Vimeo: Downloading password protected / restricted videos

Using: https://vimeo.com/api/atv/clip/VideoID it is possible to get the title, description & download the file regardless on any privacy settings this includes both setting the video to 'Only me' and using a password For proof using my own video: https://vimeo.com/171116158 which has the password...

Vimeo: All Vimeo Private videos disclosure via Authorization Bypass

Hello, There is a vulnerability in https://vimeo.com/VIDEOID?action=share that makes all Vimeo private videos available to anybody. POC link : http://opnsec.com/vimeo/vl/videoLeak.php?video=VIDEOID POC requirements : - No need to be logged in Vimeo - Because of sensitivity of this, I put a passwo...

Vimeo: XSS in Subtitles of Vimeo Flash Player and Hubnut

XSS is Subtitles of flash player and hubnut...

Vimeo: Images and Subtitles Leakage from private videos

Hello, There is a Vulnerability in https://player.vimeo.com/video/VIDEOID When a Video is private but embedable, there are some information about the video on the source code of the webpage, even if the user is not connected to Vimeo or doesn't have right to access the video. The following info a...

Vimeo: OAuth 2 Authorization Bypass via CSRF and Cross Site Flashing

Hello Vimeo Security Team, There is a vulnerability in api.vimeo.com/oauth which allows an attacker to gain full App privilege over a Vimeo victim user account without user approval, just by having the victim open a link to the attacker webpage. Proof of Concept link :...

Vimeo: CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go public

Hello Vimeo Security Team. There is a CSRF vulnerability on Vimeo.com. With this vulnerability, an attacker can make all the victim's vimeo videos go public just by having the victim open a link to the attacker webpage. He can also get the victim's vimeo name, user id, user account type and perfo...

Vimeo: Error page Text Injection.

Error page text injection...

Vimeo - Customized SSL, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Vimeo published at the 'play' market has multiple vulnerabilities...

Vimeo: Missing rate limit on private videos password

Missing rate limit on password protected clips. Rate-limits is a non-qualifying bug at this time. We have received multiple reports of this in the past, however, since that time we have implemented a clip password rate limit. This was not appropriately applied to all clip password areas, so we've...

Vimeo: Private, embeddable videos leaks data through Facebook & Open Graph

Clip meta-data disclosed to thrid-party crawlers...

Vimeo: Legacy API exposes private video titles

Hi, I have discovered Vimeo's legacy API vimeo.com/api exposes private video titles. Example URL: https://vimeo.com/api/oembed.json?url=https%3A//vimeo.com/152133387 Vimeo provides the uploader with 5 privacy options for viewing videos: 1. Anyone 2. Only me 3. Only people I follow 4. Only people ...

Vimeo: XSS on player.vimeo.com without user interaction and vimeo.com with user interaction

I reported this one in the report 87854, but I was asked to report it again in a separate report. Description At the end of each video appears the thumbnail of other video from the same user. This thumbnail has the title More from nameoftheuser. The problem is that the name of the user is not...

bas-huep.aphp.fr. XSS vulnerability

Open Bug Bounty ID: OBB-86781 Description| Value ---|--- Affected Website:| bas-huep.aphp.fr. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

Vimeo: XSS on vimeo.com | "Search within these results" feature (requires user interaction)

Description When you search in pages such as the videos of some Category or the videos of some User, and you receive more than 0 results, the path of the URL is put in the attribute data-start-page of a element without escaping. This allows to insert another attribute like onmouseover to execute...

Vimeo: XSS on mobile version of vimeo.com where the button "Follow" appears

Description In the mobile version of https://vimeo.com, you will see + Follow buttons in places like the description of a channel, the description of a video, the profile of a user, the list of users you follow and the list of users that other users follow. The problem is that the code that build...

Vimeo: Stored XSS on vimeo.com and player.vimeo.com

Description You can share your uploaded videos using the widget Hubnut. The URL is something like https://player.vimeo.com/hubnut/user/user36690798/uploadedvideos?color=44bbff&background=000000&slideshow=0&videotitle=1&videobyline=1, and I noticed that the same content is loaded for this URL...

Vimeo: Reflected XSS on vimeo.com/musicstore

Description The value of the parameter section is reflected in the Javascript function MusicStoreCommon.initialize without escaping, which allows to insert Javascript code. Proof of concept 1. Go to https://vimeo.com/musicstore?section=%27-alertdocument.domain-%27. 2. alertdocument.domain is...

Vimeo: Stored XSS on player.vimeo.com

Description The page loaded for the Vimeo embedded player prints the Name of the owner of the video in Javascript context. Some characters are escaped, like " but others like , and - if the video is public - any Vimeo user can be affected by the Javascript code that is loaded. However, there is a...

Vimeo: API: missing invalidation of OAuth2 Authorization Code during access revocation causes authorization bypass

OAuth2 API makes it possible for users to grant access to their accounts to some third-side applications. Of course, users are able to manage such applications' access to their accounts and may deny access for any application. When some user denies access for the application, all accesstokens are...

Vimeo: May cause account take over (Via invitation page)

Hello Vimeo Security Team, I just found issue on vimeo.com/tools/invite that may put our vimeo users in riks and here is the details. Problem: All Email Content Spoofing How to reproduce: 1- Go to user settings and change the username to be something like this "Urgent From Vimeo Security Team". 2...