stack trace exposed on https://receipts.uber.com/ #204568 Informative Information Disclosure Medium 2021-02-25 – 8 Information Leak - GitHub - Endpoint Configuration Details #378558 Valid Information Disclosure Medium 2018-08-27 – 8 Google Maps API Key Leakage #1321830 Informative Information Disclosure None 2021-09-03 – 8 Open Redirect in m.uber.com #125000 Valid No weakness recorded – 2016-09-27 $500 9 Listing of email addresses of whitelisted business users visible at business.uber.com #125246 Valid Information Disclosure – 2021-02-25 $250 9 SMS URL verification link does not expire on phone number change and lacks rate limiting #200179 Valid Authentication Low 2018-12-19 – 9 Mass Assignment Vulnerability in partners.uber.com #99424 Valid Command and Code Injection – 2016-05-09 $1,000 10 Open Redirect in riders.uber.com #125003 Valid Open Redirect Low 2018-11-20 $500 10 Open redirect on rush.uber.com, business.uber.com, and help.uber.com #126070 Valid Open Redirect Low 2018-11-13 – 10 Bruteforce INVITE codes easy way #144877 Duplicate Misconfiguration and Insecure Design – 2016-07-26 – 10 [IODR] Get business trip via organization id #151470 Valid Authentication – 2016-08-15 $2,000 10 Open Redirection on Uber.com #119236 Valid Open Redirect – 2016-04-22 $500 11 Reflected XSS via Unvalidated / Open Redirect in uber.com #125791 Valid No weakness recorded – 2016-05-09 $3,000 11 XSS in ubermovement.com via editable Google Sheets #193799 Valid Cross-site Scripting Medium 2018-12-19 $2,000 11 Delay of arrears notification allows Riders to take multiple rides without paying #317388 Valid Input Validation and Logic None 2018-11-13 – 11 [usuppliers.uber.com] - Server Side Request Forgery via XXE OOB #448598 Valid Server-Side Request Forgery High 2021-02-25 – 11 Bulk UUID enumeration via invite codes #145150 Valid Information Disclosure – 2016-09-08 – 12 Physical Access to Mobile App Allows Local Attribute Updates without Authentication #165561 Valid Authentication None 2018-12-19 – 12 Session not expired When logout [partners.uber.com] #231041 N/A No weakness recorded None 2017-05-26 – 12 No rate limiting on https://biz.uber.com/confirm allowed an attacker to join arbitrary business.uber.com accounts #281344 Valid Authentication Medium 2018-11-13 – 12 Unsecured Dropwizard Admin Panel on display.uber-adsystem.com exposes sensitive server information #651355 Valid Cryptography Medium 2021-03-15 $500 12 Lack of CNAME/A Record Trimming Pointing Uber Domains to Insecure Non-Uber AWS Instances/Sites #125118 Valid Information Disclosure – 2016-07-13 – 13 Lack of rate limiting on get.uber.com leads to enumeration of promotion codes and estimation of a lower bound on the number of Uber drivers #125200 Valid Information Disclosure – 2016-08-12 $3,000 13 Server version disclosure #149483 Informative Information Disclosure – 2016-07-07 – 13 Request Access for Uber Device Returns Management Platform (https://www.eats-devicereturns.com/request-access/) Bypass Allows Access to PII #1010787 Valid Access Control High 2021-05-14 – 13 Full path disclosure on track.uber.com #125197 Valid Information Disclosure Low 2018-11-20 $100 14 xss vulnerability in http://ubermovement.com/community/daniel #142946 Valid Cross-site Scripting – 2016-07-21 – 14 SMS/Call spamming due to truncated phone number #177551 Valid Authentication Low 2018-11-13 – 14 Access to SQL server of ubergreen.pt through password disclosure from different domain on same IP #439223 Valid Authentication Low 2021-03-15 $750 14 Cookie Bombing cause DOS - businesses.uber.com #847493 Valid Denial of Service Low 2021-02-24 – 14 Exposed Golang Pprof debugger at https://cn-geo1.uber.com/ #1385906 Valid Information Disclosure Low 2022-04-07 – 14 Information regarding trips from other users #127161 Valid Information Disclosure – 2016-07-12 – 15 Missing authorization checks leading to the exposure of ubernihao.com administrator accounts #154762 Valid Information Disclosure – 2016-08-15 – 15 Lack of CSRF protection on uberps.com makes every form vulnerable to CSRF #343120 Valid Cross-Site Request Forgery Medium 2021-03-15 $500 15 Uber employees are sharing information on productforums.google.com #344086 Valid Information Disclosure High 2021-02-25 – 16 Reflected XSS in https://eng.uberinternal.com and https://coeshift.corp.uber.internal/ #354686 Valid Cross-site Scripting Medium 2018-11-13 $500 16 Golang expvar Information Disclosure #1650035 Valid Information Disclosure Low 2022-08-24 – 16 Privacy policy contains hardcoded link using unencrypted HTTP #365755 Valid Command and Code Injection Low 2018-11-13 – 17 Chained vulnerabilities create DOS attack against users on desafio5estrelas.com #624645 Valid Cross-Site Request Forgery Low 2021-03-30 $1,000 17 Multiple Vulnerabilities (Including SQLi) in love.uber.com #117080 Duplicate No weakness recorded – 2016-06-14 – 18 Stored XSS on newsroom.uber.com admin panel / Stream WordPress plugin #127948 Valid Cross-site Scripting – 2016-07-27 $5,000 18 XSS on partners.uber.com due to no user input sanitisation #281283 Valid Cross-site Scripting Low 2018-10-04 $1,000 18 deleting payment profile during active trip puts account into arrears but active trip is temporarily “free” #216373 Valid Input Validation and Logic None 2017-06-28 – 20 Cleartext password exposure allows access to the desafio5estrelas.com admin panel #344566 Valid Cryptography Medium 2021-03-30 $500 20 XSS @ love.uber.com #117068 Valid Cross-site Scripting – 2016-05-07 – 21 Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.com #149679 Valid Access Control – 2016-07-25 – 21 CBC "cut and paste" attack may cause Open Redirect(even XSS) #126203 Valid Cryptography – 2016-08-12 $500 22 Uber Test Report 20220301 #1496297 Valid Input Validation and Logic Medium 2022-03-03 – 22 IDOR on partners.uber.com allows for a driver to override administrator documents #194594 Valid Insecure Direct Object Reference Medium 2018-12-19 – 23 pam-ussh may be tricked into using another logged in user's ssh-agent #204802 Valid Authentication Medium 2017-03-20 – 23