Uber · disclosed reports
Information Disclosure
44 disclosed reports · $47,600 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Uber on HackerOne- reports
- 44
- paid a bounty
- 9
Every one of the 44 is a mark on the map. Named now: 1 to 26, most upvoted first.
- Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameter
- [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repo
- Client secret, server tokens for developer applications returned by internal API
- ubernycmarketplace.com is vulnerable to the Heartbleed Bug
- private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") events
- Possibility to get private email using UUID
- Open AWS S3 bucket at ubergreece.s3.amazonaws.com exposes confidential internal documents and files
- Critical Information disclosure of rtapi token for any user via https://video-support-staging.uber.com/video/api/getPopulousUser
- phone number exposure for riders/drivers given email/uuid
- API on campus-vtc.com allows access to ~100 Uber users full names, email addresses and telephone numbers.
- Exposed█████████in apk file - devbuilds.uber.com
- Possible to View Driver Waybill via Driver UUID
- Golang expvar Information Disclosure
- Uber employees are sharing information on productforums.google.com
- Missing authorization checks leading to the exposure of ubernihao.com administrator accounts
- Information regarding trips from other users
- Exposed Golang Pprof debugger at https://cn-geo1.uber.com/
- Full path disclosure on track.uber.com
- Server version disclosure
- Lack of rate limiting on get.uber.com leads to enumeration of promotion codes and estimation of a lower bound on the number of Uber drivers
- Lack of CNAME/A Record Trimming Pointing Uber Domains to Insecure Non-Uber AWS Instances/Sites
- Bulk UUID enumeration via invite codes
- Listing of email addresses of whitelisted business users visible at business.uber.com
- Google Maps API Key Leakage
- Information Leak - GitHub - Endpoint Configuration Details
- stack trace exposed on https://receipts.uber.com/
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.