SSRF leaking internal google cloud data through upload function [SSH Keys, etc..] Analysed #549882 Valid Server-Side Request Forgery Critical 2019-12-13 – 276 Domain pointing to vimeo portfolio are prone to takeover using on-demand. Analysed #387307 Valid Input Validation and Logic High 2018-08-27 – 77 Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tv Analysed #452559 Valid Access Control High 2019-07-10 – 76 Improper Authentication in Vimeo's API 'versions' endpoint. Analysed #328724 Valid Authentication High 2018-05-15 – 64 Reflected File Download (RFD) in download video Analysed #378941 Valid No weakness recorded Medium 2019-08-23 – 60 Watch any Password Video without password Analysed #155618 Valid Information Disclosure – 2017-10-18 – 44 Downloading password protected / restricted videos Analysed #145467 Valid No weakness recorded – 2016-09-05 – 43 All Vimeo Private videos disclosure via Authorization Bypass #137502 Valid Information Disclosure – 2016-07-29 – 35 Make API calls on behalf of another user (CSRF protection bypass) #44146 Valid Cross-Site Request Forgery – 2015-01-22 – 33 Vimeo.com Insecure Direct Object References Reset Password #42587 Valid Authentication – 2015-02-26 – 33 OAuth 2 Authorization Bypass via CSRF and Cross Site Flashing #136582 Valid Cross-Site Request Forgery – 2017-10-18 – 32 Disclosure of sensitive information through Google Cloud Storage bucket #176013 Valid Information Disclosure High 2017-09-29 – 27 XSS on vimeo.com/home after other user follows you #87854 Valid Cross-site Scripting – 2017-08-31 – 19 Images and Subtitles Leakage from private videos #136850 Valid Information Disclosure – 2017-10-18 – 17 CSRF on Vimeo via cross site flashing leading to info disclosure and private videos go public #136481 Valid Cross-Site Request Forgery – 2016-07-29 – 15 URGENT - Subdomain Takeover on status.vimeo.com due to unclaimed domain pointing to statuspage.io #49663 Valid Cross-Site Request Forgery – 2015-04-18 – 14 Stored XSS on player.vimeo.com #85488 Valid Cross-site Scripting – 2017-08-31 – 11 Securing "Reset password" pages from bots #43807 Valid Misconfiguration and Insecure Design – 2017-01-31 – 11 [vimeopro.com] CRLF Injection #39181 Valid No weakness recorded – 2016-10-24 – 10 XSS when using captions/subtitles on video player based on Flash (requires user interaction) #88508 Valid Cross-site Scripting – 2017-08-31 – 8 XSS on vimeo.com | "Search within these results" feature (requires user interaction) #88105 Valid Cross-site Scripting – 2017-08-31 – 8 API: missing invalidation of OAuth2 Authorization Code during access revocation causes authorization bypass #57603 Valid Authentication – 2015-05-31 – 8 Application XSS filter function Bypass may allow Multiple stored XSS #44217 Valid Cross-site Scripting – 2015-06-28 – 8 Adding profile picture to anyone on Vimeo #43617 Valid Misconfiguration and Insecure Design – 2015-02-26 – 8 XSS on mobile version of vimeo.com where the button "Follow" appears #88088 Valid Cross-site Scripting – 2017-08-31 – 7 Can message users without the proper authorization #46113 Valid Authentication – 2015-04-01 – 7 XSS on player.vimeo.com without user interaction and vimeo.com with user interaction #96229 Valid Cross-site Scripting – 2017-08-31 – 6 Reflected XSS on vimeo.com/musicstore #85615 Valid Cross-site Scripting – 2017-08-31 – 6 Invite any user to your group without even following him #52707 Valid Access Control – 2016-08-25 – 6 XSS on any site that includes the moogaloop flash player | deprecated embed code #44512 Valid Cross-site Scripting – 2015-02-22 – 6 Poodle bleed vulnerability in cloud sub domain #44202 Valid Cryptography – 2015-03-05 – 6 Insecure Direct Object References that allows to read any comment (even if it should be private) #52181 Valid Authentication – 2015-05-04 – 5 Insecure Direct Object References in https://vimeo.com/forums #52176 Valid Authentication – 2015-05-04 – 5 CRITICAL vulnerability - Insecure Direct Object Reference - Unauthorized access to `Videos` of Channel whose privacy is set to `Private`. #45960 Valid Access Control – 2015-03-18 – 5 CRITICAL full source code/config disclosure for Cameo #43998 Valid Information Disclosure – 2015-05-11 – 5 Ability to Download Music Tracks Without Paying (Missing permission check on`/musicstore/download`) #43770 Valid Authentication – 2015-03-01 – 5 Stored XSS on vimeo.com and player.vimeo.com #87577 Valid Cross-site Scripting – 2015-11-30 – 4 subdomain takeover 1511493148.cloud.vimeo.com #46954 Valid Misconfiguration and Insecure Design – 2015-03-13 – 4 unvalid open authentication with facebook #44425 Valid Authentication – 2015-01-21 – 4 Buying ondemand videos that 0.1 and sometimes for free #43602 Valid Access Control – 2015-02-13 – 4 Missing rate limit on private videos password #124564 Valid Access Control – 2016-03-22 – 3 Private, embeddable videos leaks data through Facebook & Open Graph #121919 Valid Information Disclosure – 2016-05-21 – 3 A user can post comments on other user's private videos #50829 Valid Access Control – 2015-03-11 – 3 A user can add videos to other user's private groups #50786 Valid Access Control – 2015-04-23 – 3 A user can edit comments even after video comments are disabled #50776 Valid Access Control – 2015-03-11 – 3 Vimeo + & Vimeo PRO Unautorised Tax bypass #49561 Valid No weakness recorded – 2015-04-18 – 3 Vimeo Search - XSS Vulnerability [http://vimeo.com/search] #44798 Valid Cross-site Scripting – 2015-01-23 – 3 Open Redirection Security Filter bypassed #44157 Valid Open Redirect – 2015-06-28 – 3 [URGENT ISSUE] Add or Delete the videos in watch later list of any user . #52982 Valid Cross-Site Request Forgery – 2015-05-01 – 2 Post in private groups after getting removed #51817 Valid Access Control – 2015-05-01 – 2