Browse / Vimeo

Vimeo

See its reports on the map

What gets reported to Vimeo

• Cross-site Scripting17
• Access Control15
• Authentication10
• Misconfiguration8
• Information Disclosure7
• Cross-Site Request Forgery7

Most upvoted reports

AllValidInformativeN/ADuplicate

1. SSRF leaking internal google cloud data through upload function [SSH Keys, etc..]Server-Side Request Forgery (SSRF) · critical
   276 votes
2. Domain pointing to vimeo portfolio are prone to takeover using on-demand.Business Logic Errors · high
   77 votes
3. Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tvImproper Access Control - Generic · high
   76 votes
4. Improper Authentication in Vimeo's API 'versions' endpoint.Improper Authentication - Generic · high
   64 votes
5. Reflected File Download (RFD) in download videomedium
   60 votes
6. Watch any Password Video without passwordInformation Disclosure
   44 votes
7. Downloading password protected / restricted videosImproper Authentication - Generic
   43 votes
8. All Vimeo Private videos disclosure via Authorization BypassInformation Disclosure
   35 votes
9. Make API calls on behalf of another user (CSRF protection bypass)Cross-Site Request Forgery (CSRF)
   33 votes
10. Vimeo.com Insecure Direct Object References Reset PasswordImproper Authentication - Generic
    33 votes
11. OAuth 2 Authorization Bypass via CSRF and Cross Site FlashingCross-Site Request Forgery (CSRF)
    32 votes
12. Disclosure of sensitive information through Google Cloud Storage bucketInformation Disclosure · high
    27 votes
13. XSS on vimeo.com/home after other user follows youCross-site Scripting (XSS) - Generic
    19 votes
14. Images and Subtitles Leakage from private videosInformation Disclosure
    17 votes
15. CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go publicCross-Site Request Forgery (CSRF)
    15 votes
16. URGENT - Subdomain Takeover on status.vimeo.com due to unclaimed domain pointing to statuspage.ioCross-Site Request Forgery (CSRF)
    14 votes
17. Stored XSS on player.vimeo.comCross-site Scripting (XSS) - Generic
    11 votes
18. Securing "Reset password" pages from botsViolation of Secure Design Principles
    11 votes
19. [vimeopro.com] CRLF InjectionCRLF Injection
    10 votes
20. XSS when using captions/subtitles on video player based on Flash (requires user interaction)Cross-site Scripting (XSS) - Generic
    8 votes
21. XSS on vimeo.com | "Search within these results" feature (requires user interaction)Cross-site Scripting (XSS) - Generic
    8 votes
22. API: missing invalidation of OAuth2 Authorization Code during access revocation causes authorization bypassImproper Authentication - Generic
    8 votes
23. Application XSS filter function Bypass may allow Multiple stored XSSCross-site Scripting (XSS) - Generic
    8 votes
24. Adding profile picture to anyone on VimeoViolation of Secure Design Principles
    8 votes
25. XSS on mobile version of vimeo.com where the button "Follow" appearsCross-site Scripting (XSS) - Generic
    7 votes
26. Can message users without the proper authorizationImproper Authentication - Generic
    7 votes
27. XSS on player.vimeo.com without user interaction and vimeo.com with user interactionCross-site Scripting (XSS) - Generic
    6 votes
28. Reflected XSS on vimeo.com/musicstoreCross-site Scripting (XSS) - Generic
    6 votes
29. Invite any user to your group without even following himPrivilege Escalation
    6 votes
30. XSS on any site that includes the moogaloop flash player | deprecated embed code Cross-site Scripting (XSS) - Generic
    6 votes
31. Poodle bleed vulnerability in cloud sub domainCryptographic Issues - Generic
    6 votes
32. Insecure Direct Object References that allows to read any comment (even if it should be private)Improper Authentication - Generic
    5 votes
33. Insecure Direct Object References in https://vimeo.com/forumsImproper Authentication - Generic
    5 votes
34. CRITICAL vulnerability - Insecure Direct Object Reference - Unauthorized access to `Videos` of Channel whose privacy is set to `Private`.Privilege Escalation
    5 votes
35. CRITICAL full source code/config disclosure for CameoInformation Disclosure
    5 votes
36. Ability to Download Music Tracks Without Paying (Missing permission check on`/musicstore/download`)Improper Authentication - Generic
    5 votes
37. Stored XSS on vimeo.com and player.vimeo.comCross-site Scripting (XSS) - Generic
    4 votes
38. subdomain takeover 1511493148.cloud.vimeo.comViolation of Secure Design Principles
    4 votes
39. unvalid open authentication with facebookImproper Authentication - Generic
    4 votes
40. Buying ondemand videos that 0.1 and sometimes for free Privilege Escalation
    4 votes
41. Missing rate limit on private videos passwordPrivilege Escalation
    3 votes
42. Private, embeddable videos leaks data through Facebook & Open GraphInformation Disclosure
    3 votes
43. A user can post comments on other user's private videosPrivilege Escalation
    3 votes
44. A user can add videos to other user's private groupsPrivilege Escalation
    3 votes
45. A user can edit comments even after video comments are disabledPrivilege Escalation
    3 votes
46. Vimeo + & Vimeo PRO Unautorised Tax bypassImproper Access Control - Generic
    3 votes
47. Vimeo Search - XSS Vulnerability [http://vimeo.com/search]Cross-site Scripting (XSS) - Generic
    3 votes
48. Open Redirection Security Filter bypassedOpen Redirect
    3 votes
49. [URGENT ISSUE] Add or Delete the videos in watch later list of any user .Cross-Site Request Forgery (CSRF)
    2 votes
50. Post in private groups after getting removedPrivilege Escalation
    2 votes
51. A user can enhance their videos with paid tracks without buying the trackPrivilege Escalation
    2 votes
52. XSS on VimeoCross-site Scripting (XSS) - Generic
    2 votes
53. ftp upload of video allows naming that is not sanitized as the manual namingViolation of Secure Design Principles
    2 votes
54. abusing Thumbnails(https://vimeo.com/upload/select_thumb) to see a private videoPrivilege Escalation
    2 votes
55. No Limitation on Following allows user to follow people automatically!Cross-Site Request Forgery (CSRF)
    2 votes
56. profile photo update bypass Privilege Escalation
    2 votes
57. player.vimeo.com - Reflected XSS VulnerabilityCross-site Scripting (XSS) - Generic
    2 votes
58. APIs for channels allow HTML entities that may cause XSS issueCross-site Scripting (XSS) - Generic
    2 votes
59. Legacy API exposes private video titlesInformation Disclosure
    1 votes
60. Share your channel to any user on vimeo without following himPrivilege Escalation
    1 votes
61. Vimeo.com - reflected xss vulnerabilityCross-site Scripting (XSS) - Generic
    1 votes
62. Vimeo.com - Reflected XSS VulnerabilityCross-site Scripting (XSS) - Generic
    1 votes