Browse / Vimeo

Vimeo

See its reports on the map

What gets reported to Vimeo

• Cross-site Scripting17
• Access Control15
• Authentication10
• Misconfiguration8
• Information Disclosure7
• Cross-Site Request Forgery7

Most upvoted reports

AllValidInformativeN/ADuplicate

1. SSRF leaking internal google cloud data through upload function [SSH Keys, etc..]Server-Side Request Forgery (SSRF) · critical
   276 votes
2. Domain pointing to vimeo portfolio are prone to takeover using on-demand.Business Logic Errors · high
   77 votes
3. Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tvImproper Access Control - Generic · high
   76 votes
4. Improper Authentication in Vimeo's API 'versions' endpoint.Improper Authentication - Generic · high
   64 votes
5. Reflected File Download (RFD) in download videomedium
   60 votes
6. Watch any Password Video without passwordInformation Disclosure
   44 votes
7. Downloading password protected / restricted videosImproper Authentication - Generic
   43 votes
8. All Vimeo Private videos disclosure via Authorization BypassInformation Disclosure
   35 votes
9. Make API calls on behalf of another user (CSRF protection bypass)Cross-Site Request Forgery (CSRF)
   33 votes
10. Vimeo.com Insecure Direct Object References Reset PasswordImproper Authentication - Generic
    33 votes
11. OAuth 2 Authorization Bypass via CSRF and Cross Site FlashingCross-Site Request Forgery (CSRF)
    32 votes
12. Disclosure of sensitive information through Google Cloud Storage bucketInformation Disclosure · high
    27 votes
13. XSS on vimeo.com/home after other user follows youCross-site Scripting (XSS) - Generic
    19 votes
14. Images and Subtitles Leakage from private videosInformation Disclosure
    17 votes
15. CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go publicCross-Site Request Forgery (CSRF)
    15 votes
16. URGENT - Subdomain Takeover on status.vimeo.com due to unclaimed domain pointing to statuspage.ioCross-Site Request Forgery (CSRF)
    14 votes
17. Stored XSS on player.vimeo.comCross-site Scripting (XSS) - Generic
    11 votes
18. Securing "Reset password" pages from botsViolation of Secure Design Principles
    11 votes
19. [vimeopro.com] CRLF InjectionCRLF Injection
    10 votes
20. XSS when using captions/subtitles on video player based on Flash (requires user interaction)Cross-site Scripting (XSS) - Generic
    8 votes
21. XSS on vimeo.com | "Search within these results" feature (requires user interaction)Cross-site Scripting (XSS) - Generic
    8 votes
22. API: missing invalidation of OAuth2 Authorization Code during access revocation causes authorization bypassImproper Authentication - Generic
    8 votes
23. Application XSS filter function Bypass may allow Multiple stored XSSCross-site Scripting (XSS) - Generic
    8 votes
24. Adding profile picture to anyone on VimeoViolation of Secure Design Principles
    8 votes
25. XSS on mobile version of vimeo.com where the button "Follow" appearsCross-site Scripting (XSS) - Generic
    7 votes
26. Can message users without the proper authorizationImproper Authentication - Generic
    7 votes
27. Error page Text Injection.DuplicateViolation of Secure Design Principles
    6 votes
28. XSS on player.vimeo.com without user interaction and vimeo.com with user interactionCross-site Scripting (XSS) - Generic
    6 votes
29. Reflected XSS on vimeo.com/musicstoreCross-site Scripting (XSS) - Generic
    6 votes
30. Invite any user to your group without even following himPrivilege Escalation
    6 votes
31. XSS on any site that includes the moogaloop flash player | deprecated embed code Cross-site Scripting (XSS) - Generic
    6 votes
32. Poodle bleed vulnerability in cloud sub domainCryptographic Issues - Generic
    6 votes
33. Insecure Direct Object References that allows to read any comment (even if it should be private)Improper Authentication - Generic
    5 votes
