The Uber Promo Customer Endpoint Does Not Implement Multifactor Authentication, Blacklisting or Rate Limiting #293359 Informative Authentication High 2017-12-24 – 5 [usuppliers.uber.com] - Server Side Request Forgery via XXE OOB #448598 Valid Server-Side Request Forgery High 2021-02-25 – 11 Request Access for Uber Device Returns Management Platform (https://www.eats-devicereturns.com/request-access/) Bypass Allows Access to PII #1010787 Valid Access Control High 2021-05-14 – 13 Uber employees are sharing information on productforums.google.com #344086 Valid Information Disclosure High 2021-02-25 – 16 Exposed█████████in apk file - devbuilds.uber.com Analysed #848905 Valid Information Disclosure High 2021-04-09 – 28 Site-wide CSRF on eats.uber.com Analysed #161529 Valid Cross-Site Request Forgery High 2018-12-19 – 30 Reflected XSS on Partners Subdomain Analysed #390181 Valid No weakness recorded High 2018-09-16 $2,000 31 API on campus-vtc.com allows access to ~100 Uber users full names, email addresses and telephone numbers. Analysed #580268 Valid Information Disclosure High 2021-07-08 $750 35 Arbitrary File Reading on Uber SSL VPN Analysed #617543 Valid Authentication High 2021-02-25 $6,500 38 SQLI on uberpartner.eu leads to exposure of sensitive user data of Uber partners Analysed #361623 Valid SQL Injection High 2021-03-15 $1,500 43 Possibility to inject a malicious JavaScript code in any file on tags.tiqcdn.com results in a stored XSS on any page in most Uber domains Analysed #256152 Valid Cross-site Scripting High 2018-11-13 $6,000 51 Chain of vulnerabilities in Uber for Business Vouchers program allows for attacker to perform arbitrary charges to victim's U4B payment account Analysed #1145428 Valid Insecure Direct Object Reference High 2021-08-12 $5,750 58 SQL injection in 3rd party software Anomali Analysed #206872 Valid SQL Injection High 2017-03-21 $2,500 61 Authorization issue in Google G Suite allows DoS through HTTP redirect Analysed #191196 Valid Denial of Service High 2017-02-09 – 62 Chain of IDORs Between U4B and Vouchers APIs Allows Attackers to View and Modify Program/Voucher Policies and to Obtain Organization Employees' PII Analysed #1148697 Valid Insecure Direct Object Reference High 2022-04-07 – 64 Lack of payment type validation in dial.uber.com allows for free rides Analysed #162199 Valid Input Validation and Logic High 2018-11-20 – 68 Subdomain takeover at signup.uber.com Analysed #197489 Valid Access Control High 2019-01-25 – 79 SAML Authentication Bypass on uchat.uberinternal.com Analysed #223014 Valid Authentication High 2017-09-05 $8,500 88 Stored XSS on any page in most Uber domains Analysed #217739 Valid Cross-site Scripting High 2018-11-20 $6,000 107 Reflected XSS on https://www.uber.com Analysed #390386 Valid No weakness recorded High 2021-03-15 – 114 [First 30] Stored XSS on login.uber.com/oauth/v2/authorize via redirect_uri parameter Analysed #392106 Valid Cross-site Scripting High 2021-02-25 $3,000 131 Open Redirect on central.uber.com allows for account takeover Analysed #206591 Valid Authentication High 2019-01-25 – 144 Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sg Analysed #340431 Valid Cryptography High 2020-04-30 $4,000 376 Chained Bugs to Leak Victim's Uber's FB Oauth Token Analysed #202781 Valid Authentication High 2019-01-25 – 427 Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameter Analysed #542340 Valid Information Disclosure High 2019-09-09 – 643