User input validation can lead to DOS Analysed #767458 Valid Denial of Service Medium 2020-03-26 $560 13 http request smuggling in twitter.com #715996 Duplicate Injection and Smuggling High 2020-11-18 – 17 iOS app crashed by specially crafted direct message reactions Analysed #784676 Valid Denial of Service Medium 2020-02-21 $560 17 Twitter Source Label allow 'mongolian vowel separator' U+180E (app name) Analysed #785243 Valid Input Validation and Logic Low 2020-02-21 – 19 lack of input validation that can lead Denial of Service (DOS) Analysed #768677 Valid Denial of Service Medium 2020-03-12 $560 22 http request smuggling in pscp.tv and periscope.tv Analysed #713285 Valid Injection and Smuggling High 2020-09-10 $560 24 Twitter Media Studio Source Information Disclosure With Analyst Role Analysed #961757 Valid Information Disclosure Medium 2020-10-26 – 27 暴力破解用户密码没有速率控制 Analysed #854424 Valid Authentication Medium 2020-07-01 – 30 Reset password without knowing current password Analysed #806055 Valid Authentication Low 2020-03-25 – 32 Android WebViews in Twitter app are vulnerable to UXSS due to configuration and CVE-2020-6506 Analysed #906433 Valid Cross-site Scripting High 2020-09-24 $560 32 Delete direct message history without access the proper conversation_id Analysed #666632 Valid Input Validation and Logic Low 2020-11-20 $560 33 Accepting error message on twitter sends you to attacker site Analysed #781673 Valid Open Redirect Medium 2020-03-13 $560 33 Ability to bruteforce mopub account’s password due to lack of rate limitation protection using {ip rotation techniques} Analysed #819930 Valid Authentication Low 2020-07-10 $420 55 NO username used in authenthication to www.mopub.com leading to direct password submission which has unlimited submission rate. Analysed #790854 Valid No weakness recorded Medium 2020-02-28 – 58 Periscope iOS app CSRF in follow action due to deeplink Analysed #805073 Valid Cross-Site Request Forgery Low 2020-03-31 $2,940 58 Denial of Service [Chrome] Analysed #921286 Valid Denial of Service Medium 2020-07-24 $560 66 Denial of Service | twitter.com & mobile.twitter.com Analysed #903740 Valid Denial of Service Medium 2020-09-02 $1,120 89 Creating malformed URLs via new line character in-between two URLs leads to misrepresented hyperlinks in Tweets/DMs Analysed #712979 Valid Injection and Smuggling Low 2020-01-24 – 96 Safe Redirect Bypass Analysed #945990 Valid Other weaknesses Low 2020-09-10 $560 98 XSS via referrer parameter Analysed #867616 Valid Cross-site Scripting Medium 2020-10-26 – 124 Reflected XSS in twitterflightschool.com Analysed #770349 Valid Cross-site Scripting None 2020-02-21 – 140 character limitation bypass can lead to DoS on Twitter App and 500 Internal Server Error Analysed #819088 Valid Denial of Service Medium 2020-05-06 – 141 protected Tweet settings overwritten by other settings Analysed #664038 Valid No weakness recorded Medium 2020-01-01 – 178 Periscope android app deeplink leads to CSRF in follow action Analysed #583987 Valid Cross-Site Request Forgery Low 2020-02-21 $1,540 224 Insufficient validation on Digits bridge Analysed #168116 Valid Authentication – 2020-08-20 – 263 Bypass Password Authentication for updating email and phone number - Security Vulnerability Analysed #770504 Valid Authentication High 2020-02-08 – 288 Private list members disclosure via GraphQL Analysed #885539 Valid Access Control Low 2020-08-04 – 346 Bypassing Digits origin validation which leads to account takeover Analysed #129873 Valid Authentication – 2020-06-24 – 619