Bug bounty program

Uber

Platform: HackerOne
Bounties: Pays
Assets in scope: 4
Disclosed reports: 239
Subdomains: 11,395
Vendor on CyberSIXT: Uber (4 CVEs, 0 exploited)

Most upvoted reports239

Most upvoted reports of Uber
Report	Weakness	Disclosed	Bounty	Votes
Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterAnalysed#542340	Information Disclosure	2019-09-09	–	643
[Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoAnalysed#591813	Information Disclosure	2021-02-25	$40,000	458
Chained Bugs to Leak Victim's Uber's FB Oauth TokenAnalysed#202781	Authentication	2019-01-25	–	427
Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sgAnalysed#340431	Cryptography	2020-04-30	$4,000	376
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#1007014	Command and Code Injection	2021-02-24	$9,000	325
Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Analysed#143717	Authentication	2016-07-14	–	312
XSS At "pages.et.uber.com"#156098	Cross-site Scripting	2016-08-19	–	267
Stored XSS in developer.uber.comAnalysed#131450	Cross-site Scripting	2016-06-27	$7,500	223
Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system.Analysed#530441	Access Control	2021-03-06	$4,500	210
Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comAnalysed#219205	Authentication	2017-07-13	–	183

Subdomains11,395

Root

uber.com11,395

Scope

Name suggests

First seen

Text file11,395 names

Subdomains of Uber
Name	Scope	First seen
rdsqboo.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
realty1.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rechner11.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
redbluff.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
redesulempresas.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
redred.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
reminisce.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
remotemail.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
render05.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
repent.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
resource1.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
restaurace.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rev14.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
reverso1.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
revistaialimentos.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rgc3.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rijssen.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rip3.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rjzqduhnzsaclv.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rlawngus71.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
robo74.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rodney-carrington.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rojukiss.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rokusetsu-com.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rom-nintendods.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
romaniadindiaspora.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
roomenvy.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
roori2.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rosin.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
roslin.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rtmp1.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
ruhezaiwangshangdubo.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rundle.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
ruyifangduboyulecheng.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
ryd.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
rzv.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
saderbank.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
saiyou55-com.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sanguolabajiguilv.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sapsupport.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sariyer.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sars.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sato.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
saudi-arabia-r.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sbylhz.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
scarab.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sda.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sdis.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
secure25.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
seek.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
seniales.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
seppblatterwithblackpeople.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
serv0.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
serv42.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
server80.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sexpettite.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sfv.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sgd.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shanghaitiyuyingchaozhibo.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shangraoshishicaijiqiao.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shariselips.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shenboyulezhuwangzhan.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shengda69qipaiyouxi.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shengdachuanqiwanjie.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shengjuejingpinchuanqi.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shengxiaotianshu.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shijiebeipankoufenxi.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shijiesandazuqiubocaigongsi.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shikuangzuqiu10anjian.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shikuangzuqiu8zhuanhuijiqiao.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shikuangzuqiuguanfangluntan.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shisanzhangzhenrenyulecheng.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shishicaihouer8majiqiao.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shishicaihuangguanwangkaihu.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shishicaishashiwei.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shishicaishimeshizusan.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shishicaitouzhuzhan.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shishicaituanduijihuakekaobu.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shishicaizenmesuanzhongjiang.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shishicaizhongsanzoushitu.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shishicaizuobiruanjian.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shoujidezhoupukepai.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shuangseqiucaijingwang.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shuangseqiucaipiaojisuanqi.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shuiguolaohujishangfenqi.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shuiyoubocaidewangzhan.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
shuozhoushishicaizoushitu.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sichuanshengfulicaipiao.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sigurd.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
simane.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
simonova.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sinco.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sip.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sip00.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
site4u.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
siteunavailable.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sjb.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sk2baijiale.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
skarml.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
skrivebord.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14

0 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.