Avoiding Surge Pricing #125250 Valid Misconfiguration and Insecure Design – 2016-08-11 – 45 Change the rating of any trip, therefore change the average driver rating #724522 Valid Input Validation and Logic Medium 2020-04-06 $1,500 43 Publicly exposed HashiCorp Vault (Secrets management) at usec-gcp-staging.uberinternal.com & usec-gcp.uberinternal.com #519044 Valid No weakness recorded – 2021-08-27 – 43 SQLI on uberpartner.eu leads to exposure of sensitive user data of Uber partners #361623 Valid SQL Injection High 2021-03-15 $1,500 43 Reflected XSS on multiple uberinternal.com domains #326449 Valid Cross-site Scripting Medium 2018-11-13 $2,000 41 DOM based XSS via insecure parameter on [ https://uberpay-mock-psp.uber.com ] #1767151 Valid Cross-site Scripting Medium 2023-03-23 – 39 CVE-2020-3452 - unauthenticated file read on anyconnect.routematch.com #1257100 Valid File and Path Handling Medium 2021-08-05 – 39 Reflected XSS in lert.uber.com #191810 Valid Cross-site Scripting Medium 2018-12-19 – 39 SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/ #125932 Valid SQL Injection – 2016-06-14 $3,000 39 Arbitrary File Reading on Uber SSL VPN #617543 Valid Authentication High 2021-02-25 $6,500 38 Reflected XSS on https://www.uber.com #708081 Valid Cross-site Scripting Medium 2021-02-24 $1,000 37 [data-07.uberinternal.com] SSRF in Portainer app lead to access to Internal Docker API without Auth #366638 Valid Server-Side Request Forgery Critical 2023-03-23 $500 37 Stored XSS on developer.uber.com via admin account compromise #152067 Valid Cross-site Scripting – 2016-08-12 $5,000 37 phone number exposure for riders/drivers given email/uuid #225243 Valid Information Disclosure Medium 2017-06-02 – 36 Attacker could setup reminder remotely using brute force #158393 N/A Cross-Site Request Forgery – 2016-09-19 – 36 HTML injection via insecure parameter [https://www.ubercarshare.com/] #1790444 Valid Cross-site Scripting Medium 2023-03-23 – 35 API on campus-vtc.com allows access to ~100 Uber users full names, email addresses and telephone numbers. #580268 Valid Information Disclosure High 2021-07-08 $750 35 Stealing users password (Limited Scenario) #163067 Valid Misconfiguration and Insecure Design – 2016-09-29 – 35 Possibility to brute force invite codes in riders.uber.com #125505 Valid Misconfiguration and Insecure Design – 2016-06-13 $5,000 35 Reflected XSS on developer.uber.com via Angular template injection #125027 Valid Cross-site Scripting – 2016-04-04 $3,000 35 Full Path and internal information disclosure+ SQLNet.log file disclose internal network information #410187 Valid No weakness recorded Low 2020-04-23 – 34 pam_ussh does not properly validate the SSH certificate authority #1177356 Valid Authentication Medium 2021-07-21 – 31 Reflected XSS on Partners Subdomain #390181 Valid No weakness recorded High 2018-09-16 $2,000 31 Reflected XSS POST method at partners.uber.com #129582 Valid Cross-site Scripting Medium 2019-01-25 $3,000 31 Full read SSRF in flyte-poc-us-east4.uberinternal.com #1540906 Valid Server-Side Request Forgery Medium 2022-05-26 $2,000 30 Subdomain takeover on mta1a1.spmail.uber.com #707748 Valid Access Control Medium 2020-04-06 – 30 Site-wide CSRF on eats.uber.com #161529 Valid Cross-Site Request Forgery High 2018-12-19 – 30 4 Subdomains Takeover on 2 domains ( muberscolombia.com & ubereats.pl ) #1116545 Valid Access Control Medium 2021-04-29 $500 29 Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employees #1063022 Valid Access Control Medium 2021-05-14 – 29 SQLI on desafio5estrelas.com #476150 Valid SQL Injection Medium 2021-03-29 $2,500 29 Information Leakage - GitHub - VCenter configuration scripts, StorMagic usernames and password along with default ESXi root password #365199 Valid No weakness recorded Medium 2018-08-27 $1,000 29 Improper Access Control on Onelogin in multi-layered architecture #326080 Valid Access Control – 2018-08-08 $500 29 Outdated Wordpress installation and plugins at www.uberxgermany.com create CSRF and XSS vulnerabilities #323899 Valid Cross-Site Request Forgery Medium 2021-02-25 $500 29 Exposed█████████in apk file - devbuilds.uber.com #848905 Valid Information Disclosure High 2021-04-09 – 28 IDOR in activateFuelCard id allows bulk lookup of driver uuids #254151 Valid Insecure Direct Object Reference Low 2019-01-25 – 28 duplicate hsts headers lead to firefox ignoring hsts on business.uber.com #221955 Valid No weakness recorded Low 2020-04-30 $500 27 Get organization info base on uuid #151465 Valid Authentication – 2016-09-02 $3,000 26 Possible to View Driver Waybill via Driver UUID #127087 Valid Information Disclosure – 2016-06-14 – 24 Possibility to enumerate and bruteforce promotion codes in Uber iOS App #125707 Valid Authentication Medium 2018-11-20 $3,000 24 pam-ussh may be tricked into using another logged in user's ssh-agent #204802 Valid Authentication Medium 2017-03-20 – 23 IDOR on partners.uber.com allows for a driver to override administrator documents #194594 Valid Insecure Direct Object Reference Medium 2018-12-19 – 23 Uber Test Report 20220301 #1496297 Valid Input Validation and Logic Medium 2022-03-03 – 22 CBC "cut and paste" attack may cause Open Redirect(even XSS) #126203 Valid Cryptography – 2016-08-12 $500 22 Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.com #149679 Valid Access Control – 2016-07-25 – 21 XSS @ love.uber.com #117068 Valid Cross-site Scripting – 2016-05-07 – 21 Cleartext password exposure allows access to the desafio5estrelas.com admin panel #344566 Valid Cryptography Medium 2021-03-30 $500 20 deleting payment profile during active trip puts account into arrears but active trip is temporarily “free” #216373 Valid Input Validation and Logic None 2017-06-28 – 20 XSS on partners.uber.com due to no user input sanitisation #281283 Valid Cross-site Scripting Low 2018-10-04 $1,000 18 Stored XSS on newsroom.uber.com admin panel / Stream WordPress plugin #127948 Valid Cross-site Scripting – 2016-07-27 $5,000 18 Multiple Vulnerabilities (Including SQLi) in love.uber.com #117080 Duplicate No weakness recorded – 2016-06-14 – 18