HexBrain
Sign in

Browse / X / xAI

X / xAI

248disclosed reports
$84,989paid in bounties

See its reports on the map

What gets reported to X / xAI

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Potential pre-auth RCE on Twitter VPNOS Command Injection · critical
    $20,1601,246 votes
  2. Bypassing Digits origin validation which leads to account takeoverImproper Authentication - Generic
    619 votes
  3. CRLF injectionCRLF Injection · medium
    439 votes
  4. Read-only application can publish/delete fleetsPrivilege Escalation · medium
    398 votes
  5. Blind XSS on Twitter's internal Big Data panel at █████████████Cross-site Scripting (XSS) - Stored · critical
    357 votes
  6. Private list members disclosure via GraphQLImproper Access Control - Generic · low
    346 votes
  7. [Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailableUncontrolled Resource Consumption
    323 votes
  8. Bypass Password Authentication for updating email and phone number - Security VulnerabilityImproper Authentication - Generic · high
    288 votes
  9. Insufficient OAuth callback validation which leads to Periscope account takeoverImproper Authentication - Generic
    277 votes
  10. Insufficient validation on Digits bridgeImproper Authentication - Generic
    263 votes
  11. XXE on sms-be-vip.twitter.com in SXMP ProcessorXML External Entities (XXE) · medium
    258 votes
  12. XSS and Open Redirect on MoPub LoginOpen Redirect
    $1,540248 votes
  13. XSS via Direct Message deeplinksCross-site Scripting (XSS) - DOM
    236 votes
  14. Stored XSS on reports.Cross-site Scripting (XSS) - Stored · high
    $700232 votes
  15. Periscope android app deeplink leads to CSRF in follow actionCross-Site Request Forgery (CSRF) · low
    $1,540224 votes
  16. Github Account hijack through broken link in developer.twitter.comPhishing · high
    222 votes
  17. Discoverability by phone number/email restriction bypassImproper Access Control - Generic · high
    $5,040217 votes
  18. Account Takeover in Periscope TVCross-site Scripting (XSS) - Generic · high
    213 votes
  19. XSS and cache poisoning via upload.twitter.com on ton.twitter.comCross-site Scripting (XSS) - Generic
    198 votes
  20. Verify any unused email addressImproper Access Control - Generic
    $560197 votes
  21. protected Tweet settings overwritten by other settingsmedium
    178 votes
  22. Takeover of Twitter-owned domain at mobileapplinking.comBusiness Logic Errors
    159 votes
  23. Twitter ID exposure via error-based side-channel attackPrivacy Violation · medium
    $1,470154 votes
  24. Twitter Periscope Clickjacking VulnerabilityUI Redressing (Clickjacking) · medium
    $1,120144 votes
  25. url that twitter mobile site can not loadUncontrolled Resource Consumption · low
    $1,120142 votes
  26. character limitation bypass can lead to DoS on Twitter App and 500 Internal Server ErrorUncontrolled Resource Consumption · medium
    141 votes
  27. IDOR and statistics leakage in Orders Insecure Direct Object Reference (IDOR) · medium
    $289141 votes
  28. Reflected XSS in twitterflightschool.comCross-site Scripting (XSS) - Reflected
    140 votes
  29. Highly wormable clickjacking in player cardUI Redressing (Clickjacking)
    134 votes
  30. Incorrect param parsing in Digits web authenticationImproper Authentication - Generic
    126 votes
  31. XSS via referrer parameterCross-site Scripting (XSS) - Reflected · medium
    124 votes
  32. Vine all registered user Private/sensitive information disclosure .[ Ip address/phone no/email and many other informations ]Information Disclosure · critical
    121 votes
  33. Changing email address on Twitter for Android unsets "Protect your Tweets"Privacy Violation · low
    $2,940119 votes
  34. [URGENT] Opportunity to publish tweets on any twitters accounthigh
    119 votes
  35. Cross-Domain Leakage of X Username / UserID due to Dynamically Generated JS FileInformation Disclosure · medium
