Skip to content
Connect AISign inSign up free

Bug bounty program

UB

Uber

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
4
Disclosed reports
239
Subdomains
11,395
Vendor on CyberSIXT
Uber (4 CVEs, 0 exploited)

Most upvoted reports239

All reports
Most upvoted reports of Uber
ReportWeaknessDisclosedBountyVotes
Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterAnalysed#542340Information Disclosure2019-09-09–643
[Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoAnalysed#591813Information Disclosure2021-02-25$40,000458
Chained Bugs to Leak Victim's Uber's FB Oauth TokenAnalysed#202781Authentication2019-01-25–427
Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sgAnalysed#340431Cryptography2020-04-30$4,000376
RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#1007014Command and Code Injection2021-02-24$9,000325
Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Analysed#143717Authentication2016-07-14–312
XSS At "pages.et.uber.com"#156098Cross-site Scripting2016-08-19–267
Stored XSS in developer.uber.comAnalysed#131450Cross-site Scripting2016-06-27$7,500223
Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system.Analysed#530441Access Control2021-03-06$4,500210
Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comAnalysed#219205Authentication2017-07-13–183

Subdomains11,395

Root
Scope
Name suggests
First seen
Text file11,395 names
Subdomains of Uber
NameScopeFirst seen
tom-2.dev.uber.comdevNot in the scope2026-11-14
tom0.dev.uber.comdevNot in the scope2026-11-14
tom2.dev.uber.comdevNot in the scope2026-11-14
toolbox.dev.uber.comdevNot in the scope2026-11-14
topsecretnsadocuments.dev.uber.comdevNot in the scope2026-11-14
tor.dev.uber.comdevNot in the scope2026-11-14
tor-dispatch.dev.uber.comdevNot in the scope2026-11-14
tor-ec2.dev.uber.comdevNot in the scope2026-11-14
tor-fraud-tools.dev.uber.comdevNot in the scope2026-11-14
tor0.dev.uber.comdevNot in the scope2026-11-14
tor3.dev.uber.comdevNot in the scope2026-11-14
tors-dont-touch.dev.uber.comdevNot in the scope2026-11-14
toyota-6000-8.dev.uber.comdevNot in the scope2026-11-14
toyota-acclaim-1.dev.uber.comdevNot in the scope2026-11-14
toyota-achieva-9.dev.uber.comdevNot in the scope2026-11-14
toyota-aerio-5.dev.uber.comdevNot in the scope2026-11-14
toyota-arnage-2.dev.uber.comdevNot in the scope2026-11-14
toyota-beetle-6.dev.uber.comdevNot in the scope2026-11-14
toyota-corsica-6.dev.uber.comdevNot in the scope2026-11-14
toyota-enclave-7.dev.uber.comdevNot in the scope2026-11-14
toyota-escalade-4.dev.uber.comdevNot in the scope2026-11-14
toyota-escort-9.dev.uber.comdevNot in the scope2026-11-14
toyota-evolution-3.dev.uber.comdevNot in the scope2026-11-14
toyota-f430-spider-8.dev.uber.comdevNot in the scope2026-11-14
toyota-frontier-4.dev.uber.comdevNot in the scope2026-11-14
toyota-genesis-7.dev.uber.comdevNot in the scope2026-11-14
toyota-golf-iii-10.dev.uber.comdevNot in the scope2026-11-14
toyota-karif-7.dev.uber.comdevNot in the scope2026-11-14
toyota-mariner-6.dev.uber.comdevNot in the scope2026-11-14
toyota-parkavenue-9.dev.uber.comdevNot in the scope2026-11-14
toyota-pathfinder-6.dev.uber.comdevNot in the scope2026-11-14
toyota-peacemaker-6.dev.uber.comdevNot in the scope2026-11-14
toyota-quantum-7.dev.uber.comdevNot in the scope2026-11-14
toyota-ram-3500-9.dev.uber.comdevNot in the scope2026-11-14
toyota-rapide-2.dev.uber.comdevNot in the scope2026-11-14
