Vimeo: subdomain takeover 1511493148.cloud.vimeo.com

The researcher found a DNS entry pointing to an unused IP address. This was a domain hijacking issue and was resolved by removing the DNS entry...

Vimeo: Can message users without the proper authorization

It shouldn't be possible to send messages to users without following users: You must be following at least one Vimeo member before you can send a private message. To get started, find a friend, family member, or someone with cool videos and click the "Follow" button on their profile page. It's...

Vimeo: Brute force on "vimeo" cookie

I took at "vimeo" cookie "Vimeo authentication token" https://vimeo.com/cookielist And to show approximately my thought process I did : 1. compare two generate values from two different sessions of mine epk9rrdskc70pcdxxmrdmdx7jpcdxxmrdmdx7%2Cpv222v2mfw90w5dcv5wtkmsfffxfsxc2tdruxmcrt...

Vimeo: CRITICAL vulnerability - Insecure Direct Object Reference - Unauthorized access to `Videos` of Channel whose privacy is set to `Private`.

Hello, This time I found a IDORInsecure Direct Object Reference vulnerability. It allows an attacker to get unauthorized access to Videos of Channel whose privacy is set to Only moderators and people I choose without being a member. In simple words, we can access videos of private channel without...

Vimeo: XSS on Vimeo

Poc video: XSS on Vimeo: http://youtu.be/w5QgEEcMARY 1. Go to https://vimeo.com/settings/profile 2. Add a link with the payload on URL: javascript:alertdocument.domain+"http://" 3. Click the link and payload will execute. Thanks @niyaax...

Vimeo: ftp upload of video allows naming that is not sanitized as the manual naming

I have uploaded via ftp Vimeo Pro account a filename """.mp4 And as you can see in the screenshot it is put automatically as the name of the video. But I cannot put this name """.mp4 manually So I think it needs the same sanitization of the name as it's done after the manual editing. Even if the...

Vimeo: Full account takeover via Add a New Email to account without email verified and without password confirmation.

Description : This is especially important if the application is commonly used in shared computers such as cyber cafes or airport terminals Bug : Add a New Email to account without email verified and without password confirmation when the leaves open email ,Leading to the theft of account In less...

Vimeo: Vimeo Search - XSS Vulnerability [http://vimeo.com/search]

I found a XSS vulnerability in Vimeo Search. Keeping it short so that it does not go duplicate. Payload: "onmouseover=alert1 Live Demo: http://vimeo.com/search?q=%22onmouseover%3Dalert%281%29%3E Search @ http://vimeo.com/search with above payload. The culprit here is the Couch Mode feature. After...

Vimeo: unvalid open authentication with facebook

Hi, vimeo site is using facebook for open authentication . The authentication url is in this way https://www.facebook.com/dialog/oauth?clientid=19884028963&redirecturi=https://vimeo.com/facebook/join?ssl=0&iframe=0&popup=0&player=0&productid=0&scope=email,basicinfo,readstream,publishactions&state...

Vimeo: Poodle bleed vulnerability in cloud sub domain

Hello Vimeo team This is Shahmeer and i found out that the Vimeo web application is highly vulnerable to Poodle bleed vulnerability located on this IP 54.235.139.25 In order to scan this properly Go here https://www.poodlescan.com Enter the domain captions.cloud.vimeo.com And it will prompt as...

Vimeo: Make API calls on behalf of another user (CSRF protection bypass)

Hi! Brief I have discovered a way to issue API calls on behalf of other users. The problem stems from the fact that the API playground at https://developer.vimeo.com/api/playground/me has a very weak CSRF protection. The only thing protecting this resource from CSRF attacks is the demand that the...

Vimeo: USER PRIVACY VIOLATED (PRIVATE DATA GETTING TRANSFER OVER INSECURE CHANNEL )

Hello Team , Description : this report is about how a users private data is getting exploded over insecure channel . while testing the iOS App of Vimeo , i am analyzing all the traffics and came to know the video which is uploaded in my account and which privacy setting is private only is getting...

Vimeo: CRITICAL full source code/config disclosure for Cameo

Hi! The server at https://ci.cameo.tv/ has directory listing on and seems to host quiet a few debian packages containing extremely sensitive information database paswords, API keys, you name it. One example is the config package containing 16 config files, even personal ones containing local...

Vimeo: Serious Vulnerability Found

Hello , I have found interesting vulnerability and i hope you will like it and fix it soon because it will really cause damage . I can hijack your email server because there is no protection not even consider spam . kindly check the POC video :...

Vimeo: abusing Thumbnails(https://vimeo.com/upload/select_thumb) to see a private video

https://vimeo.com/upload/selectthumb uri is used set a thumbnails on your vimeo video. https://vimeo.com/upload/selectthumb uri request is compose of 3 parameter clipid, token, and time . clipid parameter is used to select a video you want to get a thumbnail,clipid is a csrf token and time...

Vimeo: No Limitation on Following allows user to follow people automatically!

Hello, i'm not sure it's intentional or somehow you missed it, I noticed that when User follow people on Vimeo, CSRF token of the request doesn't change at all. It's become something like a static code for a single session. ex: POST: https://vimeo.com/user12345 = ID POST CONTENT:...

Vimeo: Securing "Reset password" pages from bots

I found a security issue on your "Reset password" page Google botnets are indexing some of your sensitive pages with tokens of accounts. For this you may like to add: For pages like "resetting your password" need to have this. Vulnerable url:...

Vimeo: Ability to Download Music Tracks Without Paying (Missing permission check on`/musicstore/download`)

Hello, I'm not sure how serious this is to be honest. If you're downloading tracks without paying, then I'm sure you could find a copy somewhere on the internet anyway. But I guess it's still an issue. When browsing the Music Store https://vimeo.com/musicstore, some tracks are free. To download...

Vimeo: profile photo update bypass

hello sir this is N B Sri Harsha again as per vimeo rules , we are not allow to upload photo until we verify our email id i have bypassed it ! steps to reproduce you need to make three requests 1 POST /upload/getimageurl HTTP/1.1 Host: vimeo.com User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64;...

Vimeo: player.vimeo.com - Reflected XSS Vulnerability

Hi. I want to report a reflected xss vulnerability that I found in player.vimeo.com website and which can affect the safety of your users. This vulnerability allows an attacker to inject in web pages javascript content for sending malicious scripts to an unsuspecting user. This flaw can access an...