HTML form without CSRF protection at http://try.crashlytics.com/enterprise/ #25128 Valid Cross-Site Request Forgery – 2014-10-02 – – CSRF in crashlytics.com #13856 Valid Cross-Site Request Forgery – 2014-09-08 – 1 password sent over HTTP #20081 Valid Cryptography – 2014-08-05 – 1 Missing Rate Limiting on https://twitter.com/account/complete #27166 Valid Information Disclosure – 2014-11-10 – 1 Twitter Flight SSL 2.0 deprecated protocol vulnerability. #29206 Valid Cryptography – 2014-10-07 – 1 XSS platform.twitter.com | video-js metadata #29360 Valid Cross-site Scripting – 2014-11-17 – 1 Bad extended ascii handling in HTTP 301 redirects of t.co #34084 Valid Open Redirect – 2015-08-09 – 1 POODLE Bug: 199.16.156.44, 199.16.156.108, mx4.twitter.com #41240 Valid Cryptography – 2015-09-20 $140 1 open redirect sends authenticity_token to any website or (ip address) #50752 Valid Open Redirect – 2015-03-14 $560 1 Following a User Actually Follows Another User #95243 Valid Open Redirect – 2015-12-02 $280 1 Following a User After Favoriting Actually Follows Another User (related to #95243) #97510 Valid Misconfiguration and Insecure Design – 2015-12-02 $280 1 XSS vulnerability in video player page #15125 Valid Cross-site Scripting – 2014-08-02 – 2 Cookie not marked as secure. #15232 Valid No weakness recorded – 2014-08-04 – 2 Full path disclosure at ads.twitter.com #26825 Valid Information Disclosure – 2014-11-17 $140 2 Unauthorized Tweeting on behalf of Account Owners #31082 Valid Misconfiguration and Insecure Design – 2015-05-07 $420 2 [Stored XSS] vine.co - profile page #36986 Valid Cross-site Scripting – 2015-03-26 – 2 twitter android app Fragment Injection #43988 Valid Command and Code Injection – 2015-04-11 – 2 URGENT - SUBDOMAIN TAKEOVER ON TWITTER ACQ. #44578 Valid Command and Code Injection – 2015-02-21 – 2 User's DM won't deleted after logout from Twitter for iOS (com.atebits.xxx.application-state) #23913 Valid No weakness recorded – 2015-02-25 – 3 XSS platform.twitter.com #29328 Valid Cross-site Scripting – 2014-11-17 – 3 XSS in fabric.io #32519 Valid Cross-site Scripting – 2014-12-23 – 3 DOM Cross-Site Scripting ( XSS ) #33091 Valid Cross-site Scripting – 2014-12-03 $1,400 3 Open redirection in fabric.io #39631 Valid Open Redirect – 2014-12-18 $280 3 Fabric.io - an app admin can delete team members from other user apps #43065 Valid Access Control – 2015-03-09 $1,120 3 Twitter Card - Parent Window Redirection #46818 Valid Cross-site Scripting – 2015-05-04 $560 3 Redirect URL in /intent/ functionality is not properly escaped #48516 Valid Cross-site Scripting – 2015-02-24 – 3 Can see private tweets via keyword searches on tweetdeck #97161 Valid Access Control – 2016-02-16 – 3 Full Path Disclosure at 27.prd.vine.co #175451 Valid No weakness recorded – 2016-10-21 $140 3 XSS ON MOPUB.COM #15356 Valid Cross-site Scripting – 2014-08-15 – 4 ads.twitter.com xss #27511 Valid Cross-site Scripting – 2014-11-17 – 4 Stored xss #27846 Valid Cross-site Scripting – 2014-09-27 – 4 iOS App can establish Facetime calls without user's permission #28500 Valid Cross-Site Request Forgery – 2015-04-27 – 4 getting emails of users/removing them from victims account [using typical attack] #35287 Valid Authentication – 2015-03-13 – 4 URGENT - Subdomain Takeover on users.tweetdeck.com , the same issue of report #32825 #42236 Valid Command and Code Injection – 2015-01-01 $420 4 fabric.io - app member can make himself an admin #42961 Valid Access Control – 2015-03-09 $1,400 4 Reporting user's profile by using another people's ID #47888 Valid Open Redirect – 2015-06-11 $140 4 XSS in twitter.com/safety/unsafe_link_warning #53098 Valid Cross-site Scripting – 2015-04-03 $1,400 4 Subdomain Expired #101104 Valid Authentication – 2016-01-15 – 4 Sub-Domain Takeover #119220 Valid No weakness recorded – 2016-03-18 – 4 xss in DM group name in twitter #129436 Valid Cross-site Scripting – 2016-04-22 – 4 Singup Page HTML Injection Vulnerability #31554 Valid Command and Code Injection – 2015-03-22 – 5 XSS via Fabrico Account Name #34725 Valid Cross-site Scripting – 2016-07-11 – 5 HTML/XSS rendered in Android App of Crashlytics through fabric.io #41856 Valid Cross-site Scripting – 2015-02-18 – 5 XSS in original referrer after follow #50134 Valid Cross-site Scripting – 2015-03-09 – 5 Tweetdeck (twitter owned app) not revoked #90172 Valid Authentication – 2016-04-29 – 5 Tweet Deck XSS- Persistent- Group DM name #119022 Valid Cross-site Scripting – 2016-03-04 – 5 [mobile.twitter.com / twitter.com] CSRF protection bypass #14883 Valid Cross-Site Request Forgery – 2015-05-04 – 6 Delete Credit Cards from any Twitter Account in ads.twitter.com [New Vulnerability] #27404 Valid Authentication – 2014-09-30 – 6 Improper Verification of email address while saving Account Settings #30975 Valid Misconfiguration and Insecure Design – 2015-08-13 $560 6 Insecure Data Storage in Vine Android App #44727 Valid Cryptography – 2015-06-24 $140 6