toyota-reliant-9.dev.uber.comdevNot in the scope2026-11-14
toyota-rl-2.dev.uber.comdevNot in the scope2026-11-14
toyota-sparrow-4.dev.uber.comdevNot in the scope2026-11-14
toyota-special-1.dev.uber.comdevNot in the scope2026-11-14
toyota-srx-2.dev.uber.comdevNot in the scope2026-11-14
toyota-sterling-2.dev.uber.comdevNot in the scope2026-11-14
toyota-tank-2.dev.uber.comdevNot in the scope2026-11-14
toyota-tracer-8.dev.uber.comdevNot in the scope2026-11-14
toyota-tracker-9.dev.uber.comdevNot in the scope2026-11-14
toyota-versa-2.dev.uber.comdevNot in the scope2026-11-14
toyota-vigor-6.dev.uber.comdevNot in the scope2026-11-14
toyota-windstar-3.dev.uber.comdevNot in the scope2026-11-14
toyota-xk-1.dev.uber.comdevNot in the scope2026-11-14
tpeng.dev.uber.comdevNot in the scope2026-11-14
tperrien.dev.uber.comdevNot in the scope2026-11-14
tprouty.dev.uber.comdevNot in the scope2026-11-14
tr-ams-golden.dev.uber.comdevNot in the scope2026-11-14
tracy.dev.uber.comdevNot in the scope2026-11-14
tran.dev.uber.comdevNot in the scope2026-11-14
tran0.dev.uber.comdevNot in the scope2026-11-14
tran1.dev.uber.comdevNot in the scope2026-11-14
transformer.dev.uber.comdevNot in the scope2026-11-14
transformer2.dev.uber.comdevNot in the scope2026-11-14
trev.dev.uber.comdevNot in the scope2026-11-14
trev1.dev.uber.comdevNot in the scope2026-11-14
trev2.dev.uber.comdevNot in the scope2026-11-14
trev3.dev.uber.comdevNot in the scope2026-11-14
trevino.dev.uber.comdevNot in the scope2026-11-14
trevino1.dev.uber.comdevNot in the scope2026-11-14
trevino3.dev.uber.comdevNot in the scope2026-11-14
trevino4.dev.uber.comdevNot in the scope2026-11-14
trevinobe.dev.uber.comdevNot in the scope2026-11-14
trevv.dev.uber.comdevNot in the scope2026-11-14
triceratops.dev.uber.comdevNot in the scope2026-11-14
trifle.dev.uber.comdevNot in the scope2026-11-14
trifle1.dev.uber.comdevNot in the scope2026-11-14
triforce.dev.uber.comdevNot in the scope2026-11-14
tripindex.dev.uber.comdevNot in the scope2026-11-14
tristan.dev.uber.comdevNot in the scope2026-11-14
truber.dev.uber.comdevNot in the scope2026-11-14
tsageser.dev.uber.comdevNot in the scope2026-11-14
tsc.dev.uber.comdevNot in the scope2026-11-14
tsc2.dev.uber.comdevNot in the scope2026-11-14
tsc3.dev.uber.comdevNot in the scope2026-11-14
tsc4.dev.uber.comdevNot in the scope2026-11-14
tsifleet.dev.uber.comdevNot in the scope2026-11-14
tugrul-dev.dev.uber.comdevNot in the scope2026-11-14
tullie3.dev.uber.comdevNot in the scope2026-11-14
tunay.dev.uber.comdevNot in the scope2026-11-14
tunaydev.dev.uber.comdevNot in the scope2026-11-14
tungwaiyip.dev.uber.comdevNot in the scope2026-11-14
turbo.dev.uber.comdevNot in the scope2026-11-14
turing.dev.uber.comdevNot in the scope2026-11-14
twexler.dev.uber.comdevNot in the scope2026-11-14
twexler-clusto.dev.uber.comdevNot in the scope2026-11-14
twexler-data.dev.uber.comdevNot in the scope2026-11-14
twexler1.dev.uber.comdevNot in the scope2026-11-14
tws.dev.uber.comdevNot in the scope2026-11-14
tws-iphone.dev.uber.comdevNot in the scope2026-11-14
tws-iphone-2.dev.uber.comdevNot in the scope2026-11-14
tws-toolshed.dev.uber.comdevNot in the scope2026-11-14
tws-toolshed-3.dev.uber.comdevNot in the scope2026-11-14
tws-toolshed2.dev.uber.comdevNot in the scope2026-11-14
tws-workation.dev.uber.comdevNot in the scope2026-11-14
tws-workation-2.dev.uber.comdevNot in the scope2026-11-14

0 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated