Missing Rate Limiting on https://twitter.com/account/complete #27166 Valid Information Disclosure – 2014-11-10 – 1 Path disclosure in platform0.twitter.com #44371 Informative Information Disclosure – 2015-02-20 – 1 Full path disclosure at ads.twitter.com #26825 Valid Information Disclosure – 2014-11-17 $140 2 List of a ton of internal twitter servers available on GitHub #137404 Informative Information Disclosure – 2016-10-17 – 4 Profile Pic padding (Length-hiding) fails due to use of GZIP #29835 Valid Information Disclosure – 2016-03-18 $280 7 Reports Modal in app.mopub.com Disclose by any user #574639 Valid Information Disclosure Medium 2019-10-02 $280 9 Access MoPub Reports Data even after Company removed you from their MoPub Account. #399174 Valid Information Disclosure High 2019-11-05 – 11 leaking Digits OAuth authorization to third party websites #166942 Valid Information Disclosure – 2017-01-24 – 13 Sensitive Information Disclosure https://cards-dev.twitter.com #268888 Valid Information Disclosure Medium 2017-09-29 $280 19 ms5 debug page exposing internal info (internal IPs, headers) #311326 Valid Information Disclosure Medium 2018-05-11 $280 19 Unauthorized Access to Protected Tweets via niche.co API Analysed #273698 Valid Information Disclosure High 2017-11-02 – 22 Twitter for android is exposing user's location to any installed android app Analysed #185862 Valid Information Disclosure Low 2017-01-13 $560 23 CVE-2017-15277 on Profile page Analysed #315906 Valid Information Disclosure Low 2018-03-08 – 23 Information Disclosure through .DS_Store in ██████████ Analysed #142549 Valid Information Disclosure – 2016-12-12 $560 27 Information Exposure Through Directory Listing vulnerability on 8 vcache**.usw2.snappytv.com websites Analysed #438299 Valid Information Disclosure Low 2019-02-11 – 27 Twitter Media Studio Source Information Disclosure With Analyst Role Analysed #961757 Valid Information Disclosure Medium 2020-10-26 – 27 [sms-be-vip.twitter.com] vulnerable to Jetleak Analysed #143935 Valid Information Disclosure – 2018-04-02 $1,260 28 The Deleted Polls is Still Accessable after 30 Days Analysed #1015373 Valid Information Disclosure High 2023-02-13 $560 28 HTTP 401 response injection on "amp.twimg.com/amplify-web-player/prod/source.html" through "image_src" parameter Analysed #221328 Valid Information Disclosure Low 2017-05-08 – 30 Identify the mobile number of a twitter user Analysed #1225164 Valid Information Disclosure Critical 2022-03-29 $560 30 [staging-engineering.gnip.com] Publicly accessible GIT directory Analysed #218465 Valid Information Disclosure Medium 2018-11-01 $280 33 Listing of Amazon S3 Bucket accessible to any amazon authenticated user (metrics.pscp.tv) Analysed #278191 Valid Information Disclosure – 2017-11-19 $140 36 View liked twits of private account via publish.twitter.com Analysed #174721 Valid Information Disclosure Medium 2016-11-14 – 47 Tracking of users on third-party websites using the Twitter cookie, due to a flaw in authenticating image requests Analysed #329957 Valid Information Disclosure Medium 2019-02-08 $1,120 49 Protected tweets exposure through the URL Analysed #491473 Valid Information Disclosure High 2019-04-19 $560 67 Incorrect details on OAuth permissions screen allows DMs to be read without permission Analysed #434763 Valid Information Disclosure Medium 2018-12-14 $2,940 80 Cross-Domain Leakage of X Username / UserID due to Dynamically Generated JS File Analysed #2244229 Valid Information Disclosure Medium 2024-05-10 $1,500 115 Changing email address on Twitter for Android unsets "Protect your Tweets" Analysed #472013 Valid Information Disclosure Low 2019-01-18 $2,940 119 Vine all registered user Private/sensitive information disclosure .[ Ip address/phone no/email and many other informations ] Analysed #202823 Valid Information Disclosure Critical 2017-07-11 – 121 Twitter ID exposure via error-based side-channel attack Analysed #505424 Valid Information Disclosure Medium 2019-05-16 $1,470 154