Pornhub: IDOR - Access to private video thumbnails even if video requires password authentication

The researcher discovered an IDOR path which allows the user to few content and images from a password protected videos...

U.S. Dept Of Defense: Video player on ███ allows arbitrary remote videos to be played

Summary: A Flash video player hosted on ███████ can be provided with an arbitrary remote XML file via the url query string parameter. Description: The Flash video player http://█████/shared/widgets/popup.asp uses the url query string parameter as an address to fetch an RSS feed type XML document...

scoreland.com XSS vulnerability

Vulnerable URL: http://www.scoreland.com/big-boob-videos/?page=1'"--!confirmOPENBUGBOUNTY//...

Pornhub: IDOR - disclosure of private videos - /api_android_v3/getUserVideos

An API endpoint exposed private video links when a user added the video to their profile favourites. An API endpoint allowed to obtain a link to any private video by adding it to ones profile favourites. Check out the infrastructure monitoring platform BugLabs.me for bounty hunters -...

iOS WebView Problem Allows Attackers to Initiate Phone Calls

iOS developers who have embedded Apple’s WebView into mobile apps need to be aware of an exploitable issue that could allow phone calls to a number of the attacker’s choosing. Researcher Collin Mulliner said the vulnerability is trivial to exploit, requiring at a minimum one line of HTML code. Th...

Fedora 23 : webkitgtk4 (2016-d957ffbac1)

This update addresses the following vulnerabilities : - CVE-2016-4622, CVE-2016-4624, CVE-2016-4591, CVE-2016-4590 Additional fixes : - Fix performance in accelerated compositing mode with the modesetting intel driver and DRI3 enabled. - Reduce the amount of file descriptors that the Web Process...

Security update for MozillaFirefox, mozilla-nss (important)

This update to Mozilla Firefox 47 fixes the following issues boo983549: Security fixes: - CVE-2016-2815/CVE-2016-2818: Miscellaneous memory safety hazards boo983638 MFSA 2016-49 - CVE-2016-2819: Buffer overflow parsing HTML5 fragments boo983655 MFSA 2016-50 - CVE-2016-2821: Use-after-free deletin...

Windows Zero Day Selling for $90,000

Hackers claim to have unearthed a zero-day vulnerability giving attackers admin rights to any Windows machine from Windows 2000 to a fully patched version of Windows 10. The zero day is for sale on the black market for $90,000. Security experts say the zero-day exploit looks legitimate and in the...

Vimeo: All Vimeo Private videos disclosure via Authorization Bypass

Hello, There is a vulnerability in https://vimeo.com/VIDEOID?action=share that makes all Vimeo private videos available to anybody. POC link : http://opnsec.com/vimeo/vl/videoLeak.php?video=VIDEOID POC requirements : - No need to be logged in Vimeo - Because of sensitivity of this, I put a passwo...

Vimeo: Images and Subtitles Leakage from private videos

Hello, There is a Vulnerability in https://player.vimeo.com/video/VIDEOID When a Video is private but embedable, there are some information about the video on the source code of the webpage, even if the user is not connected to Vimeo or doesn't have right to access the video. The following info a...

Vimeo: CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go public

Hello Vimeo Security Team. There is a CSRF vulnerability on Vimeo.com. With this vulnerability, an attacker can make all the victim's vimeo videos go public just by having the victim open a link to the attacker webpage. He can also get the victim's vimeo name, user id, user account type and perfo...

berck-tourisme.com XSS vulnerability

Vulnerable URL: http://www.berck-tourisme.com/videos.php?id=9'"/alert/openbugbounty/...

Jelly Jamm 2 - Videos for Kids - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Jelly Jamm 2 - Videos for Kids published at the 'play' market has multiple vulnerabilities...

Mouk 1 - Watch Videos for Kids - Customized SSL, Dangerous filesystem permissions, Exported ContentProvider vulnerabilities

HackApp vulnerability scanner discovered that application Mouk 1 - Watch Videos for Kids published at the 'play' market has multiple vulnerabilities...

KIDOZ TV: Best Videos for Kids - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application KIDOZ TV: Best Videos for Kids published at the 'play' market has multiple vulnerabilities...

Hide Pictures &Videos - Vaulty - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Hide Pictures &Videos - Vaulty published at the 'play' market has multiple vulnerabilities...

Pic Lock- Hide Photos & Videos - Corrupted files, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Pic Lock- Hide Photos & Videos published at the 'play' market has multiple vulnerabilities...

Camcorder - VHS Home Videos - Customized SSL, MIT license vulnerabilities

HackApp vulnerability scanner discovered that application Camcorder - VHS Home Videos published at the 'play' market has multiple vulnerabilities...

Hide Pictures & Videos - VAULT - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Hide Pictures & Videos - VAULT published at the 'play' market has multiple vulnerabilities...

Slow Motion Videos - Dynamic Code Loading, External URLs, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Slow Motion Videos published at the 'play' market has multiple vulnerabilities...