    $1,500115 votes
  36. Bypassing Digits web authentication's host validation with HPPImproper Authentication - Generic
    108 votes
  37. Ability to perform actions (Tweet, Retweet, DM) and other actions, unauthenticated, on any account with SMS enabled.Business Logic Errors · critical
    106 votes
  38. Remote Unrestricted file Creation/Deletion and Possible RCE.Code Injection · low
    100 votes
  39. Blind XSS on Twitter's internal Jira panel at ████ allows exfiltration of hackers reports and other sensitive dataCross-site Scripting (XSS) - Stored · critical
    99 votes
  40. Safe Redirect Bypass Security Through Obscurity · low
    $56098 votes
  41. Creating malformed URLs via new line character in-between two URLs leads to misrepresented hyperlinks in Tweets/DMsCRLF Injection · low
    96 votes
  42. Twitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirect Improper Access Control - Generic · critical
    95 votes
  43. Attacker can get vine repost user all informations even Ip address and location .Improper Authentication - Generic
    95 votes
  44. Github Token Leaked publicly for https://github.com/mopubCleartext Storage of Sensitive Information · medium
    92 votes
  45. Bypassing Digits bridge origin validationImproper Authentication - Generic
    92 votes
  46. Able to see Twitter Circle tweets due to improper access control on the "FavoriteTweet" endpointImproper Access Control - Generic · medium
    91 votes
  47. Denial of Service | twitter.com & mobile.twitter.comUncontrolled Resource Consumption · medium
    $1,12089 votes
  48. [CRITICAL] Full account takeover using CSRFCross-Site Request Forgery (CSRF) · high
    88 votes
  49. Ability to getting Twitter Blue verified badge without purchase itDuplicateBusiness Logic Errors · medium
    85 votes
  50. Persistent DOM-based XSS in https://help.twitter.com via localStorageCross-site Scripting (XSS) - Stored · medium
    84 votes
  51. [Studio.twitter.com] See someone else pics Improper Authentication - Generic
    84 votes
  52. Ability to see hidden likesImproper Access Control - Generic · medium
    83 votes
  53. Html Injection and Possible XSS in sms-be-vip.twitter.comCross-site Scripting (XSS) - Generic
    83 votes
  54. Incorrect details on OAuth permissions screen allows DMs to be read without permissionPrivacy Violation · medium
    $2,94080 votes
  55. [dev.twitter.com] XSS and Open RedirectCross-site Scripting (XSS) - Generic · medium
    $1,12075 votes
  56. CSRF on Periscope Web OAuth authorization endpoint Cross-Site Request Forgery (CSRF)
    74 votes
  57. Multiple XSS on account settings that can hijack any users in the company. Cross-site Scripting (XSS) - Stored · critical
    $70073 votes
  58. Subdomain takeover of images.crossinstall.comBusiness Logic Errors · high
    71 votes
  59. Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking linksSecurity Through Obscurity · medium
    $56070 votes
  60. Ability to add arbitrary images/descriptions/titles to ohter people's issues via IDOR on getrevue.coInsecure Direct Object Reference (IDOR) · critical
    67 votes
  61. Protected tweets exposure through the URLInformation Disclosure · high
    $56067 votes
  62. Denial of Service [Chrome]Uncontrolled Resource Consumption · medium
    $56066 votes
  63. Multiple DOMXSS on Amplify Web PlayerCross-site Scripting (XSS) - Generic
    66 votes
  64. Viral Direct Message Clickjacking via link truncation leading to capture of both Google credentials & installation of malicious 3rd party Twitter AppUI Redressing (Clickjacking) · high
    64 votes
  65. Blind XSS in Mobpub Marketplace Admin Production | Sentry via demand.mopub.com (User-Agent)Cross-site Scripting (XSS) - Stored · high
    63 votes
  66. Bypassing x profile verification to receive instant blue checkmark and unlimited profile changesBusiness Logic Errors · low
