Cross-site Scripting (XSS) #126049 Valid Cross-site Scripting – 2016-05-06 – 1 XSS In archive.uber.com Due to Mime Sniffing in IE #126197 Valid Cross-site Scripting – 2016-04-06 $750 1 Easy spam with USE My PHONE Feature #127918 Valid Memory Corruption – 2016-06-13 $250 1 Stored self-XSS at m.uber.com #134124 Valid Cross-site Scripting – 2016-07-08 – 1 Estimation of a Lower Bound on Number of Uber Drivers via Enumeration #125488 Valid Information Disclosure – 2016-08-24 $500 2 HTML Escaping Error in the 404 Page on developer.uber.com/docs/ #125130 Valid Cross-site Scripting – 2016-04-06 – 3 CSRF on eng.uber.com may lead to server-side compromise #125594 Valid Cross-Site Request Forgery – 2016-04-26 – 3 Disclosure of Co-Rider user (Uber-pooling) profile picture at Amazon AWS Cloudfront within HTTP RESPONSE #789803 Valid Information Disclosure – 2021-02-25 – 3 SQLi in love.uber.com #125181 Valid SQL Injection – 2016-04-25 – 4 Dom Based Xss #125498 Valid Cross-site Scripting – 2016-05-09 – 4 Compromising Atlassian Confluence (team.uberinternal.com) via WordPress (newsroom.uber.com) #136531 Valid Access Control – 2016-06-06 – 4 Brute-Forcing invite codes in partners.uber.com #144616 Valid Misconfiguration and Insecure Design – 2016-07-26 $750 4 Wordpress Vulnerabilities in transparencyreport.uber.com and eng.uber.com domains #148163 Valid Authentication – 2016-08-24 $1,000 4 XSS on partners.uber.com #42393 Valid Cross-site Scripting – 2016-03-24 $500 5 Issue with Password reset functionality #92251 Valid Authentication – 2016-05-23 $100 5 Drivers can change profile picture #101063 Valid Authentication – 2016-05-12 $500 5 Stored XSS in archive.uber.com Due to Injection of Javascript:alert(0) #126906 Valid Cross-site Scripting – 2016-05-09 $3,000 5 Requested and received edit access to Google form #130440 Valid Information Disclosure – 2016-07-26 – 5 lert.uber.com: Few default folders/files of AURA Framework are accessible #195205 Valid Information Disclosure – 2018-12-19 – 5 [experience.uber.com] Node.js source code disclosure & anonymous access to internal Uber documents, templates and tools #389078 Valid Information Disclosure – 2021-02-23 – 5 XSS in getrush.uber.com #125112 Valid Cross-site Scripting – 2016-04-06 $3,000 6 CSV Injection in business.uber.com #126109 Valid Information Disclosure – 2016-04-06 $1,000 6 Reflected XSS via Livefyre Media Wall in newsroom.uber.com #134061 Valid Cross-site Scripting – 2016-05-09 $2,000 6 newsroom.uber.com is vulnerable to 'SOME' XSS attack via plupload.flash.swf #150375 Valid Command and Code Injection – 2016-08-22 – 6 ability to retrieve a user's phone-number/email for a given inviteCode #178503 Valid Information Disclosure – 2017-05-17 – 6 Thumbor misconfiguration at blogapi.uber.com can lead to DoS #787240 Valid Denial of Service – 2021-02-25 $500 6 Stored XSS in drive.uber.com WordPress admin panel #126099 Valid Cross-site Scripting – 2016-05-14 $2,000 7 Users can falsely declare their own Uber account info on the monthly billing application #168453 Valid Authentication – 2016-10-20 – 7 Reflected XSS on Uber.com careers #117190 Valid Cross-site Scripting – 2016-04-06 – 8 Bypassing Uber Partner's 3 Cancel Limit #125218 Valid Command and Code Injection – 2016-05-26 $2,000 8 Information Leak - GitHub - Endpoint Configuration Details #378558 Valid Information Disclosure – 2018-08-27 – 8 Open Redirect in m.uber.com #125000 Valid No weakness recorded – 2016-09-27 $500 9 Listing of email addresses of whitelisted business users visible at business.uber.com #125246 Valid Information Disclosure – 2021-02-25 $250 9 SMS URL verification link does not expire on phone number change and lacks rate limiting #200179 Valid Authentication – 2018-12-19 – 9 Mass Assignment Vulnerability in partners.uber.com #99424 Valid Command and Code Injection – 2016-05-09 $1,000 10 Open Redirect in riders.uber.com #125003 Valid Open Redirect – 2018-11-20 $500 10 Open redirect on rush.uber.com, business.uber.com, and help.uber.com #126070 Valid Open Redirect – 2018-11-13 – 10 [IODR] Get business trip via organization id #151470 Valid Authentication – 2016-08-15 $2,000 10 Open Redirection on Uber.com #119236 Valid Open Redirect – 2016-04-22 $500 11 Reflected XSS via Unvalidated / Open Redirect in uber.com #125791 Valid No weakness recorded – 2016-05-09 $3,000 11 XSS in ubermovement.com via editable Google Sheets #193799 Valid Cross-site Scripting – 2018-12-19 $2,000 11 Delay of arrears notification allows Riders to take multiple rides without paying #317388 Valid Input Validation and Logic – 2018-11-13 – 11 [usuppliers.uber.com] - Server Side Request Forgery via XXE OOB #448598 Valid Server-Side Request Forgery – 2021-02-25 – 11 Bulk UUID enumeration via invite codes #145150 Valid Information Disclosure – 2016-09-08 – 12 Physical Access to Mobile App Allows Local Attribute Updates without Authentication #165561 Valid Authentication – 2018-12-19 – 12 No rate limiting on https://biz.uber.com/confirm allowed an attacker to join arbitrary business.uber.com accounts #281344 Valid Authentication – 2018-11-13 – 12 Unsecured Dropwizard Admin Panel on display.uber-adsystem.com exposes sensitive server information #651355 Valid Cryptography – 2021-03-15 $500 12 Lack of CNAME/A Record Trimming Pointing Uber Domains to Insecure Non-Uber AWS Instances/Sites #125118 Valid Information Disclosure – 2016-07-13 – 13 Lack of rate limiting on get.uber.com leads to enumeration of promotion codes and estimation of a lower bound on the number of Uber drivers #125200 Valid Information Disclosure – 2016-08-12 $3,000 13 Request Access for Uber Device Returns Management Platform (https://www.eats-devicereturns.com/request-access/) Bypass Allows Access to PII #1010787 Valid Access Control – 2021-05-14 – 13