Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| May cause account take over (Via invitation page)#56182 | Informative | Misconfiguration and Insecure Design | – | 2015-05-20 | – | 1 |
| USER PRIVACY VIOLATED (PRIVATE DATA GETTING TRANSFER OVER INSECURE CHANNEL )#44056 | Informative | Misconfiguration and Insecure Design | – | 2015-01-20 | – | 2 |
| ftp upload of video allows naming that is not sanitized as the manual naming#45368 | Valid | Misconfiguration and Insecure Design | – | 2015-01-29 | – | 2 |
| Full account takeover via Add a New Email to account without email verified and without password confirmation.#45084 | Informative | Misconfiguration and Insecure Design | – | 2015-03-06 | – | 3 |
| subdomain takeover 1511493148.cloud.vimeo.com#46954 | Valid | Misconfiguration and Insecure Design | – | 2015-03-13 | – | 4 |
| Error page Text Injection.#130914 | Duplicate | Misconfiguration and Insecure Design | – | 2016-08-02 | – | 6 |
| Adding profile picture to anyone on Vimeo#43617 | Valid | Misconfiguration and Insecure Design | – | 2015-02-26 | – | 8 |
| Securing "Reset password" pages from bots#43807 | Valid | Misconfiguration and Insecure Design | – | 2017-01-31 | – | 11 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.