerability affects the Dismiss functionality of credit cards in payments methods section the vulnerability is similair to the one i've reported earlier h1 report 272...

WordPress Plugin WP to Twitter - Authentication Bypass

WordPress Plugin WP to Twitter - Authentication Bypass source: https://www.securityfocus.com/bid/69741/info WP to Twitter Plugin for WordPress is prone to an authorization-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized...

WordPress Plugin Xhanch My Twitter - Cross-Site Request Forgery

WordPress Plugin Xhanch My Twitter - Cross-Site Request Forgery source: https://www.securityfocus.com/bid/69744/info Xhanch My Twitter plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform unauthorized...

WordPress Plugin Xhanch My Twitter - Cross-Site Request Forgery

source: https://www.securityfocus.com/bid/69744/info Xhanch My Twitter plugin for WordPress is prone to a cross-site request-forgery vulnerability. An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected...

WordPress Plugin WP to Twitter - Authentication Bypass

source: https://www.securityfocus.com/bid/69741/info WP to Twitter Plugin for WordPress is prone to an authorization-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. WP to...

WordPress Xhanch My Twitter Plugin - CSRF

Xhanch My Twitter plugin is prone to a cross-site request forgery vulnerability. It allows an attacker to gain unauthorized access to the affected application by performing certain actions in the context of an authorized user's session. Solution Upgrade the plugin...

WordPress WP to Twitter Plugin - Authorization Bypass

WP to Twitter plugin is prone to an authorization BYPASS vulenrability that allows an attacker to bypass security restrictions and perform unauthorized actions. Solution Upgrade the plugin...

X (Formerly Twitter): Missing Rate Limiting on https://twitter.com/account/complete

The following link is missing rate limiting https://twitter.com/account/complete by which an attacker can get all the valid phone no. on twitters account. POC :- Screenshot attached...

Wordpress Huge-IT Image Gallery 1.0.1 Authenticated SQL Injection

No description provided by source. Exploit Title : Wordpress Huge-IT Image Gallery 1.0.1 Authenticated SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://huge-it.com/ Software Link : http://downloads.wordpress.org/plugin/gallery-images.zip Mirror Link :...

X (Formerly Twitter): Full path disclosure at ads.twitter.com

Hi there, I noticed a small information disclosure full path disclosure on ads.twitter.com. Steps to reproduce - 1. Login to ads.twitter.com - 2. Start to create a new twitter-follower campaign - 3. Choose to upload a new picture - 4. Turn on your intercepting proxy - 5. Upload a file - 6. You...

Twitter Launches Bug Bounty Program

Twitter is the latest major Internet company to establish a bug bounty program, and has put no upper limit on the bounty that a researcher can earn for reporting a vulnerability. The company announced on Wednesday that it will operate its bounty program through the HackerOne platform, a bug bount...