Bad extended ascii handling in HTTP 301 redirects of t.co #34084 Valid Open Redirect – 2015-08-09 – 1 POODLE Bug: 199.16.156.44, 199.16.156.108, mx4.twitter.com #41240 Valid Cryptography – 2015-09-20 $140 1 No rate limiting on creating lists #42250 Informative Misconfiguration and Insecure Design – 2015-01-06 – 1 Path disclosure in platform0.twitter.com #44371 Informative Information Disclosure – 2015-02-20 – 1 open redirect sends authenticity_token to any website or (ip address) #50752 Valid Open Redirect – 2015-03-14 $560 1 Following a User Actually Follows Another User #95243 Valid Open Redirect – 2015-12-02 $280 1 Following a User After Favoriting Actually Follows Another User (related to #95243) #97510 Valid Misconfiguration and Insecure Design – 2015-12-02 $280 1 Unauthorized Tweeting on behalf of Account Owners #31082 Valid Misconfiguration and Insecure Design – 2015-05-07 $420 2 [Stored XSS] vine.co - profile page #36986 Valid Cross-site Scripting – 2015-03-26 – 2 Homograph attack. #37108 Informative Misconfiguration and Insecure Design – 2015-01-01 – 2 twitter android app Fragment Injection #43988 Valid Command and Code Injection – 2015-04-11 – 2 URGENT - SUBDOMAIN TAKEOVER ON TWITTER ACQ. #44578 Valid Command and Code Injection – 2015-02-21 – 2 Privacy Issue on protected tweets #55506 Informative Authentication – 2015-05-14 – 2 User's DM won't deleted after logout from Twitter for iOS (com.atebits.xxx.application-state) #23913 Valid No weakness recorded – 2015-02-25 – 3 Fabric.io - an app admin can delete team members from other user apps #43065 Valid Access Control – 2015-03-09 $1,120 3 Twitter Card - Parent Window Redirection #46818 Valid Cross-site Scripting – 2015-05-04 $560 3 Redirect URL in /intent/ functionality is not properly escaped #48516 Valid Cross-site Scripting – 2015-02-24 – 3 Privecy Issue : view "Protected users" followers and following #56119 Informative Authentication – 2015-05-15 – 3 iOS App can establish Facetime calls without user's permission #28500 Valid Cross-Site Request Forgery – 2015-04-27 – 4 getting emails of users/removing them from victims account [using typical attack] #35287 Valid Authentication – 2015-03-13 – 4 Notifications can mark as read by CSRF #36980 Informative Cross-Site Request Forgery – 2015-01-03 – 4 URGENT - Subdomain Takeover on users.tweetdeck.com , the same issue of report #32825 #42236 Valid Command and Code Injection – 2015-01-01 $420 4 Account Deleted without any confirmation #42403 Informative Authentication – 2015-02-05 – 4 fabric.io - app member can make himself an admin #42961 Valid Access Control – 2015-03-09 $1,400 4 Reporting user's profile by using another people's ID #47888 Valid Open Redirect – 2015-06-11 $140 4 Cross site Port Scanning bug in twitter developers console #49474 Informative Cryptography – 2015-05-23 – 4 XSS in twitter.com/safety/unsafe_link_warning #53098 Valid Cross-site Scripting – 2015-04-03 $1,400 4 Singup Page HTML Injection Vulnerability #31554 Valid Command and Code Injection – 2015-03-22 – 5 HTML/XSS rendered in Android App of Crashlytics through fabric.io #41856 Valid Cross-site Scripting – 2015-02-18 – 5 XSS in original referrer after follow #50134 Valid Cross-site Scripting – 2015-03-09 – 5 [mobile.twitter.com / twitter.com] CSRF protection bypass #14883 Valid Cross-Site Request Forgery – 2015-05-04 – 6 Improper Verification of email address while saving Account Settings #30975 Valid Misconfiguration and Insecure Design – 2015-08-13 $560 6 Insecure Data Storage in Vine Android App #44727 Valid Cryptography – 2015-06-24 $140 6 Twitter Ads Campaign information disclosure through admin without any authentication. #49806 Valid Authentication – 2015-04-25 $560 6 Flaw in login with twitter to steal Oauth tokens #44492 Valid Authentication – 2015-02-18 – 7 Problem with OAuth #46485 Valid Authentication – 2015-11-14 $1,260 7 Open Redirect leak of authenticity_token lead to full account take over. #49759 Valid Open Redirect – 2015-04-03 $1,400 7 URGENT : NICHE.co Account Take Over Vulnerability #100849 Valid Cross-Site Request Forgery – 2015-12-21 $560 7 Fabric.io: Ex-admin of an organization can delete team members #55670 Valid Access Control – 2015-11-01 $280 8 Insecure direct object reference - have access to deleted DM's #52646 Valid Authentication – 2015-10-12 – 10 Insecure Direct Object Reference - access to other user/group DM's #53858 Valid Access Control – 2015-10-03 – 10 XSS on OAuth authorize/authenticate endpoint Analysed #87040 Valid Cross-site Scripting – 2015-11-20 – 23 HTTP Response Splitting (CRLF injection) due to headers overflow Analysed #53843 Valid No weakness recorded – 2015-05-04 – 30 HTTP Response Splitting (CRLF injection) in report_story Analysed #52042 Valid No weakness recorded – 2015-04-21 – 59