229 matches found
Joomla HWDVideoShare 1.5 Bypass / Database Disclosure / SQL Injection
Exploit Title : Joomla HWDVideoShare Components 1.5 SQL Injection / Database Disclosure / Incorrect Authorization Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 30/01/2019 Vendor Homepage : joomla.org hwdmediashare.co.uk Software Download Link :...
Weak Password Vulnerability in Vimeo Interactive Website Management System
Chengdu Vimeo Interactive Network Technology Co., Ltd. is a technology company whose main products or services are all kinds of website construction, space domain name. Weak password vulnerability exists in the website management system of Weimei Interactive, which can be exploited by attackers t...
Cross-Site Scripting in Online Media Asset Rendering
Failing to properly encode user input, online media asset rendering .youtube and .vimeo files is vulnerable to cross-site scripting. A valid backend user account or write access on the server system e.g. SFTP is needed in order to exploit this vulnerability...
Denial of Service in Online Media Asset Handling
Online Media Asset Handling .youtube and .vimeo files in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a...
Vimeo: Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tv
By modifying the Content-Type to be blank, during a PUT command, the researcher was able to upload files to the CDN. This has been resolved. It was possible to write and overwrite arbitrary files to the CDN vpe.cdn.vimeo.tv used for JS scripts delivery on the various in-scope assets using the PUT...
Argus Surveillance DVR 4.0.0.0 Directory Traversal Vulnerability
Exploit for cgi platform in category web applications + Credits: John Page aka hyp3rlinx + Source: http://hyp3rlinx.altervista.org/advisories/ARGUS-SURVEILLANCE-DVR-v4-UNAUTHENTICATED-PATH-TRAVERSAL-FILE-DISCLOSURE.txt + ISR: Apparition Security Greetz: Greetz: indoushka | Eduardo | GGA Vendor...
Vimeo: Domain pointing to vimeo portfolio are prone to takeover using on-demand.
We thank @bugdiscloseguys for finding this issue. We were only checking \ on-demand to on-demand, but not on-demand to portfolio. Vimeo offers service for pro users to add custom domain under portfolios so that portfolios can be hosted on your subDomain, However Vimeo offers same feature for...
Vimeo: Reflected File Download (RFD) in download video
The researcher was able to craft a Reflected File Download during the re-download of a video previously uploaded...
Vimeo: Improper Authentication in Vimeo's API 'versions' endpoint.
The versions endpoint was exploitable by accounts that were not pro or business. Issue -- There was an authorization issue in versions endpoint, Which on exploiting could allow an attacker to leak private videos of pro/business users due to the fact version is only applicable for pro/business...
WordPress Jetpack plugin cross-site scripting vulnerability (CNVD-2018-01270)
WordPress is the WordPress Software Foundation's set of blogging platform using PHP language development, the platform supports in PHP and MySQL server set up a personal blog site. Jetpack is one of the plugin package contains a variety of features such as social sharing, social login and social...
CVE-2016-10706
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link...
Design/Logic Flaw
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link...
CVE-2016-10706
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link...
CVE-2016-10706
The Jetpack plugin before 4.0.3 for WordPress has XSS via a crafted Vimeo link...
CVE-2016-10706
The CVE-2016-10706 affects the WordPress Jetpack plugin prior to version 4.0.3. A cross-site scripting (XSS) vulnerability can be triggered by a specially crafted Vimeo link. Public sources (NVD/Red Hat/CNVD) confirm the issue as a vulnerability in Jetpackās handling of Vimeo content; the cited r...
Vimeo: Disclosure of sensitive information through Google Cloud Storage bucket
An insecure bucket was discovered on the GCP platform that had some debug information in it. Steps were taken to secure the bucket and it's contents...
Vimeo: Watch any Password Video without password
Hello Jeremy and Vimeo Security Team, There is a vulnerability in Vimeo which allows any user to watch password video without the password. A user can like a passworded video without password, then the user can watch the video on Couchmode without the password. POC link :...
Vimeo: Downloading password protected / restricted videos
Using: https://vimeo.com/api/atv/clip/VideoID it is possible to get the title, description & download the file regardless on any privacy settings this includes both setting the video to 'Only me' and using a password For proof using my own video: https://vimeo.com/171116158 which has the password...
Vimeo: All Vimeo Private videos disclosure via Authorization Bypass
Hello, There is a vulnerability in https://vimeo.com/VIDEOID?action=share that makes all Vimeo private videos available to anybody. POC link : http://opnsec.com/vimeo/vl/videoLeak.php?video=VIDEOID POC requirements : - No need to be logged in Vimeo - Because of sensitivity of this, I put a passwo...