Disclosure of Co-Rider user (Uber-pooling) profile picture at Amazon AWS Cloudfront within HTTP RESPONSE #789803 Valid Information Disclosure Low 2021-02-25 – 3 SMS URL verification link does not expire on phone number change and lacks rate limiting #200179 Valid Authentication Low 2018-12-19 – 9 Open Redirect in riders.uber.com #125003 Valid Open Redirect Low 2018-11-20 $500 10 Open redirect on rush.uber.com, business.uber.com, and help.uber.com #126070 Valid Open Redirect Low 2018-11-13 – 10 Full path disclosure on track.uber.com #125197 Valid Information Disclosure Low 2018-11-20 $100 14 SMS/Call spamming due to truncated phone number #177551 Valid Authentication Low 2018-11-13 – 14 Access to SQL server of ubergreen.pt through password disclosure from different domain on same IP #439223 Valid Authentication Low 2021-03-15 $750 14 Cookie Bombing cause DOS - businesses.uber.com #847493 Valid Denial of Service Low 2021-02-24 – 14 Exposed Golang Pprof debugger at https://cn-geo1.uber.com/ #1385906 Valid Information Disclosure Low 2022-04-07 – 14 Golang expvar Information Disclosure #1650035 Valid Information Disclosure Low 2022-08-24 – 16 Privacy policy contains hardcoded link using unencrypted HTTP #365755 Valid Command and Code Injection Low 2018-11-13 – 17 Chained vulnerabilities create DOS attack against users on desafio5estrelas.com #624645 Valid Cross-Site Request Forgery Low 2021-03-30 $1,000 17 XSS on partners.uber.com due to no user input sanitisation #281283 Valid Cross-site Scripting Low 2018-10-04 $1,000 18 duplicate hsts headers lead to firefox ignoring hsts on business.uber.com Analysed #221955 Valid No weakness recorded Low 2020-04-30 $500 27 IDOR in activateFuelCard id allows bulk lookup of driver uuids Analysed #254151 Valid Insecure Direct Object Reference Low 2019-01-25 – 28 Full Path and internal information disclosure+ SQLNet.log file disclose internal network information Analysed #410187 Valid No weakness recorded Low 2020-04-23 – 34 Open AWS S3 bucket at ubergreece.s3.amazonaws.com exposes confidential internal documents and files Analysed #361438 Valid Information Disclosure Low 2021-03-12 $500 70 ubernycmarketplace.com is vulnerable to the Heartbleed Bug Analysed #304190 Valid Information Disclosure Low 2020-04-23 $1,500 112 Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system. Analysed #530441 Valid Access Control Low 2021-03-06 $4,500 210