iOS App can establish Facetime calls without user's permission #28500 Valid Cross-Site Request Forgery – 2015-04-27 – 4 getting emails of users/removing them from victims account [using typical attack] #35287 Valid Authentication – 2015-03-13 – 4 Notifications can mark as read by CSRF #36980 Informative Cross-Site Request Forgery – 2015-01-03 – 4 URGENT - Subdomain Takeover on users.tweetdeck.com , the same issue of report #32825 #42236 Valid Command and Code Injection – 2015-01-01 $420 4 Account Deleted without any confirmation #42403 Informative Authentication – 2015-02-05 – 4 fabric.io - app member can make himself an admin #42961 Valid Access Control – 2015-03-09 $1,400 4 Reporting user's profile by using another people's ID #47888 Valid Open Redirect – 2015-06-11 $140 4 Cross site Port Scanning bug in twitter developers console #49474 Informative Cryptography – 2015-05-23 – 4 XSS in twitter.com/safety/unsafe_link_warning #53098 Valid Cross-site Scripting – 2015-04-03 $1,400 4 Subdomain Expired #101104 Valid Authentication – 2016-01-15 – 4 Sub-Domain Takeover #119220 Valid No weakness recorded – 2016-03-18 – 4 xss in DM group name in twitter #129436 Valid Cross-site Scripting – 2016-04-22 – 4 List of a ton of internal twitter servers available on GitHub #137404 Informative Information Disclosure – 2016-10-17 – 4 Singup Page HTML Injection Vulnerability #31554 Valid Command and Code Injection – 2015-03-22 – 5 XSS via Fabrico Account Name #34725 Valid Cross-site Scripting – 2016-07-11 – 5 HTML/XSS rendered in Android App of Crashlytics through fabric.io #41856 Valid Cross-site Scripting – 2015-02-18 – 5 XSS in original referrer after follow #50134 Valid Cross-site Scripting – 2015-03-09 – 5 Tweetdeck (twitter owned app) not revoked #90172 Valid Authentication – 2016-04-29 – 5 Tweet Deck XSS- Persistent- Group DM name #119022 Valid Cross-site Scripting – 2016-03-04 – 5 [mobile.twitter.com / twitter.com] CSRF protection bypass #14883 Valid Cross-Site Request Forgery – 2015-05-04 – 6 Delete Credit Cards from any Twitter Account in ads.twitter.com [New Vulnerability] #27404 Valid Authentication – 2014-09-30 – 6 Improper Verification of email address while saving Account Settings #30975 Valid Misconfiguration and Insecure Design – 2015-08-13 $560 6 Insecure Data Storage in Vine Android App #44727 Valid Cryptography – 2015-06-24 $140 6 Twitter Ads Campaign information disclosure through admin without any authentication. #49806 Valid Authentication – 2015-04-25 $560 6 XSS in the "Poll" Feature on Twitter.com #95231 Valid Cross-site Scripting – 2016-08-12 – 6 Urgent : Disclosure of all the apps with hash ID in mopub through API request (Authentication bypass) #98432 Valid Authentication – 2016-08-22 – 6 Cross site scripting on ads.twitter.com #28150 Valid Cross-site Scripting – 2014-10-16 – 7 Profile Pic padding (Length-hiding) fails due to use of GZIP #29835 Valid Information Disclosure – 2016-03-18 $280 7 Flaw in login with twitter to steal Oauth tokens #44492 Valid Authentication – 2015-02-18 – 7 Problem with OAuth #46485 Valid Authentication – 2015-11-14 $1,260 7 Open Redirect leak of authenticity_token lead to full account take over. #49759 Valid Open Redirect – 2015-04-03 $1,400 7 URGENT : NICHE.co Account Take Over Vulnerability #100849 Valid Cross-Site Request Forgery – 2015-12-21 $560 7 Sub Domain Takeover at mk.prd.vine.co #191323 Valid No weakness recorded – 2017-02-13 $140 7 Fabric.io: Ex-admin of an organization can delete team members #55670 Valid Access Control – 2015-11-01 $280 8 CSRF in twitterflightschool.com ( CAN POST ON TIMELINE WITHOUT USER PERMISSION) #115158 Valid Cross-Site Request Forgery – 2017-11-06 – 8 Broken authentication and invalidated email address leads to account takeover #22203 Informative Cryptography – 2014-11-28 – 9 [Twitter Open Source] Releases were & are built/executed/tested/released in the context of insecure/untrusted code #505007 Valid Cryptography High 2019-12-13 $280 9 Reports Modal in app.mopub.com Disclose by any user #574639 Valid Information Disclosure Medium 2019-10-02 $280 9 Insecure direct object reference - have access to deleted DM's #52646 Valid Authentication – 2015-10-12 – 10 Insecure Direct Object Reference - access to other user/group DM's #53858 Valid Access Control – 2015-10-03 – 10 Clickjacking Periscope.tv on Chrome #198622 Valid Misconfiguration and Insecure Design Medium 2017-02-06 $560 11 [Gnip Blogs] Reflected XSS via "plupload.flash.swf" component vulnerable to SOME #218451 Valid Cross-site Scripting Medium 2017-05-08 – 11 Access MoPub Reports Data even after Company removed you from their MoPub Account. #399174 Valid Information Disclosure High 2019-11-05 – 11 HTTPS is not validating TLS mac codes #402671 Valid Cryptography – 2019-05-25 – 11 Add tweet to collection CSRF #100820 Valid Cross-Site Request Forgery – 2016-08-22 – 12 login csrf in analytics.mopub.com #577920 Valid Cross-Site Request Forgery Medium 2019-10-02 $280 12 leaking Digits OAuth authorization to third party websites #166942 Valid Information Disclosure – 2017-01-24 – 13 Html Injection and Possible XSS via MathML #502926 Duplicate Cross-site Scripting Critical 2019-09-03 – 13 User input validation can lead to DOS #767458 Valid Denial of Service Medium 2020-03-26 $560 13 xss in link items (mopub.com) #100931 Valid Cross-site Scripting – 2016-07-05 $560 14