Possibility to enumerate and bruteforce promotion codes in Uber iOS App #125707 Valid Authentication Medium 2018-11-20 $3,000 24 Possible to View Driver Waybill via Driver UUID #127087 Valid Information Disclosure – 2016-06-14 – 24 Get organization info base on uuid Analysed #151465 Valid Authentication – 2016-09-02 $3,000 26 duplicate hsts headers lead to firefox ignoring hsts on business.uber.com Analysed #221955 Valid No weakness recorded Low 2020-04-30 $500 27 IDOR in activateFuelCard id allows bulk lookup of driver uuids Analysed #254151 Valid Insecure Direct Object Reference Low 2019-01-25 – 28 Exposed█████████in apk file - devbuilds.uber.com Analysed #848905 Valid Information Disclosure High 2021-04-09 – 28 Outdated Wordpress installation and plugins at www.uberxgermany.com create CSRF and XSS vulnerabilities Analysed #323899 Valid Cross-Site Request Forgery Medium 2021-02-25 $500 29 Improper Access Control on Onelogin in multi-layered architecture Analysed #326080 Valid Access Control – 2018-08-08 $500 29 Information Leakage - GitHub - VCenter configuration scripts, StorMagic usernames and password along with default ESXi root password Analysed #365199 Valid No weakness recorded Medium 2018-08-27 $1,000 29 SQLI on desafio5estrelas.com Analysed #476150 Valid SQL Injection Medium 2021-03-29 $2,500 29 Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employees Analysed #1063022 Valid Access Control Medium 2021-05-14 – 29 4 Subdomains Takeover on 2 domains ( muberscolombia.com & ubereats.pl ) Analysed #1116545 Valid Access Control Medium 2021-04-29 $500 29 Site-wide CSRF on eats.uber.com Analysed #161529 Valid Cross-Site Request Forgery High 2018-12-19 – 30 Subdomain takeover on mta1a1.spmail.uber.com Analysed #707748 Valid Access Control Medium 2020-04-06 – 30 Full read SSRF in flyte-poc-us-east4.uberinternal.com Analysed #1540906 Valid Server-Side Request Forgery Medium 2022-05-26 $2,000 30 Reflected XSS POST method at partners.uber.com Analysed #129582 Valid Cross-site Scripting Medium 2019-01-25 $3,000 31 Reflected XSS on Partners Subdomain Analysed #390181 Valid No weakness recorded High 2018-09-16 $2,000 31 pam_ussh does not properly validate the SSH certificate authority Analysed #1177356 Valid Authentication Medium 2021-07-21 – 31 Full Path and internal information disclosure+ SQLNet.log file disclose internal network information Analysed #410187 Valid No weakness recorded Low 2020-04-23 – 34 Reflected XSS on developer.uber.com via Angular template injection Analysed #125027 Valid Cross-site Scripting – 2016-04-04 $3,000 35 Possibility to brute force invite codes in riders.uber.com Analysed #125505 Valid Misconfiguration and Insecure Design – 2016-06-13 $5,000 35 Stealing users password (Limited Scenario) Analysed #163067 Valid Misconfiguration and Insecure Design – 2016-09-29 – 35 API on campus-vtc.com allows access to ~100 Uber users full names, email addresses and telephone numbers. Analysed #580268 Valid Information Disclosure High 2021-07-08 $750 35 HTML injection via insecure parameter [https://www.ubercarshare.com/] Analysed #1790444 Valid Cross-site Scripting Medium 2023-03-23 – 35 Attacker could setup reminder remotely using brute force #158393 N/A Cross-Site Request Forgery – 2016-09-19 – 36 phone number exposure for riders/drivers given email/uuid Analysed #225243 Valid Information Disclosure Medium 2017-06-02 – 36 Stored XSS on developer.uber.com via admin account compromise Analysed #152067 Valid Cross-site Scripting – 2016-08-12 $5,000 37 [data-07.uberinternal.com] SSRF in Portainer app lead to access to Internal Docker API without Auth Analysed #366638 Valid Server-Side Request Forgery Critical 2023-03-23 $500 37 Reflected XSS on https://www.uber.com Analysed #708081 Valid Cross-site Scripting Medium 2021-02-24 $1,000 37 Arbitrary File Reading on Uber SSL VPN Analysed #617543 Valid Authentication High 2021-02-25 $6,500 38 SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/ Analysed #125932 Valid SQL Injection – 2016-06-14 $3,000 39 Reflected XSS in lert.uber.com Analysed #191810 Valid Cross-site Scripting Medium 2018-12-19 – 39 CVE-2020-3452 - unauthenticated file read on anyconnect.routematch.com Analysed #1257100 Valid File and Path Handling Medium 2021-08-05 – 39 DOM based XSS via insecure parameter on [ https://uberpay-mock-psp.uber.com ] Analysed #1767151 Valid Cross-site Scripting Medium 2023-03-23 – 39 Reflected XSS on multiple uberinternal.com domains Analysed #326449 Valid Cross-site Scripting Medium 2018-11-13 $2,000 41 SQLI on uberpartner.eu leads to exposure of sensitive user data of Uber partners Analysed #361623 Valid SQL Injection High 2021-03-15 $1,500 43 Publicly exposed HashiCorp Vault (Secrets management) at usec-gcp-staging.uberinternal.com & usec-gcp.uberinternal.com Analysed #519044 Valid No weakness recorded – 2021-08-27 – 43 Change the rating of any trip, therefore change the average driver rating Analysed #724522 Valid Input Validation and Logic Medium 2020-04-06 $1,500 43 Avoiding Surge Pricing Analysed #125250 Valid Misconfiguration and Insecure Design – 2016-08-11 – 45 Critical Information disclosure of rtapi token for any user via https://video-support-staging.uber.com/video/api/getPopulousUser Analysed #953649 Valid Information Disclosure Critical 2021-03-29 – 49 [uchat.uberinternals.com] Mattermost doesn't check Origin in Websockets, which leads to the Critical Inforamation Leakage. Analysed #201326 Valid Cross-Site Request Forgery Critical 2023-03-23 $2,000 50 Possibility to inject a malicious JavaScript code in any file on tags.tiqcdn.com results in a stored XSS on any page in most Uber domains Analysed #256152 Valid Cross-site Scripting High 2018-11-13 $6,000 51 Stored XSS on auth.uber.com/oauth/v2/authorize via redirect_uri parameter leads to Account Takeover Analysed #397497 Valid Cross-site Scripting Medium 2021-02-25 $3,000 52 [manage.jumpbikes.com] Blind XSS on Jump admin panel via user name Analysed #472470 Valid Cross-site Scripting Critical 2021-02-23 – 54 Multiple vulnerabilities in a WordPress plugin at drive.uber.com Analysed #135288 Valid SQL Injection – 2016-08-23 – 55 Blind OOB XXE At "http://ubermovement.com/" Analysed #154096 Valid Command and Code Injection – 2016-08-08 $500 56 OneLogin authentication bypass on WordPress sites Analysed #136169 Valid Authentication – 2016-06-06 $10,000 58 Unrestricted File Upload Results in Cross-Site Scripting Attacks Analysed #1005355 Valid Cross-site Scripting Medium 2021-05-14 – 58 Chain of vulnerabilities in Uber for Business Vouchers program allows for attacker to perform arbitrary charges to victim's U4B payment account Analysed #1145428 Valid Insecure Direct Object Reference High 2021-08-12 $5,750 58 SQL injection in 3rd party software Anomali Analysed #206872 Valid SQL Injection High 2017-03-21 $2,500 61