Potential pre-auth RCE on Twitter VPN Analysed #591295 Valid Command and Code Injection – 2019-08-10 $20,160 1,246 Bypassing Digits origin validation which leads to account takeover Analysed #129873 Valid Authentication – 2020-06-24 – 619 CRLF injection Analysed #446271 Valid No weakness recorded – 2019-12-25 – 439 Read-only application can publish/delete fleets Analysed #1032468 Valid Access Control – 2021-01-04 – 398 Blind XSS on Twitter's internal Big Data panel at █████████████ Analysed #1207040 Valid Cross-site Scripting – 2021-07-09 – 357 Private list members disclosure via GraphQL Analysed #885539 Valid Access Control – 2020-08-04 – 346 [Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailable Analysed #210779 Valid Denial of Service – 2019-04-25 – 323 Bypass Password Authentication for updating email and phone number - Security Vulnerability Analysed #770504 Valid Authentication – 2020-02-08 – 288 Insufficient OAuth callback validation which leads to Periscope account takeover Analysed #110293 Valid Authentication – 2019-04-10 – 277 Insufficient validation on Digits bridge Analysed #168116 Valid Authentication – 2020-08-20 – 263 XXE on sms-be-vip.twitter.com in SXMP Processor Analysed #248668 Valid Injection and Smuggling – 2017-07-26 – 258 XSS and Open Redirect on MoPub Login Analysed #683298 Valid Open Redirect – 2019-09-24 $1,540 248 XSS via Direct Message deeplinks Analysed #341908 Valid Cross-site Scripting – 2019-05-09 – 236 Stored XSS on reports. Analysed #485748 Valid Cross-site Scripting – 2019-04-01 $700 232 Periscope android app deeplink leads to CSRF in follow action Analysed #583987 Valid Cross-Site Request Forgery – 2020-02-21 $1,540 224 Github Account hijack through broken link in developer.twitter.com Analysed #1031321 Valid Input Validation and Logic – 2021-02-04 – 222 Discoverability by phone number/email restriction bypass Analysed #1439026 Valid Access Control – 2022-02-11 $5,040 217 Account Takeover in Periscope TV Analysed #317476 Valid Cross-site Scripting – 2018-09-06 – 213 XSS and cache poisoning via upload.twitter.com on ton.twitter.com Analysed #84601 Valid Cross-site Scripting – 2019-05-01 – 198 Verify any unused email address Analysed #574962 Valid Access Control – 2019-06-24 $560 197 protected Tweet settings overwritten by other settings Analysed #664038 Valid No weakness recorded – 2020-01-01 – 178 Takeover of Twitter-owned domain at mobileapplinking.com Analysed #321699 Valid Input Validation and Logic – 2019-02-28 – 159 Twitter ID exposure via error-based side-channel attack Analysed #505424 Valid Information Disclosure – 2019-05-16 $1,470 154 Twitter Periscope Clickjacking Vulnerability Analysed #591432 Valid Misconfiguration and Insecure Design – 2019-07-10 $1,120 144 url that twitter mobile site can not load Analysed #500686 Valid Denial of Service – 2019-03-19 $1,120 142 character limitation bypass can lead to DoS on Twitter App and 500 Internal Server Error Analysed #819088 Valid Denial of Service – 2020-05-06 – 141 IDOR and statistics leakage in Orders Analysed #544329 Valid Insecure Direct Object Reference – 2019-06-14 $289 141 Reflected XSS in twitterflightschool.com Analysed #770349 Valid Cross-site Scripting – 2020-02-21 – 140 Highly wormable clickjacking in player card Analysed #85624 Valid Misconfiguration and Insecure Design – 2018-05-17 – 134 Incorrect param parsing in Digits web authentication Analysed #126522 Valid Authentication – 2018-08-18 – 126 XSS via referrer parameter Analysed #867616 Valid Cross-site Scripting – 2020-10-26 – 124 Vine all registered user Private/sensitive information disclosure .[ Ip address/phone no/email and many other informations ] #202823 Valid Information Disclosure – 2017-07-11 – 121 Changing email address on Twitter for Android unsets "Protect your Tweets" #472013 Valid Information Disclosure – 2019-01-18 $2,940 119 [URGENT] Opportunity to publish tweets on any twitters account #208978 Valid No weakness recorded – 2017-05-22 – 119 Cross-Domain Leakage of X Username / UserID due to Dynamically Generated JS File #2244229 Valid Information Disclosure Medium 2024-05-10 $1,500 115 Bypassing Digits web authentication's host validation with HPP #114169 Valid Authentication – 2016-08-12 – 108 Ability to perform actions (Tweet, Retweet, DM) and other actions, unauthenticated, on any account with SMS enabled. #470749 Valid Input Validation and Logic – 2019-09-26 – 106 Remote Unrestricted file Creation/Deletion and Possible RCE. #191884 Valid Command and Code Injection – 2017-02-26 – 100 Blind XSS on Twitter's internal Jira panel at ████ allows exfiltration of hackers reports and other sensitive data #1369674 Valid Cross-site Scripting – 2022-02-12 – 99 Safe Redirect Bypass #945990 Valid Other weaknesses – 2020-09-10 $560 98 Creating malformed URLs via new line character in-between two URLs leads to misrepresented hyperlinks in Tweets/DMs #712979 Valid Injection and Smuggling – 2020-01-24 – 96 Twitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirect #499348 Valid Access Control – 2019-04-29 – 95 Attacker can get vine repost user all informations even Ip address and location . #201300 Valid Authentication – 2017-03-25 – 95 Github Token Leaked publicly for https://github.com/mopub #612231 Valid Cryptography – 2019-08-15 – 92 Bypassing Digits bridge origin validation #110467 Valid Authentication – 2017-04-30 – 92 Able to see Twitter Circle tweets due to improper access control on the "FavoriteTweet" endpoint #1694304 Valid Access Control – 2024-03-01 – 91 Denial of Service | twitter.com & mobile.twitter.com #903740 Valid Denial of Service – 2020-09-02 $1,120 89 [CRITICAL] Full account takeover using CSRF #235642 Valid Cross-Site Request Forgery – 2017-11-03 – 88 Persistent DOM-based XSS in https://help.twitter.com via localStorage #297968 Valid Cross-site Scripting – 2018-02-24 – 84 [Studio.twitter.com] See someone else pics #164649 Valid Authentication – 2017-06-22 – 84