Browse / X / xAI

X / xAI

See its reports on the map

What gets reported to X / xAI

• Cross-site Scripting48
• Authentication37
• Information Disclosure34
• Misconfiguration19
• Access Control18
• Cross-Site Request Forgery16

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Potential pre-auth RCE on Twitter VPNOS Command Injection · critical
   $20,1601,246 votes
2. Bypassing Digits origin validation which leads to account takeoverImproper Authentication - Generic
   619 votes
3. CRLF injectionCRLF Injection · medium
   439 votes
4. Read-only application can publish/delete fleetsPrivilege Escalation · medium
   398 votes
5. Blind XSS on Twitter's internal Big Data panel at █████████████Cross-site Scripting (XSS) - Stored · critical
   357 votes
6. Private list members disclosure via GraphQLImproper Access Control - Generic · low
   346 votes
7. [Urgent] Invalidating OAuth2 Bearer token makes TweetDeck unavailableUncontrolled Resource Consumption
   323 votes
8. Bypass Password Authentication for updating email and phone number - Security VulnerabilityImproper Authentication - Generic · high
   288 votes
9. Insufficient OAuth callback validation which leads to Periscope account takeoverImproper Authentication - Generic
   277 votes
10. Insufficient validation on Digits bridgeImproper Authentication - Generic
    263 votes
11. XXE on sms-be-vip.twitter.com in SXMP ProcessorXML External Entities (XXE) · medium
    258 votes
12. XSS and Open Redirect on MoPub LoginOpen Redirect
    $1,540248 votes
13. XSS via Direct Message deeplinksCross-site Scripting (XSS) - DOM
    236 votes
14. Stored XSS on reports.Cross-site Scripting (XSS) - Stored · high
    $700232 votes
15. Periscope android app deeplink leads to CSRF in follow actionCross-Site Request Forgery (CSRF) · low
    $1,540224 votes
16. Github Account hijack through broken link in developer.twitter.comPhishing · high
    222 votes
17. Discoverability by phone number/email restriction bypassImproper Access Control - Generic · high
    $5,040217 votes
18. Account Takeover in Periscope TVCross-site Scripting (XSS) - Generic · high
    213 votes
19. XSS and cache poisoning via upload.twitter.com on ton.twitter.comCross-site Scripting (XSS) - Generic
    198 votes
20. Verify any unused email addressImproper Access Control - Generic
    $560197 votes
21. protected Tweet settings overwritten by other settingsmedium
    178 votes
22. Takeover of Twitter-owned domain at mobileapplinking.comBusiness Logic Errors
    159 votes
23. Twitter ID exposure via error-based side-channel attackPrivacy Violation · medium
    $1,470154 votes
24. Twitter Periscope Clickjacking VulnerabilityUI Redressing (Clickjacking) · medium
    $1,120144 votes
25. url that twitter mobile site can not loadUncontrolled Resource Consumption · low
    $1,120142 votes
26. character limitation bypass can lead to DoS on Twitter App and 500 Internal Server ErrorUncontrolled Resource Consumption · medium
    141 votes
27. IDOR and statistics leakage in Orders Insecure Direct Object Reference (IDOR) · medium
    $289141 votes
28. Reflected XSS in twitterflightschool.comCross-site Scripting (XSS) - Reflected
    140 votes
29. Highly wormable clickjacking in player cardUI Redressing (Clickjacking)
    134 votes
30. Incorrect param parsing in Digits web authenticationImproper Authentication - Generic
    126 votes
31. XSS via referrer parameterCross-site Scripting (XSS) - Reflected · medium
    124 votes
32. Vine all registered user Private/sensitive information disclosure .[ Ip address/phone no/email and many other informations ]Information Disclosure · critical
    121 votes
33. Changing email address on Twitter for Android unsets "Protect your Tweets"Privacy Violation · low
    $2,940119 votes
34. [URGENT] Opportunity to publish tweets on any twitters accounthigh
    119 votes