    $25060 votes
  67. Bypass Password Authentication to Update the PasswordImproper Authentication - Generic · high
    59 votes
  68. HTTP Response Splitting (CRLF injection) in report_storyCRLF Injection
    59 votes
  69. Periscope iOS app CSRF in follow action due to deeplinkCross-Site Request Forgery (CSRF) · low
    $2,94058 votes
  70. NO username used in authenthication to www.mopub.com leading to direct password submission which has unlimited submission rate.Improper Authentication - Generic · medium
    58 votes
  71. Ability to bruteforce mopub account’s password due to lack of rate limitation protection using {ip rotation techniques}Improper Restriction of Authentication Attempts · low
    $42055 votes
  72. Subdomain takeover on dev-admin.periscope.tvPrivilege Escalation · medium
    55 votes
  73. DOM based cookie bombUncontrolled Resource Consumption
    55 votes
  74. Open Redirect on https://www.twitterflightschool.com/widgets/experience?destination_url=https://evil.comOpen Redirect · low
    53 votes
  75. csp bypass + xssCross-site Scripting (XSS) - Generic
    51 votes
  76. reverb.twitter.com redirects to vulnerable reverb.guru
    50 votes
  77. DOMXSS in TweetdeckCross-site Scripting (XSS) - Generic
    50 votes
  78. URGENT - Subdomain Takeover on media.vine.co due to unclaimed domain pointing to AWSCross-site Scripting (XSS) - Generic
    50 votes
  79. Periscope-all Firebase database takeoverImproper Access Control - Generic · critical
    49 votes
  80. Tracking of users on third-party websites using the Twitter cookie, due to a flaw in authenticating image requestsPrivacy Violation · medium
    $1,12049 votes
  81. Stealing User emails by clickjacking cards.twitter.com/xxx/xxxUI Redressing (Clickjacking) · medium
    49 votes
  82. Opportunity to obtain private tweets through search widget preview cachesBusiness Logic Errors
    $1,12048 votes
  83. Bypassing callback_url validation on DigitsOpen Redirect
    48 votes
  84. View liked twits of private account via publish.twitter.comInformation Disclosure · medium
    47 votes
  85. [dev.twitter.com] XSS and Open Redirect Protection BypassCross-site Scripting (XSS) - Generic · medium
    $1,12046 votes
  86. Cross-site scripting (reflected)Cross-site Scripting (XSS) - Generic · medium
    45 votes
  87. Bypass t.co link shortener in Twitter direct messagesBusiness Logic Errors · low
    44 votes
  88. Open RedirectOpen Redirect
    41 votes
  89. CSRF on cards APICross-Site Request Forgery (CSRF)
    41 votes
  90. Twitter iOS fails to validate server certificate and sends oauth tokenCryptographic Issues - Generic · high
    $2,10040 votes
  91. Bypass Password Authentication to Update the PasswordImproper Authentication - Generic · medium
    39 votes
  92. niche s3 buckets are readable/writeable/deleteable by authorized AWS usersImproper Authentication - Generic
    39 votes
  93. Urgent : Unauthorised Access to Media content of all Direct messages and protected tweets(Indirect object reference)Improper Authentication - Generic · high
    39 votes
  94. XSS on https://app.mopub.com/reports/custom/add/ [new-d1]Cross-site Scripting (XSS) - Generic
    38 votes
  95. [IDOR][translate.twitter.com] Opportunity to change any comment at the forumPrivilege Escalation · low
    38 votes
  96. Wrong Interpretation of URL encoded characters, showing different punny code leads to redirection on different domainOpen Redirect · low
    $56037 votes
  97. Listing of Amazon S3 Bucket accessible to any amazon authenticated user (metrics.pscp.tv)Information Disclosure
    $14036 votes
  98. 2 Subdomains Takeover at readfu.comPrivilege Escalation · medium
    35 votes
  99. CSRF on https://www.niche.co leads to "account disconnection"DuplicateCross-Site Request Forgery (CSRF) · medium
    35 votes
  100. Accepting error message on twitter sends you to attacker siteOpen Redirect · medium
    $56033 votes