Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| DOM based XSS on#139875 | Informative | Command and Code Injection | – | 2016-05-26 | – | 1 |
| Command Injection, Information#146735 | Informative | Command and Code Injection | – | 2016-07-07 | – | 1 |
| newsroom.uber.com is vulnerable to 'SOME' XSS attack via plupload.flash.swf#150375 | Valid | Command and Code Injection | – | 2016-08-22 | – | 6 |
| Bypassing Uber Partner's 3 Cancel Limit#125218 | Valid | Command and Code Injection | – | 2016-05-26 | $2,000 | 8 |
| Mass Assignment Vulnerability in partners.uber.com#99424 | Valid | Command and Code Injection | – | 2016-05-09 | $1,000 | 10 |
| Privacy policy contains hardcoded link using unencrypted HTTPAnalysed#365755 | Valid | Command and Code Injection | Low | 2018-11-13 | – | 17 |
| Blind OOB XXE At "http://ubermovement.com/"Analysed#154096 | Valid | Command and Code Injection | – | 2016-08-08 | $500 | 56 |
| Pre-auth Remote Code Execution on multiple Uber SSL VPN serversAnalysed#540242 | Valid | Command and Code Injection | Critical | 2021-02-24 | $2,000 | 80 |
| OneLogin authentication bypass on WordPress sites via XMLRPCAnalysed#138869 | Valid | Command and Code Injection | – | 2016-07-15 | $7,000 | 83 |
| uber.com may RCE by Flask Jinja2 Template InjectionAnalysed#125980 | Valid | Command and Code Injection | – | 2016-04-06 | $10,000 | 137 |
| RCE via npm misconfig -- installing internal libraries from the public registryAnalysed#1007014 | Valid | Command and Code Injection | Critical | 2021-02-24 | $9,000 | 325 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.