34. Insecure Direct Object References in https://vimeo.com/forumsImproper Authentication - Generic
    5 votes
35. CRITICAL vulnerability - Insecure Direct Object Reference - Unauthorized access to `Videos` of Channel whose privacy is set to `Private`.Privilege Escalation
    5 votes
36. CRITICAL full source code/config disclosure for CameoInformation Disclosure
    5 votes
37. Ability to Download Music Tracks Without Paying (Missing permission check on`/musicstore/download`)Improper Authentication - Generic
    5 votes
38. Misconfigured crossdomain.xml - vimeo.comInformativeCryptographic Issues - Generic
    5 votes
39. XSS in Subtitles of Vimeo Flash Player and Hubnut DuplicateCross-site Scripting (XSS) - Generic
    4 votes
40. Stored XSS on vimeo.com and player.vimeo.comCross-site Scripting (XSS) - Generic
    4 votes
41. subdomain takeover 1511493148.cloud.vimeo.comViolation of Secure Design Principles
    4 votes
42. CSRF bypassInformativeCross-Site Request Forgery (CSRF)
    4 votes
43. unvalid open authentication with facebookImproper Authentication - Generic
    4 votes
44. Buying ondemand videos that 0.1 and sometimes for free Privilege Escalation
    4 votes
45. Missing rate limit on private videos passwordPrivilege Escalation
    3 votes
46. Private, embeddable videos leaks data through Facebook & Open GraphInformation Disclosure
    3 votes
47. A user can post comments on other user's private videosPrivilege Escalation
    3 votes
48. A user can add videos to other user's private groupsPrivilege Escalation
    3 votes
49. A user can edit comments even after video comments are disabledPrivilege Escalation
    3 votes
50. Vimeo + & Vimeo PRO Unautorised Tax bypassImproper Access Control - Generic
    3 votes
51. Brute force on "vimeo" cookieInformativeImproper Authentication - Generic
    3 votes
52. Full account takeover via Add a New Email to account without email verified and without password confirmation.InformativeViolation of Secure Design Principles
    3 votes
53. Vimeo Search - XSS Vulnerability [http://vimeo.com/search]Cross-site Scripting (XSS) - Generic
    3 votes
54. Open Redirection Security Filter bypassedOpen Redirect
    3 votes
55. [URGENT ISSUE] Add or Delete the videos in watch later list of any user .Cross-Site Request Forgery (CSRF)
    2 votes
56. Post in private groups after getting removedPrivilege Escalation
    2 votes
57. A user can enhance their videos with paid tracks without buying the trackPrivilege Escalation
    2 votes
58. Bypassing Email verification InformativeImproper Access Control - Generic
    2 votes
59. XSS on VimeoCross-site Scripting (XSS) - Generic
    2 votes
60. ftp upload of video allows naming that is not sanitized as the manual namingViolation of Secure Design Principles
    2 votes
61. USER PRIVACY VIOLATED (PRIVATE DATA GETTING TRANSFER OVER INSECURE CHANNEL ) InformativeViolation of Secure Design Principles
    2 votes
62. abusing Thumbnails(https://vimeo.com/upload/select_thumb) to see a private videoPrivilege Escalation
    2 votes
63. No Limitation on Following allows user to follow people automatically!Cross-Site Request Forgery (CSRF)
    2 votes
64. profile photo update bypass Privilege Escalation
    2 votes
65. player.vimeo.com - Reflected XSS VulnerabilityCross-site Scripting (XSS) - Generic
    2 votes
66. APIs for channels allow HTML entities that may cause XSS issueCross-site Scripting (XSS) - Generic
    2 votes
67. Legacy API exposes private video titlesInformation Disclosure
    1 votes
68. May cause account take over (Via invitation page)InformativeViolation of Secure Design Principles
    1 votes
69. Share your channel to any user on vimeo without following himPrivilege Escalation
    1 votes
70. Vimeo.com - reflected xss vulnerabilityCross-site Scripting (XSS) - Generic
    1 votes
71. Vimeo.com - Reflected XSS VulnerabilityCross-site Scripting (XSS) - Generic
    1 votes