[Twitter Open Source] Releases were & are built/executed/tested/released in the context of insecure/untrusted code #505007 Valid Cryptography High 2019-12-13 $280 9 Access MoPub Reports Data even after Company removed you from their MoPub Account. #399174 Valid Information Disclosure High 2019-11-05 – 11 http request smuggling in twitter.com #715996 Duplicate Injection and Smuggling High 2020-11-18 – 17 AppLovin API Key hardcoded in a Github repo Analysed #674774 Valid Cryptography High 2019-09-18 $280 20 Unauthorized Access to Protected Tweets via niche.co API Analysed #273698 Valid Information Disclosure High 2017-11-02 – 22 http request smuggling in pscp.tv and periscope.tv Analysed #713285 Valid Injection and Smuggling High 2020-09-10 $560 24 The Deleted Polls is Still Accessable after 30 Days Analysed #1015373 Valid Information Disclosure High 2023-02-13 $560 28 GNIP subdomain take over Analysed #189548 Valid No weakness recorded High 2017-02-06 – 30 CORS misconfig | Account Takeover Analysed #426147 Valid No weakness recorded High 2018-12-10 – 30 Android WebViews in Twitter app are vulnerable to UXSS due to configuration and CVE-2020-6506 Analysed #906433 Valid Cross-site Scripting High 2020-09-24 $560 32 Urgent : Unauthorised Access to Media content of all Direct messages and protected tweets(Indirect object reference) Analysed #99600 Valid Authentication High 2018-03-21 – 39 Twitter iOS fails to validate server certificate and sends oauth token Analysed #168538 Valid Cryptography High 2016-12-23 $2,100 40 Bypass Password Authentication to Update the Password Analysed #970157 Valid Authentication High 2021-01-11 – 59 Blind XSS in Mobpub Marketplace Admin Production | Sentry via demand.mopub.com (User-Agent) Analysed #275518 Valid Cross-site Scripting High 2018-02-17 – 63 Viral Direct Message Clickjacking via link truncation leading to capture of both Google credentials & installation of malicious 3rd party Twitter App Analysed #643274 Valid Misconfiguration and Insecure Design High 2019-10-31 – 64 Protected tweets exposure through the URL Analysed #491473 Valid Information Disclosure High 2019-04-19 $560 67 Subdomain takeover of images.crossinstall.com Analysed #1406335 Valid Input Validation and Logic High 2022-01-05 – 71 [CRITICAL] Full account takeover using CSRF Analysed #235642 Valid Cross-Site Request Forgery High 2017-11-03 – 88 [URGENT] Opportunity to publish tweets on any twitters account Analysed #208978 Valid No weakness recorded High 2017-05-22 – 119 Account Takeover in Periscope TV Analysed #317476 Valid Cross-site Scripting High 2018-09-06 – 213 Discoverability by phone number/email restriction bypass Analysed #1439026 Valid Access Control High 2022-02-11 $5,040 217 Github Account hijack through broken link in developer.twitter.com Analysed #1031321 Valid Input Validation and Logic High 2021-02-04 – 222 Stored XSS on reports. Analysed #485748 Valid Cross-site Scripting High 2019-04-01 $700 232 Bypass Password Authentication for updating email and phone number - Security Vulnerability Analysed #770504 Valid Authentication High 2020-02-08 – 288