Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Reflected XSS on https://www.uber.comAnalysed#390386	Valid	No weakness recorded	High	2021-03-15	–	114
Hack The World 2017 Top 2 Bonus#300779	Valid	No weakness recorded	–	2018-11-13	$5,000	61
Publicly exposed HashiCorp Vault (Secrets management) at usec-gcp-staging.uberinternal.com & usec-gcp.uberinternal.comAnalysed#519044	Valid	No weakness recorded	–	2021-08-27	–	43
Full Path and internal information disclosure+ SQLNet.log file disclose internal network informationAnalysed#410187	Valid	No weakness recorded	Low	2020-04-23	–	34
Reflected XSS on Partners SubdomainAnalysed#390181	Valid	No weakness recorded	High	2018-09-16	$2,000	31
Information Leakage - GitHub - VCenter configuration scripts, StorMagic usernames and password along with default ESXi root passwordAnalysed#365199	Valid	No weakness recorded	Medium	2018-08-27	$1,000	29
duplicate hsts headers lead to firefox ignoring hsts on business.uber.comAnalysed#221955	Valid	No weakness recorded	Low	2020-04-30	$500	27
Multiple Vulnerabilities (Including SQLi) in love.uber.com#117080	Duplicate	No weakness recorded	–	2016-06-14	–	18
Session not expired When logout [partners.uber.com]#231041	N/A	No weakness recorded	None	2017-05-26	–	12
Reflected XSS via Unvalidated / Open Redirect in uber.com#125791	Valid	No weakness recorded	–	2016-05-09	$3,000	11
Open Redirect in m.uber.com#125000	Valid	No weakness recorded	–	2016-09-27	$500	9
text injection in get.uber.com/check-otp#126235	Informative	No weakness recorded	–	2016-09-16	–	4
Email Enumeration Vulnerability#143672	Informative	No weakness recorded	–	2016-07-07	–	3
CRLF Injection in developer.uber.com#125984	Duplicate	No weakness recorded	–	2016-05-09	–	3
Error Message on 404 page#145893	Informative	No weakness recorded	–	2016-07-07	–	1
CrashPlan Backup is Vulnerable Allowing to a DoS Attack Against Uber's Backups to ```backup.uber.com```#131560	Duplicate	No weakness recorded	–	2016-05-09	–	1
developer.uber.com/404 and developer.uber.com/docs/404 are susceptible to iframes#130136	Informative	No weakness recorded	–	2016-06-13	–	1

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.