35. Cross-Domain Leakage of X Username / UserID due to Dynamically Generated JS FileInformation Disclosure · medium
    $1,500115 votes
36. Bypassing Digits web authentication's host validation with HPPImproper Authentication - Generic
    108 votes
37. Ability to perform actions (Tweet, Retweet, DM) and other actions, unauthenticated, on any account with SMS enabled.Business Logic Errors · critical
    106 votes
38. Remote Unrestricted file Creation/Deletion and Possible RCE.Code Injection · low
    100 votes
39. Blind XSS on Twitter's internal Jira panel at ████ allows exfiltration of hackers reports and other sensitive dataCross-site Scripting (XSS) - Stored · critical
    99 votes
40. Safe Redirect Bypass Security Through Obscurity · low
    $56098 votes
41. Creating malformed URLs via new line character in-between two URLs leads to misrepresented hyperlinks in Tweets/DMsCRLF Injection · low
    96 votes
42. Twitter lite(Android): Vulnerable to local file steal, Javascript injection, Open redirect Improper Access Control - Generic · critical
    95 votes
43. Attacker can get vine repost user all informations even Ip address and location .Improper Authentication - Generic
    95 votes
44. Github Token Leaked publicly for https://github.com/mopubCleartext Storage of Sensitive Information · medium
    92 votes
45. Bypassing Digits bridge origin validationImproper Authentication - Generic
    92 votes
46. Able to see Twitter Circle tweets due to improper access control on the "FavoriteTweet" endpointImproper Access Control - Generic · medium
    91 votes
47. Denial of Service | twitter.com & mobile.twitter.comUncontrolled Resource Consumption · medium
    $1,12089 votes
48. [CRITICAL] Full account takeover using CSRFCross-Site Request Forgery (CSRF) · high
    88 votes
49. Persistent DOM-based XSS in https://help.twitter.com via localStorageCross-site Scripting (XSS) - Stored · medium
    84 votes
50. [Studio.twitter.com] See someone else pics Improper Authentication - Generic
    84 votes
51. Ability to see hidden likesImproper Access Control - Generic · medium
    83 votes
52. Html Injection and Possible XSS in sms-be-vip.twitter.comCross-site Scripting (XSS) - Generic
    83 votes
53. Incorrect details on OAuth permissions screen allows DMs to be read without permissionPrivacy Violation · medium
    $2,94080 votes
54. [dev.twitter.com] XSS and Open RedirectCross-site Scripting (XSS) - Generic · medium
    $1,12075 votes
55. CSRF on Periscope Web OAuth authorization endpoint Cross-Site Request Forgery (CSRF)
    74 votes
56. Multiple XSS on account settings that can hijack any users in the company. Cross-site Scripting (XSS) - Stored · critical
    $70073 votes
57. Subdomain takeover of images.crossinstall.comBusiness Logic Errors · high
    71 votes
58. Chained open redirects and use of Ideographic Full Stop defeat Twitter's approach to blocking linksSecurity Through Obscurity · medium
    $56070 votes
59. Ability to add arbitrary images/descriptions/titles to ohter people's issues via IDOR on getrevue.coInsecure Direct Object Reference (IDOR) · critical
    67 votes
60. Protected tweets exposure through the URLInformation Disclosure · high
    $56067 votes
61. Denial of Service [Chrome]Uncontrolled Resource Consumption · medium
    $56066 votes
62. Multiple DOMXSS on Amplify Web PlayerCross-site Scripting (XSS) - Generic
    66 votes
63. Viral Direct Message Clickjacking via link truncation leading to capture of both Google credentials & installation of malicious 3rd party Twitter AppUI Redressing (Clickjacking) · high
    64 votes
64. Blind XSS in Mobpub Marketplace Admin Production | Sentry via demand.mopub.com (User-Agent)Cross-site Scripting (XSS) - Stored · high
    63 votes
65. Bypassing x profile verification to receive instant blue checkmark and unlimited profile changesBusiness Logic Errors · low
    $25060 votes
66. Bypass Password Authentication to Update the PasswordImproper Authentication - Generic · high
