Thumbor misconfiguration at blogapi.uber.com can lead to DoS #787240 Valid Denial of Service Medium 2021-02-25 $500 6 Unsecured Dropwizard Admin Panel on display.uber-adsystem.com exposes sensitive server information #651355 Valid Cryptography Medium 2021-03-15 $500 12 Uber Test Report 20220301 #1496297 Valid Input Validation and Logic Medium 2022-03-03 – 22 Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employees #1063022 Valid Access Control Medium 2021-05-14 – 29 4 Subdomains Takeover on 2 domains ( muberscolombia.com & ubereats.pl ) #1116545 Valid Access Control Medium 2021-04-29 $500 29 Subdomain takeover on mta1a1.spmail.uber.com #707748 Valid Access Control Medium 2020-04-06 – 30 Full read SSRF in flyte-poc-us-east4.uberinternal.com #1540906 Valid Server-Side Request Forgery Medium 2022-05-26 $2,000 30 pam_ussh does not properly validate the SSH certificate authority #1177356 Valid Authentication Medium 2021-07-21 – 31 HTML injection via insecure parameter [https://www.ubercarshare.com/] #1790444 Valid Cross-site Scripting Medium 2023-03-23 – 35 Reflected XSS on https://www.uber.com #708081 Valid Cross-site Scripting Medium 2021-02-24 $1,000 37 CVE-2020-3452 - unauthenticated file read on anyconnect.routematch.com #1257100 Valid File and Path Handling Medium 2021-08-05 – 39 DOM based XSS via insecure parameter on [ https://uberpay-mock-psp.uber.com ] #1767151 Valid Cross-site Scripting Medium 2023-03-23 – 39 Change the rating of any trip, therefore change the average driver rating #724522 Valid Input Validation and Logic Medium 2020-04-06 $1,500 43 Unrestricted File Upload Results in Cross-Site Scripting Attacks #1005355 Valid Cross-site Scripting Medium 2021-05-14 – 58 Lack of proper paymentProfileUUID validation allows any number of free rides without any outstanding balance Analysed #574638 Valid Input Validation and Logic Medium 2019-07-18 – 82 Complete Admin account takeover due to PhpDebugBar turned on in Uber's production server Analysed #1883806 Valid Misconfiguration and Insecure Design Medium 2023-08-23 – 90 IDOR leads to See analytics of Loyalty Program in any restaurant. Analysed #1137819 Valid Insecure Direct Object Reference Medium 2021-05-28 – 112 IDOR leads to leak analytics of any restaurant Analysed #1116387 Valid Insecure Direct Object Reference Medium 2021-04-29 – 123