Disclosure of Co-Rider user (Uber-pooling) profile picture at Amazon AWS Cloudfront within HTTP RESPONSE #789803 Valid Information Disclosure Low 2021-02-25 – 3 [experience.uber.com] Node.js source code disclosure & anonymous access to internal Uber documents, templates and tools #389078 Valid Information Disclosure Medium 2021-02-23 – 5 Thumbor misconfiguration at blogapi.uber.com can lead to DoS #787240 Valid Denial of Service Medium 2021-02-25 $500 6 stack trace exposed on https://receipts.uber.com/ #204568 Informative Information Disclosure Medium 2021-02-25 – 8 Google Maps API Key Leakage #1321830 Informative Information Disclosure None 2021-09-03 – 8 Listing of email addresses of whitelisted business users visible at business.uber.com #125246 Valid Information Disclosure – 2021-02-25 $250 9 [usuppliers.uber.com] - Server Side Request Forgery via XXE OOB #448598 Valid Server-Side Request Forgery High 2021-02-25 – 11 Unsecured Dropwizard Admin Panel on display.uber-adsystem.com exposes sensitive server information #651355 Valid Cryptography Medium 2021-03-15 $500 12 Request Access for Uber Device Returns Management Platform (https://www.eats-devicereturns.com/request-access/) Bypass Allows Access to PII #1010787 Valid Access Control High 2021-05-14 – 13 Access to SQL server of ubergreen.pt through password disclosure from different domain on same IP #439223 Valid Authentication Low 2021-03-15 $750 14 Cookie Bombing cause DOS - businesses.uber.com #847493 Valid Denial of Service Low 2021-02-24 – 14 Lack of CSRF protection on uberps.com makes every form vulnerable to CSRF Analysed #343120 Valid Cross-Site Request Forgery Medium 2021-03-15 $500 15 Uber employees are sharing information on productforums.google.com Analysed #344086 Valid Information Disclosure High 2021-02-25 – 16 Chained vulnerabilities create DOS attack against users on desafio5estrelas.com Analysed #624645 Valid Cross-Site Request Forgery Low 2021-03-30 $1,000 17 Cleartext password exposure allows access to the desafio5estrelas.com admin panel Analysed #344566 Valid Cryptography Medium 2021-03-30 $500 20 Exposed█████████in apk file - devbuilds.uber.com Analysed #848905 Valid Information Disclosure High 2021-04-09 – 28 Outdated Wordpress installation and plugins at www.uberxgermany.com create CSRF and XSS vulnerabilities Analysed #323899 Valid Cross-Site Request Forgery Medium 2021-02-25 $500 29 SQLI on desafio5estrelas.com Analysed #476150 Valid SQL Injection Medium 2021-03-29 $2,500 29 Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employees Analysed #1063022 Valid Access Control Medium 2021-05-14 – 29 4 Subdomains Takeover on 2 domains ( muberscolombia.com & ubereats.pl ) Analysed #1116545 Valid Access Control Medium 2021-04-29 $500 29 pam_ussh does not properly validate the SSH certificate authority Analysed #1177356 Valid Authentication Medium 2021-07-21 – 31 API on campus-vtc.com allows access to ~100 Uber users full names, email addresses and telephone numbers. Analysed #580268 Valid Information Disclosure High 2021-07-08 $750 35 Reflected XSS on https://www.uber.com Analysed #708081 Valid Cross-site Scripting Medium 2021-02-24 $1,000 37 Arbitrary File Reading on Uber SSL VPN Analysed #617543 Valid Authentication High 2021-02-25 $6,500 38 CVE-2020-3452 - unauthenticated file read on anyconnect.routematch.com Analysed #1257100 Valid File and Path Handling Medium 2021-08-05 – 39 SQLI on uberpartner.eu leads to exposure of sensitive user data of Uber partners Analysed #361623 Valid SQL Injection High 2021-03-15 $1,500 43 Publicly exposed HashiCorp Vault (Secrets management) at usec-gcp-staging.uberinternal.com & usec-gcp.uberinternal.com Analysed #519044 Valid No weakness recorded – 2021-08-27 – 43 Critical Information disclosure of rtapi token for any user via https://video-support-staging.uber.com/video/api/getPopulousUser Analysed #953649 Valid Information Disclosure Critical 2021-03-29 – 49 Stored XSS on auth.uber.com/oauth/v2/authorize via redirect_uri parameter leads to Account Takeover Analysed #397497 Valid Cross-site Scripting Medium 2021-02-25 $3,000 52 [manage.jumpbikes.com] Blind XSS on Jump admin panel via user name Analysed #472470 Valid Cross-site Scripting Critical 2021-02-23 – 54 Unrestricted File Upload Results in Cross-Site Scripting Attacks Analysed #1005355 Valid Cross-site Scripting Medium 2021-05-14 – 58 Chain of vulnerabilities in Uber for Business Vouchers program allows for attacker to perform arbitrary charges to victim's U4B payment account Analysed #1145428 Valid Insecure Direct Object Reference High 2021-08-12 $5,750 58 Open AWS S3 bucket at ubergreece.s3.amazonaws.com exposes confidential internal documents and files Analysed #361438 Valid Information Disclosure Low 2021-03-12 $500 70 Pre-auth Remote Code Execution on multiple Uber SSL VPN servers Analysed #540242 Valid Command and Code Injection Critical 2021-02-24 $2,000 80 private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") events Analysed #174404 Valid Information Disclosure Medium 2021-05-14 – 91 IDOR leads to See analytics of Loyalty Program in any restaurant. Analysed #1137819 Valid Insecure Direct Object Reference Medium 2021-05-28 – 112 Reflected XSS on https://www.uber.com Analysed #390386 Valid No weakness recorded High 2021-03-15 – 114 IDOR leads to leak analytics of any restaurant Analysed #1116387 Valid Insecure Direct Object Reference Medium 2021-04-29 – 123 [First 30] Stored XSS on login.uber.com/oauth/v2/authorize via redirect_uri parameter Analysed #392106 Valid Cross-site Scripting High 2021-02-25 $3,000 131 Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system. Analysed #530441 Valid Access Control Low 2021-03-06 $4,500 210 RCE via npm misconfig -- installing internal libraries from the public registry Analysed #1007014 Valid Command and Code Injection Critical 2021-02-24 $9,000 325 [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repo Analysed #591813 Valid Information Disclosure Critical 2021-02-25 $40,000 458