    59 votes
67. HTTP Response Splitting (CRLF injection) in report_storyCRLF Injection
    59 votes
68. Periscope iOS app CSRF in follow action due to deeplinkCross-Site Request Forgery (CSRF) · low
    $2,94058 votes
69. NO username used in authenthication to www.mopub.com leading to direct password submission which has unlimited submission rate.Improper Authentication - Generic · medium
    58 votes
70. Ability to bruteforce mopub account’s password due to lack of rate limitation protection using {ip rotation techniques}Improper Restriction of Authentication Attempts · low
    $42055 votes
71. Subdomain takeover on dev-admin.periscope.tvPrivilege Escalation · medium
    55 votes
72. DOM based cookie bombUncontrolled Resource Consumption
    55 votes
73. Open Redirect on https://www.twitterflightschool.com/widgets/experience?destination_url=https://evil.comOpen Redirect · low
    53 votes
74. csp bypass + xssCross-site Scripting (XSS) - Generic
    51 votes
75. reverb.twitter.com redirects to vulnerable reverb.guru
    50 votes
76. DOMXSS in TweetdeckCross-site Scripting (XSS) - Generic
    50 votes
77. URGENT - Subdomain Takeover on media.vine.co due to unclaimed domain pointing to AWSCross-site Scripting (XSS) - Generic
    50 votes
78. Periscope-all Firebase database takeoverImproper Access Control - Generic · critical
    49 votes
79. Tracking of users on third-party websites using the Twitter cookie, due to a flaw in authenticating image requestsPrivacy Violation · medium
    $1,12049 votes
80. Stealing User emails by clickjacking cards.twitter.com/xxx/xxxUI Redressing (Clickjacking) · medium
    49 votes
81. Opportunity to obtain private tweets through search widget preview cachesBusiness Logic Errors
    $1,12048 votes
82. Bypassing callback_url validation on DigitsOpen Redirect
    48 votes
83. View liked twits of private account via publish.twitter.comInformation Disclosure · medium
    47 votes
84. [dev.twitter.com] XSS and Open Redirect Protection BypassCross-site Scripting (XSS) - Generic · medium
    $1,12046 votes
85. Cross-site scripting (reflected)Cross-site Scripting (XSS) - Generic · medium
    45 votes
86. Bypass t.co link shortener in Twitter direct messagesBusiness Logic Errors · low
    44 votes
87. Open RedirectOpen Redirect
    41 votes
88. CSRF on cards APICross-Site Request Forgery (CSRF)
    41 votes
89. Twitter iOS fails to validate server certificate and sends oauth tokenCryptographic Issues - Generic · high
    $2,10040 votes
90. Bypass Password Authentication to Update the PasswordImproper Authentication - Generic · medium
    39 votes
91. niche s3 buckets are readable/writeable/deleteable by authorized AWS usersImproper Authentication - Generic
    39 votes
92. Urgent : Unauthorised Access to Media content of all Direct messages and protected tweets(Indirect object reference)Improper Authentication - Generic · high
    39 votes
93. XSS on https://app.mopub.com/reports/custom/add/ [new-d1]Cross-site Scripting (XSS) - Generic
    38 votes
94. [IDOR][translate.twitter.com] Opportunity to change any comment at the forumPrivilege Escalation · low
    38 votes
95. Wrong Interpretation of URL encoded characters, showing different punny code leads to redirection on different domainOpen Redirect · low
    $56037 votes
96. Listing of Amazon S3 Bucket accessible to any amazon authenticated user (metrics.pscp.tv)Information Disclosure
    $14036 votes
97. 2 Subdomains Takeover at readfu.comPrivilege Escalation · medium
    35 votes
98. Accepting error message on twitter sends you to attacker siteOpen Redirect · medium
    $56033 votes
99. Delete direct message history without access the proper conversation_idBusiness Logic Errors · low
    $56033 votes
100. [staging-engineering.gnip.com] Publicly accessible GIT directoryInformation Disclosure · medium
     $28033 votes