Chained vulnerabilities create DOS attack against users on desafio5estrelas.com #624645 Valid Cross-Site Request Forgery Low 2021-03-30 $1,000 17 Privacy policy contains hardcoded link using unencrypted HTTP #365755 Valid Command and Code Injection Low 2018-11-13 – 17 Golang expvar Information Disclosure #1650035 Valid Information Disclosure Low 2022-08-24 – 16 Reflected XSS in https://eng.uberinternal.com and https://coeshift.corp.uber.internal/ #354686 Valid Cross-site Scripting Medium 2018-11-13 $500 16 Uber employees are sharing information on productforums.google.com #344086 Valid Information Disclosure High 2021-02-25 – 16 Lack of CSRF protection on uberps.com makes every form vulnerable to CSRF #343120 Valid Cross-Site Request Forgery Medium 2021-03-15 $500 15 Missing authorization checks leading to the exposure of ubernihao.com administrator accounts #154762 Valid Information Disclosure – 2016-08-15 – 15 Information regarding trips from other users #127161 Valid Information Disclosure – 2016-07-12 – 15 Exposed Golang Pprof debugger at https://cn-geo1.uber.com/ #1385906 Valid Information Disclosure Low 2022-04-07 – 14 Cookie Bombing cause DOS - businesses.uber.com #847493 Valid Denial of Service Low 2021-02-24 – 14 Access to SQL server of ubergreen.pt through password disclosure from different domain on same IP #439223 Valid Authentication Low 2021-03-15 $750 14 SMS/Call spamming due to truncated phone number #177551 Valid Authentication Low 2018-11-13 – 14 xss vulnerability in http://ubermovement.com/community/daniel #142946 Valid Cross-site Scripting – 2016-07-21 – 14 Full path disclosure on track.uber.com #125197 Valid Information Disclosure Low 2018-11-20 $100 14 Request Access for Uber Device Returns Management Platform (https://www.eats-devicereturns.com/request-access/) Bypass Allows Access to PII #1010787 Valid Access Control High 2021-05-14 – 13 Server version disclosure #149483 Informative Information Disclosure – 2016-07-07 – 13 Lack of rate limiting on get.uber.com leads to enumeration of promotion codes and estimation of a lower bound on the number of Uber drivers #125200 Valid Information Disclosure – 2016-08-12 $3,000 13 Lack of CNAME/A Record Trimming Pointing Uber Domains to Insecure Non-Uber AWS Instances/Sites #125118 Valid Information Disclosure – 2016-07-13 – 13 Unsecured Dropwizard Admin Panel on display.uber-adsystem.com exposes sensitive server information #651355 Valid Cryptography Medium 2021-03-15 $500 12 No rate limiting on https://biz.uber.com/confirm allowed an attacker to join arbitrary business.uber.com accounts #281344 Valid Authentication Medium 2018-11-13 – 12 Session not expired When logout [partners.uber.com] #231041 N/A No weakness recorded None 2017-05-26 – 12 Physical Access to Mobile App Allows Local Attribute Updates without Authentication #165561 Valid Authentication None 2018-12-19 – 12 Bulk UUID enumeration via invite codes #145150 Valid Information Disclosure – 2016-09-08 – 12 [usuppliers.uber.com] - Server Side Request Forgery via XXE OOB #448598 Valid Server-Side Request Forgery High 2021-02-25 – 11 Delay of arrears notification allows Riders to take multiple rides without paying #317388 Valid Input Validation and Logic None 2018-11-13 – 11 XSS in ubermovement.com via editable Google Sheets #193799 Valid Cross-site Scripting Medium 2018-12-19 $2,000 11 Reflected XSS via Unvalidated / Open Redirect in uber.com #125791 Valid No weakness recorded – 2016-05-09 $3,000 11 Open Redirection on Uber.com #119236 Valid Open Redirect – 2016-04-22 $500 11 [IODR] Get business trip via organization id #151470 Valid Authentication – 2016-08-15 $2,000 10 Bruteforce INVITE codes easy way #144877 Duplicate Misconfiguration and Insecure Design – 2016-07-26 – 10 Open redirect on rush.uber.com, business.uber.com, and help.uber.com #126070 Valid Open Redirect Low 2018-11-13 – 10 Open Redirect in riders.uber.com #125003 Valid Open Redirect Low 2018-11-20 $500 10 Mass Assignment Vulnerability in partners.uber.com #99424 Valid Command and Code Injection – 2016-05-09 $1,000 10 SMS URL verification link does not expire on phone number change and lacks rate limiting #200179 Valid Authentication Low 2018-12-19 – 9 Listing of email addresses of whitelisted business users visible at business.uber.com #125246 Valid Information Disclosure – 2021-02-25 $250 9 Open Redirect in m.uber.com #125000 Valid No weakness recorded – 2016-09-27 $500 9 Google Maps API Key Leakage #1321830 Informative Information Disclosure None 2021-09-03 – 8 Information Leak - GitHub - Endpoint Configuration Details #378558 Valid Information Disclosure Medium 2018-08-27 – 8 stack trace exposed on https://receipts.uber.com/ #204568 Informative Information Disclosure Medium 2021-02-25 – 8 Can add employee in business.uber.com without add payment method #153175 Informative Authentication – 2016-07-26 – 8 Bypassing Uber Partner's 3 Cancel Limit #125218 Valid Command and Code Injection – 2016-05-26 $2,000 8 Reflected XSS on Uber.com careers #117190 Valid Cross-site Scripting – 2016-04-06 – 8 It's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without #298862 Informative Authentication Medium 2017-12-26 – 7 The Microsoft Store Uber App Does Not Implement Certificate Pinning #293358 Duplicate Cryptography Critical 2017-12-24 – 7 Users can falsely declare their own Uber account info on the monthly billing application #168453 Valid Authentication – 2016-10-20 – 7 Stored XSS in drive.uber.com WordPress admin panel #126099 Valid Cross-site Scripting – 2016-05-14 $2,000 7 Thumbor misconfiguration at blogapi.uber.com can lead to DoS #787240 Valid Denial of Service Medium 2021-02-25 $500 6 Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication #298990 Informative Authentication Medium 2017-12-26 – 6 ability to retrieve a user's phone-number/email for a given inviteCode #178503 Valid Information Disclosure – 2017-05-17 – 6 newsroom.uber.com is vulnerable to 'SOME' XSS attack via plupload.flash.swf #150375 Valid Command and Code Injection – 2016-08-22 – 6