lert.uber.com: Few default folders/files of AURA Framework are accessible #195205 Valid Information Disclosure None 2018-12-19 – 5 Information Leak - GitHub - Endpoint Configuration Details #378558 Valid Information Disclosure Medium 2018-08-27 – 8 SMS URL verification link does not expire on phone number change and lacks rate limiting #200179 Valid Authentication Low 2018-12-19 – 9 Open Redirect in riders.uber.com #125003 Valid Open Redirect Low 2018-11-20 $500 10 Open redirect on rush.uber.com, business.uber.com, and help.uber.com #126070 Valid Open Redirect Low 2018-11-13 – 10 XSS in ubermovement.com via editable Google Sheets #193799 Valid Cross-site Scripting Medium 2018-12-19 $2,000 11 Delay of arrears notification allows Riders to take multiple rides without paying #317388 Valid Input Validation and Logic None 2018-11-13 – 11 Physical Access to Mobile App Allows Local Attribute Updates without Authentication #165561 Valid Authentication None 2018-12-19 – 12 No rate limiting on https://biz.uber.com/confirm allowed an attacker to join arbitrary business.uber.com accounts #281344 Valid Authentication Medium 2018-11-13 – 12 Full path disclosure on track.uber.com #125197 Valid Information Disclosure Low 2018-11-20 $100 14 SMS/Call spamming due to truncated phone number #177551 Valid Authentication Low 2018-11-13 – 14 Reflected XSS in https://eng.uberinternal.com and https://coeshift.corp.uber.internal/ #354686 Valid Cross-site Scripting Medium 2018-11-13 $500 16 Privacy policy contains hardcoded link using unencrypted HTTP #365755 Valid Command and Code Injection Low 2018-11-13 – 17 XSS on partners.uber.com due to no user input sanitisation #281283 Valid Cross-site Scripting Low 2018-10-04 $1,000 18 IDOR on partners.uber.com allows for a driver to override administrator documents #194594 Valid Insecure Direct Object Reference Medium 2018-12-19 – 23 Possibility to enumerate and bruteforce promotion codes in Uber iOS App #125707 Valid Authentication Medium 2018-11-20 $3,000 24 Improper Access Control on Onelogin in multi-layered architecture Analysed #326080 Valid Access Control – 2018-08-08 $500 29 Information Leakage - GitHub - VCenter configuration scripts, StorMagic usernames and password along with default ESXi root password Analysed #365199 Valid No weakness recorded Medium 2018-08-27 $1,000 29 Site-wide CSRF on eats.uber.com Analysed #161529 Valid Cross-Site Request Forgery High 2018-12-19 – 30 Reflected XSS on Partners Subdomain Analysed #390181 Valid No weakness recorded High 2018-09-16 $2,000 31 Reflected XSS in lert.uber.com Analysed #191810 Valid Cross-site Scripting Medium 2018-12-19 – 39 Reflected XSS on multiple uberinternal.com domains Analysed #326449 Valid Cross-site Scripting Medium 2018-11-13 $2,000 41 Possibility to inject a malicious JavaScript code in any file on tags.tiqcdn.com results in a stored XSS on any page in most Uber domains Analysed #256152 Valid Cross-site Scripting High 2018-11-13 $6,000 51 Hack The World 2017 Top 2 Bonus #300779 Valid No weakness recorded – 2018-11-13 $5,000 61 Lack of payment type validation in dial.uber.com allows for free rides Analysed #162199 Valid Input Validation and Logic High 2018-11-20 – 68 Stored XSS on any page in most Uber domains Analysed #217739 Valid Cross-site Scripting High 2018-11-20 $6,000 107