Read the researcher's report on HackerOne
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report. Ask for a correction or removal.
Uber · disclosed report #617543
Arbitrary File Reading on Uber SSL VPN
No analysis yet · $6,500 bounty · 38 votes
No analysis of this report yet. What HackerOne publishes about it is below, with the link to the report.
Read the researcher's report- Program
- Uber
- Status
- Valid
- Severity
- High
- Bounty
- $6,500
- Weakness as filed
- Plaintext Storage of a Password
- Disclosed
- 2021
- CVE 1
- CVE-2019-11508
- CVE 2
- CVE-2019-11510
- CVE 3
- CVE-2019-11538
- CVE 4
- CVE-2019-11539
- CVE 5
- CVE-2019-11540
- CVE 6
- CVE-2019-11542
- Upvotes
- 38
Every one of the 10 is a mark on the map. Named now: 1 to 10, most similar first.
- Attacker can read password from log data
- Storage of old passwords in plain text format
- Mail app stores cleartext password in database until OAUTH2 setup is done
- Password of failed (2FA) login attempt is stored in log
- Local Storage Custom Node Credentials Leak
- Plain text password for 'unknown' user exist in URL when opening jira.apiok.ru
- The password of a mail share is not hashed if the password is given when the share is created
- Github test clientID and clientSecret leaked
- Nextcloud logs ldap passwords
- Plaintext storage of a password on kubernetes release bucket
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.