Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
XSS on love.uber.com#125179	Duplicate	Cross-site Scripting	–	2016-05-09	–	1
SMS Flood with Update Profile#126536	Duplicate	Denial of Service	–	2016-06-13	–	1
CrashPlan Backup is Vulnerable Allowing to a DoS Attack Against Uber's Backups to ```backup.uber.com```#131560	Duplicate	No weakness recorded	–	2016-05-09	–	1
Self-XSS in Partners Profile#145289	Duplicate	Cross-site Scripting	–	2016-07-07	–	1
Session retention is present which reveals the customer info#125634	Duplicate	Authentication	–	2016-05-09	–	2
Enumerating userIDs with phone numbers#128723	Duplicate	Information Disclosure	–	2016-06-11	–	2
User credentials are not strong on vault.uber.com#128895	Duplicate	Authentication	–	2016-07-26	–	2
Unauthorized file (invoice) download#115209	Duplicate	Authentication	–	2016-06-15	–	3
CRLF Injection in developer.uber.com#125984	Duplicate	No weakness recorded	–	2016-05-09	–	3
Uber password reset link EMAIL FLOOD#126364	Duplicate	Denial of Service	–	2016-06-13	–	3
SSL-protected Reflected XSS in m.uber.com#296701	Duplicate	Cross-site Scripting	Critical	2017-12-26	–	3
SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint#300080	Duplicate	Cross-site Scripting	Critical	2017-12-26	–	3
SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint#300081	Duplicate	Cross-site Scripting	Critical	2017-12-26	–	3
lite:sess Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint#300101	Duplicate	Cross-site Scripting	Critical	2017-12-26	–	3
udi-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint#300103	Duplicate	Cross-site Scripting	Critical	2017-12-26	–	3
XSS in people.uber.com#140791	Duplicate	Cross-site Scripting	–	2016-07-26	–	4
Self-XSS Vulnerability on Password Reset Form#125059	Duplicate	Cross-site Scripting	–	2016-06-13	–	5
Use Partner/Driver App Without Being Activated#127085	Duplicate	Authentication	–	2016-06-14	–	5
muber-id Query Parameter Can Generate SSL-protected Reflected XSS in https://m.uber.com/0-dfffb25d2cf6ceeb0a27.js Endpoint#300102	Duplicate	Cross-site Scripting	Critical	2017-12-26	–	5
The Microsoft Store Uber App Does Not Implement Certificate Pinning#293358	Duplicate	Cryptography	Critical	2017-12-24	–	7
Bruteforce INVITE codes easy way#144877	Duplicate	Misconfiguration and Insecure Design	–	2016-07-26	–	10
Multiple Vulnerabilities (Including SQLi) in love.uber.com#117080	Duplicate	No weakness recorded	–	2016-06-14	–	18

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,443 analysed so far), which can be wrong. Data as of 2026-11-14.