Vimeo: XSS on vimeo.com | "Search within these results" feature (requires user interaction)

Description When you search in pages such as the videos of some Category or the videos of some User, and you receive more than 0 results, the path of the URL is put in the attribute data-start-page of a element without escaping. This allows to insert another attribute like onmouseover to execute...

Vimeo: XSS on mobile version of vimeo.com where the button "Follow" appears

Description In the mobile version of https://vimeo.com, you will see + Follow buttons in places like the description of a channel, the description of a video, the profile of a user, the list of users you follow and the list of users that other users follow. The problem is that the code that build...

Vimeo: Stored XSS on vimeo.com and player.vimeo.com

Description You can share your uploaded videos using the widget Hubnut. The URL is something like https://player.vimeo.com/hubnut/user/user36690798/uploadedvideos?color=44bbff&background=000000&slideshow=0&videotitle=1&videobyline=1, and I noticed that the same content is loaded for this URL...

Vimeo: Reflected XSS on vimeo.com/musicstore

Description The value of the parameter section is reflected in the Javascript function MusicStoreCommon.initialize without escaping, which allows to insert Javascript code. Proof of concept 1. Go to https://vimeo.com/musicstore?section=%27-alertdocument.domain-%27. 2. alertdocument.domain is...

Vimeo: Stored XSS on player.vimeo.com

Description The page loaded for the Vimeo embedded player prints the Name of the owner of the video in Javascript context. Some characters are escaped, like " but others like , and - if the video is public - any Vimeo user can be affected by the Javascript code that is loaded. However, there is a...

Vimeo: API: missing invalidation of OAuth2 Authorization Code during access revocation causes authorization bypass

OAuth2 API makes it possible for users to grant access to their accounts to some third-side applications. Of course, users are able to manage such applications' access to their accounts and may deny access for any application. When some user denies access for the application, all accesstokens are...

Vimeo: May cause account take over (Via invitation page)

Hello Vimeo Security Team, I just found issue on vimeo.com/tools/invite that may put our vimeo users in riks and here is the details. Problem: All Email Content Spoofing How to reproduce: 1- Go to user settings and change the username to be something like this "Urgent From Vimeo Security Team". 2...

Vimeo: [URGENT ISSUE] Add or Delete the videos in watch later list of any user .

This could be done using vimeo api .I used the access token of IOS vimeo app .An attacker could remotely add and delete the videos in watchlater list of any user with out any permission of user. get the watch later list: GET /users//watchlater/ HTTP/1.1 Host: api.vimeo.com Authorization: Bearer...

Vimeo: Share your channel to any user on vimeo without following him

Hi Team, Hope you are good. Privilege escalation vulnerability exist on the request of sharing your channel to user. You can share your channel to any user without even following him Request : POST /channels/893054 HTTP/1.0 Host: vimeo.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.9;...

Vimeo: Invite any user to your group without even following him

Hi, I can invite any user on vimeo.com to my group without even following him. Request : POST /groups/303339 HTTP/1.0 Host: vimeo.com User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.9; rv:36.0 Gecko/20100101 Firefox/36.0 Accept: text/javascript, text/html, application/xml, text/xml, /...

Vimeo: Insecure Direct Object References that allows to read any comment (even if it should be private)

Dear Vimeo Team, in combination with my previous bug i discovered that it was possible to read any comment on any video even if the video is private: I did a short POC on the Insecure Direct Object Reference. If an attacker wants to exploit this issue he has to know the ID of the comment, which...

Vimeo: Insecure Direct Object References in https://vimeo.com/forums

Insecure Direct Object References Dear Vimeo Team, i recently discovered a bug which allowed me to send comments in the forum in behalf on any user The trick here is to create a comment with your account Post it, and press on Edit : GET...

Vimeo: Post in private groups after getting removed

Steps to reproduce: 1. A uservictim have a private video and he have added it on his private groups. Now the group members can see it and comment to it. 2. The attacker is on the group and he adds a new comment and capture the request using burp proxy. 3. Then the attacker is removed from the gro...

Vimeo: A user can enhance their videos with paid tracks without buying the track

It is possible to enhance videos with paid tracks without buying the track. Steps to verify: 1. Log into vimeo.com and navigate to https://vimeo.com/enhancer. 2. Click on any paid music track and note down the track id from the URL ex:...

Vimeo: A user can post comments on other user's private videos

It is possible for a user to post comments on other's private videos. Steps to verify: 1. Log into www.vimeo.com as Alice and create a video say, AliceVideo with id - 118026546 with 'Allow anyone to see my videos' setting. 2. Login as Bob and create an album say, BobAlbum with album id 3295969. 3...

Vimeo: A user can add videos to other user's private groups

It is possible for a user to add videos to other user's private groups. Steps to verify: 1. Log into vimeo.com as Alice. Create a new group lets say, AlicePrivateGroup with group id 301924 and choose 'Only members can see this group' setting. 2. Login as Bob and create a new group lets say,...

Vimeo: A user can edit comments even after video comments are disabled

A user can escalate privileges and edit his previous comments, when comments are disabled for a video. Steps to verify: 1. Log into vimeo.com as Alice. Upload a video say, video id - 118026546 and allow anyone to leave comments for that video . 2. Login as Bob and navigate to the video URL -...

Vimeo: URGENT - Subdomain Takeover on status.vimeo.com due to unclaimed domain pointing to statuspage.io

Hi, Brief This is an urgent issue and I hope you will act on it likewise. Your subdomain status.vimeo.com is pointing to hosted.statuspage.io, but no statuspage was connected to it. This means that anyone can claim the subdomain by setting up a statuspage.io site and using "status.vimeo.com" as t...

Vimeo: Vimeo + & Vimeo PRO Unautorised Tax bypass

Hello ! I've found a Vuln' which allows to override the taxification applied when buying Vimeo + or Vimeo PRO tested by selecting France as country Comparing data sent when attempting to purchase on demand movie, I noticed a field named "vinTransactiontransactionItems0taxClassification" with the...

Vimeo: Bypassing Email verification

Hi Description : While registering new account on vimeo the email must be verified - A confirmation link sent to the email the user want to register Without verifying user cant do some actions .There is a Bypass for it Steps For Doing PoC : 1.If attacker have already account with verified email I...