241 matches found
Video Gallery - Vimeo and YouTube Gallery < 1.1.5 - Admin+ Stored Cross-Site Scripting
The plugin does not escape the Title and Description of the videos in a gallery before outputting them in attributes, leading to Stored Cross-Site Scripting issues PoC Add the following payload in the Title or Description of a Video added in a List/Gallery: "onmouseover=alert/XSS/// Then view the...
Information Leakage Vulnerability in WEB Network Management System of Shenzhen WML Technology Co.
Ltd. is a professional provider of total network solutions and smart home solutions. There is an information leakage vulnerability in the WEB network management system of Shenzhen WML Technology Co., Ltd, which can be exploited by attackers to obtain sensitive information...
vimeo-download.com Cross Site Scripting vulnerability OBB-1288434
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Identifying a Person Based on a Photo, LinkedIn and Etsy Profiles, and Other Internet Bread Crumbs
Interesting story of how the police can identify someone by following the evidence chain from website to website. According to filings in Blumenthal's case, FBI agents had little more to go on when they started their investigation than the news helicopter footage of the woman setting the police c...
Lazysizes Cross-Site Scripting Vulnerability
lazysizes is a lightweight inert loader. It is mainly used for delayed loading of content such as images, iframes and scripts. A security vulnerability exists in lazysizes 5.2.0 and earlier versions, which stems from the program's failure to clean up the following attributes: data-vimeo,...
CVE-2020-7642
lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...
Cross-site Scripting (XSS)
Overview lazysizes is a fast jank-free, SEO-friendly and self-initializing lazyloader for images including responsive images picture/srcset, iframes, scripts/widgets and much more. It also prioritizes resources by differentiating between crucial in view and near view elements to make perceived...
ACCESS Act might improve data privacy through interoperability
Data privacy is back in Congressional lawmakers’ sights, as a new, legislative proposal focuses not on data collection, storage, and selling, but on the idea that Americans should be able to more easily pack up their user data and take it to a competing service—perhaps one that better respects...
Vimeo Slapped With Lawsuit Over Biometrics Privacy Policy
Vimeo, the popular ad-free video platform, is facing a lawsuit that alleges it stored people’s facial biometrics without their consent or knowledge. The lawsuit, which was filed on Sept. 20, claims Vimeo violated the Illinois Biometrics Information Privacy Act BIPA. This is a law that imposes...
openSUSE: Security Advisory for vlc (openSUSE-SU-2019:1909-1)
The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Vimeo: SSRF leaking internal google cloud data through upload function [SSH Keys, etc..]
Using our upload feature, the user was able to force an SSRF to occur. For more information you can read my writeup: https://medium.com/@dPhoeniixx/vimeo-upload-function-ssrf-7466d8630437...
Top 10 Best Anime Movie Sites 2019
By Zehra Ali Are you a fan of anime movies? Look no further, here is a list of best anime movie sites. Entertainment is a major part of our lives and the Internet is the biggest source for it these days. There are several websites such as YouTube, DailyMotion, and Vimeo, etc. offering movies and ...
Joomla HWDVideoShare 1.5 Bypass / Database Disclosure / SQL Injection
Exploit Title : Joomla HWDVideoShare Components 1.5 SQL Injection / Database Disclosure / Incorrect Authorization Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 30/01/2019 Vendor Homepage : joomla.org hwdmediashare.co.uk Software Download Link :...
Weak Password Vulnerability in Vimeo Interactive Website Management System
Chengdu Vimeo Interactive Network Technology Co., Ltd. is a technology company whose main products or services are all kinds of website construction, space domain name. Weak password vulnerability exists in the website management system of Weimei Interactive, which can be exploited by attackers t...
Denial of Service in Online Media Asset Handling
Online Media Asset Handling .youtube and .vimeo files in the TYPO3 backend is vulnerable to denial of service. Putting large files with according file extensions results in high consumption of system resources. This can lead to exceeding limits of the current PHP process which results in a...
Cross-Site Scripting in Online Media Asset Rendering
Failing to properly encode user input, online media asset rendering .youtube and .vimeo files is vulnerable to cross-site scripting. A valid backend user account or write access on the server system e.g. SFTP is needed in order to exploit this vulnerability...
Vimeo: Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tv
By modifying the Content-Type to be blank, during a PUT command, the researcher was able to upload files to the CDN. This has been resolved. It was possible to write and overwrite arbitrary files to the CDN vpe.cdn.vimeo.tv used for JS scripts delivery on the various in-scope assets using the PUT...
Argus Surveillance DVR 4.0.0.0 Directory Traversal Vulnerability
Exploit for cgi platform in category web applications + Credits: John Page aka hyp3rlinx + Source: http://hyp3rlinx.altervista.org/advisories/ARGUS-SURVEILLANCE-DVR-v4-UNAUTHENTICATED-PATH-TRAVERSAL-FILE-DISCLOSURE.txt + ISR: Apparition Security Greetz: Greetz: indoushka | Eduardo | GGA Vendor...
Vimeo: Domain pointing to vimeo portfolio are prone to takeover using on-demand.
We thank @bugdiscloseguys for finding this issue. We were only checking \ on-demand to on-demand, but not on-demand to portfolio. Vimeo offers service for pro users to add custom domain under portfolios so that portfolios can be hosted on your subDomain, However Vimeo offers same feature for...