U tweetove putem weba ili aplikacija drugih proizvođača možete dodati podatke o lokaciji, kao što su grad ili točna lokacija. Povijest lokacija tweetova uvijek možete izbrisati. Saznajte više
XSS using Image file SVG 1. SVG files can be treated as images in HTML 2. SVG files also support inline javascript code 3. website loads a SVG file with an XSS payload it will get executed http://ghostlulz.com/xss-svg/?fbclid=IwAR01ZcyLPUp3iEP_rtqmc_1sS1bNn2BPfIBYWnis19o16tXliZ7FkiEQCAc …pic.twitter.com/82h5oa4B2i
4. easy way to test for this vulnerability is to upload a SVG file as your profile picture 5. Notice the content type is set to : - Content-Type: image/svg+xml 6. find out what path it was uploaded to - right clicking the image and selecting “copy image address”pic.twitter.com/cWtRMoDJw5
Why are browsers honoring js in svg? Is there no option to nuke this from orbit??
displaying SVG has two modes. in an image context (<img>, css, etc.) it does not run stricts. When navigated to as a top-level it can run scripts like any HTML/XML/XHTML document - which it essentially is.
Very clever! 
Thanks for the shout out 
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.
