Vimeo.com - Reflected XSS Vulnerability #42582 Valid Cross-site Scripting – 2015-04-08 – 1 Vimeo.com - reflected xss vulnerability #42584 Valid Cross-site Scripting – 2015-03-09 – 1 Share your channel to any user on vimeo without following him #52708 Valid Access Control – 2015-09-28 – 1 May cause account take over (Via invitation page) #56182 Informative Misconfiguration and Insecure Design – 2015-05-20 – 1 Legacy API exposes private video titles #111386 Valid Information Disclosure – 2016-02-10 – 1 APIs for channels allow HTML entities that may cause XSS issue #42702 Valid Cross-site Scripting – 2015-01-08 – 2 player.vimeo.com - Reflected XSS Vulnerability #43672 Valid Cross-site Scripting – 2015-03-09 – 2 profile photo update bypass #43758 Valid Access Control – 2015-02-17 – 2 No Limitation on Following allows user to follow people automatically! #43846 Valid Cross-Site Request Forgery – 2016-05-02 – 2 abusing Thumbnails(https://vimeo.com/upload/select_thumb) to see a private video #43850 Valid Access Control – 2015-04-03 – 2 USER PRIVACY VIOLATED (PRIVATE DATA GETTING TRANSFER OVER INSECURE CHANNEL ) #44056 Informative Misconfiguration and Insecure Design – 2015-01-20 – 2 ftp upload of video allows naming that is not sanitized as the manual naming #45368 Valid Misconfiguration and Insecure Design – 2015-01-29 – 2 XSS on Vimeo #45484 Valid Cross-site Scripting – 2015-01-29 – 2 Bypassing Email verification #49304 Informative No weakness recorded – 2015-03-29 – 2 A user can enhance their videos with paid tracks without buying the track #50941 Valid Access Control – 2015-10-14 – 2 Post in private groups after getting removed #51817 Valid Access Control – 2015-05-01 – 2 [URGENT ISSUE] Add or Delete the videos in watch later list of any user . #52982 Valid Cross-Site Request Forgery – 2015-05-01 – 2 Open Redirection Security Filter bypassed #44157 Valid Open Redirect – 2015-06-28 – 3 Vimeo Search - XSS Vulnerability [http://vimeo.com/search] #44798 Valid Cross-site Scripting – 2015-01-23 – 3 Full account takeover via Add a New Email to account without email verified and without password confirmation. #45084 Informative Misconfiguration and Insecure Design – 2015-03-06 – 3 Brute force on "vimeo" cookie #46109 Informative Authentication – 2015-02-02 – 3 Vimeo + & Vimeo PRO Unautorised Tax bypass #49561 Valid No weakness recorded – 2015-04-18 – 3 A user can edit comments even after video comments are disabled #50776 Valid Access Control – 2015-03-11 – 3 A user can add videos to other user's private groups #50786 Valid Access Control – 2015-04-23 – 3 A user can post comments on other user's private videos #50829 Valid Access Control – 2015-03-11 – 3 Private, embeddable videos leaks data through Facebook & Open Graph #121919 Valid Information Disclosure – 2016-05-21 – 3 Missing rate limit on private videos password #124564 Valid Access Control – 2016-03-22 – 3 Buying ondemand videos that 0.1 and sometimes for free #43602 Valid Access Control – 2015-02-13 – 4 unvalid open authentication with facebook #44425 Valid Authentication – 2015-01-21 – 4 CSRF bypass #45428 Informative Cross-Site Request Forgery – 2015-01-30 – 4 subdomain takeover 1511493148.cloud.vimeo.com #46954 Valid Misconfiguration and Insecure Design – 2015-03-13 – 4 Stored XSS on vimeo.com and player.vimeo.com #87577 Valid Cross-site Scripting – 2015-11-30 – 4 XSS in Subtitles of Vimeo Flash Player and Hubnut #137023 Duplicate Cross-site Scripting – 2016-09-14 – 4 Misconfigured crossdomain.xml - vimeo.com #43070 Informative Cryptography – 2015-02-09 – 5 Ability to Download Music Tracks Without Paying (Missing permission check on`/musicstore/download`) #43770 Valid Authentication – 2015-03-01 – 5 CRITICAL full source code/config disclosure for Cameo #43998 Valid Information Disclosure – 2015-05-11 – 5 CRITICAL vulnerability - Insecure Direct Object Reference - Unauthorized access to `Videos` of Channel whose privacy is set to `Private`. #45960 Valid Access Control – 2015-03-18 – 5 Insecure Direct Object References in https://vimeo.com/forums #52176 Valid Authentication – 2015-05-04 – 5 Insecure Direct Object References that allows to read any comment (even if it should be private) #52181 Valid Authentication – 2015-05-04 – 5 Poodle bleed vulnerability in cloud sub domain #44202 Valid Cryptography – 2015-03-05 – 6 XSS on any site that includes the moogaloop flash player | deprecated embed code #44512 Valid Cross-site Scripting – 2015-02-22 – 6 Invite any user to your group without even following him #52707 Valid Access Control – 2016-08-25 – 6 Reflected XSS on vimeo.com/musicstore #85615 Valid Cross-site Scripting – 2017-08-31 – 6 XSS on player.vimeo.com without user interaction and vimeo.com with user interaction #96229 Valid Cross-site Scripting – 2017-08-31 – 6 Error page Text Injection. #130914 Duplicate Misconfiguration and Insecure Design – 2016-08-02 – 6 Can message users without the proper authorization #46113 Valid Authentication – 2015-04-01 – 7 XSS on mobile version of vimeo.com where the button "Follow" appears #88088 Valid Cross-site Scripting – 2017-08-31 – 7 Adding profile picture to anyone on Vimeo #43617 Valid Misconfiguration and Insecure Design – 2015-02-26 – 8 Application XSS filter function Bypass may allow Multiple stored XSS #44217 Valid Cross-site Scripting – 2015-06-28 – 8 API: missing invalidation of OAuth2 Authorization Code during access revocation causes authorization bypass #57603 Valid Authentication – 2015-05-31 – 8