Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
71 of 15,219 reports · 227 analysed so far
- #549882ValidAnalysedSSRF leaking internal google cloud data through upload function [SSH Keys, etc..]Vimeo · Server-Side Request Forgery · 2019 · needs: not clear from the report · SSRF–276votes
- #387307ValidDomain pointing to vimeo portfolio are prone to takeover using on-demand.Vimeo · Input Validation and Logic · 2018–77votes
- #452559ValidPossibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tvVimeo · Access Control · 2019–76votes
- #328724ValidImproper Authentication in Vimeo's API 'versions' endpoint.Vimeo · Authentication · 2018–64votes
- #378941ValidReflected File Download (RFD) in download videoVimeo · No weakness recorded · 2019–60votes
- #155618ValidWatch any Password Video without passwordVimeo · Information Disclosure · 2017–44votes
- #145467ValidDownloading password protected / restricted videosVimeo · No weakness recorded · 2016–43votes
- #137502ValidAll Vimeo Private videos disclosure via Authorization BypassVimeo · Information Disclosure · 2016–35votes
- #44146ValidMake API calls on behalf of another user (CSRF protection bypass)Vimeo · Cross-Site Request Forgery · 2015–33votes
- #42587ValidVimeo.com Insecure Direct Object References Reset PasswordVimeo · Authentication · 2015–33votes
- #136582ValidOAuth 2 Authorization Bypass via CSRF and Cross Site FlashingVimeo · Cross-Site Request Forgery · 2017–32votes
- #176013ValidDisclosure of sensitive information through Google Cloud Storage bucketVimeo · Information Disclosure · 2017–27votes
- #87854ValidXSS on vimeo.com/home after other user follows youVimeo · Cross-site Scripting · 2017–19votes
- #136850ValidImages and Subtitles Leakage from private videosVimeo · Information Disclosure · 2017–17votes
- #136481ValidCSRF on Vimeo via cross site flashing leading to info disclosure and private videos go publicVimeo · Cross-Site Request Forgery · 2016–15votes
- #49663ValidURGENT - Subdomain Takeover on status.vimeo.com due to unclaimed domain pointing to statuspage.ioVimeo · Cross-Site Request Forgery · 2015–14votes
- #85488ValidStored XSS on player.vimeo.comVimeo · Cross-site Scripting · 2017–11votes
- #43807ValidSecuring "Reset password" pages from botsVimeo · Misconfiguration and Insecure Design · 2017–11votes
- #39181Valid[vimeopro.com] CRLF InjectionVimeo · No weakness recorded · 2016–10votes
- #88508ValidXSS when using captions/subtitles on video player based on Flash (requires user interaction)Vimeo · Cross-site Scripting · 2017–8votes
- #88105ValidXSS on vimeo.com | "Search within these results" feature (requires user interaction)Vimeo · Cross-site Scripting · 2017–8votes
- #57603ValidAPI: missing invalidation of OAuth2 Authorization Code during access revocation causes authorization bypassVimeo · Authentication · 2015–8votes
- #44217ValidApplication XSS filter function Bypass may allow Multiple stored XSSVimeo · Cross-site Scripting · 2015–8votes
- #43617ValidAdding profile picture to anyone on VimeoVimeo · Misconfiguration and Insecure Design · 2015–8votes
- #88088ValidXSS on mobile version of vimeo.com where the button "Follow" appearsVimeo · Cross-site Scripting · 2017–7votes
- #46113ValidCan message users without the proper authorizationVimeo · Authentication · 2015–7votes
- #130914DuplicateError page Text Injection.Vimeo · Misconfiguration and Insecure Design · 2016–6votes
- #96229ValidXSS on player.vimeo.com without user interaction and vimeo.com with user interactionVimeo · Cross-site Scripting · 2017–6votes
- #85615ValidReflected XSS on vimeo.com/musicstoreVimeo · Cross-site Scripting · 2017–6votes
- #52707ValidInvite any user to your group without even following himVimeo · Access Control · 2016–6votes
- #44512ValidXSS on any site that includes the moogaloop flash player | deprecated embed codeVimeo · Cross-site Scripting · 2015–6votes
- #44202ValidPoodle bleed vulnerability in cloud sub domainVimeo · Cryptography · 2015–6votes
- #52181ValidInsecure Direct Object References that allows to read any comment (even if it should be private)Vimeo · Authentication · 2015–5votes
- #52176ValidInsecure Direct Object References in https://vimeo.com/forumsVimeo · Authentication · 2015–5votes
- #45960ValidCRITICAL vulnerability - Insecure Direct Object Reference - Unauthorized access to `Videos` of Channel whose privacy is set to `Private`.Vimeo · Access Control · 2015–5votes
- #43998ValidCRITICAL full source code/config disclosure for CameoVimeo · Information Disclosure · 2015–5votes
- #43770ValidAbility to Download Music Tracks Without Paying (Missing permission check on`/musicstore/download`)Vimeo · Authentication · 2015–5votes
- #43070InformativeMisconfigured crossdomain.xml - vimeo.comVimeo · Cryptography · 2015–5votes
- #137023DuplicateXSS in Subtitles of Vimeo Flash Player and HubnutVimeo · Cross-site Scripting · 2016–4votes
- #87577ValidStored XSS on vimeo.com and player.vimeo.comVimeo · Cross-site Scripting · 2015–4votes
- #46954Validsubdomain takeover 1511493148.cloud.vimeo.comVimeo · Misconfiguration and Insecure Design · 2015–4votes
- #45428InformativeCSRF bypassVimeo · Cross-Site Request Forgery · 2015–4votes
- #44425Validunvalid open authentication with facebookVimeo · Authentication · 2015–4votes
- #43602ValidBuying ondemand videos that 0.1 and sometimes for freeVimeo · Access Control · 2015–4votes
- #124564ValidMissing rate limit on private videos passwordVimeo · Access Control · 2016–3votes
- #121919ValidPrivate, embeddable videos leaks data through Facebook & Open GraphVimeo · Information Disclosure · 2016–3votes
- #50829ValidA user can post comments on other user's private videosVimeo · Access Control · 2015–3votes
- #50786ValidA user can add videos to other user's private groupsVimeo · Access Control · 2015–3votes
- #50776ValidA user can edit comments even after video comments are disabledVimeo · Access Control · 2015–3votes
- #49561ValidVimeo + & Vimeo PRO Unautorised Tax bypassVimeo · No weakness recorded · 2015–3votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.