Bug bounty program

Uber

Platform: HackerOne
Bounties: Pays
Assets in scope: 4
Disclosed reports: 239
Subdomains: 11,395
Vendor on CyberSIXT: Uber (4 CVEs, 0 exploited)

Most upvoted reports239

Most upvoted reports of Uber
Report	Weakness	Disclosed	Bounty	Votes
Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterAnalysed#542340	Information Disclosure	2019-09-09	–	643
[Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoAnalysed#591813	Information Disclosure	2021-02-25	$40,000	458
Chained Bugs to Leak Victim's Uber's FB Oauth TokenAnalysed#202781	Authentication	2019-01-25	–	427
Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sgAnalysed#340431	Cryptography	2020-04-30	$4,000	376
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#1007014	Command and Code Injection	2021-02-24	$9,000	325
Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Analysed#143717	Authentication	2016-07-14	–	312
XSS At "pages.et.uber.com"#156098	Cross-site Scripting	2016-08-19	–	267
Stored XSS in developer.uber.comAnalysed#131450	Cross-site Scripting	2016-06-27	$7,500	223
Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system.Analysed#530441	Access Control	2021-03-06	$4,500	210
Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comAnalysed#219205	Authentication	2017-07-13	–	183

Subdomains11,395

Root

uber.com11,395

Scope

Name suggests

First seen

Text file11,395 names

Subdomains of Uber
Name	Scope	First seen
skyrocket.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sl42.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
slave6.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
slay.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
smartfox.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
smartsheet.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
smola.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
smount-com.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
smtp3-3.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
smtp60.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
soc6.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
solutionproduce.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
song88duchang.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
songszonal.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
songtiyanjinpingtai.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sonofrainbow.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sorrel.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sosp.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sousuoquanxunwang.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
southsea.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
spil.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
spisovka.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sportster.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
spquanxunwang.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
spquanxunwangzhi.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sprntx.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
srls.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
srv94.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
stamp2.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
static-85.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
statusquo.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
stolen-ip.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
stupc.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sturex.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
stylebook.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
submissive.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
suboyulechengbeiyongwang.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
suen.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sugarcrm.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
summercamps.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sunace-biz.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sunlit.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
super5.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
supercat.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
supple.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
suzdal.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sw72.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
sweeney.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
taiguoyoumeiyouduchang.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
taiyangchengdeshipianzima.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
taiyangchengdoudizhudaili.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
taiyuanlaohuji.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
taiyuantiantianyulecheng.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
takatsuki.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
takehairfashion.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tamai-tsuriclub-com.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tangrenjieyulechengaomendubo.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tangrenjieyulechengtouzhu.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tanners.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
taobaogouwuxianjinliquan.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tc.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
te1-8.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tecnica.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
teenstrawberry.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
telco13.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
temp33.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
temppc.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
test.mx.dev.uber.comdev, mail, test	Not in the scope	2026-11-14
testdev.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
thasmokebreak.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
thdqusofv.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
thechicmuse.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
themix.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
thermometer.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
theshield.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
thisistrend-com.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tiancaimajiangshaonvyouxi.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tianchaobocaijiaoliu.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tianmaoyulechengzenyangying.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tianmiaozhenrenyule.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tianyanzuanshi.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tidy.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tigi.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tinashe.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tisg-6.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
titan.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tiyujiaoanmobanxiazai.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tiyutai.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tiyutouzhuwanghuangguan.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tlemybywnhyikxtv.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tmobile.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tns10.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tongshizhismeizi.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tongyingyulecheng.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tp31.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
trainingtest.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
treefrog.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
tricot.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
trusty-co-jp.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14
ts1-4.mx.dev.uber.comdev, mail	Not in the scope	2026-11-14

0 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.