IDOR leads to leak analytics of any restaurant Analysed #1116387 Valid Insecure Direct Object Reference Medium 2021-04-29 – 123 IDOR leads to See analytics of Loyalty Program in any restaurant. Analysed #1137819 Valid Insecure Direct Object Reference Medium 2021-05-28 – 112 Complete Admin account takeover due to PhpDebugBar turned on in Uber's production server Analysed #1883806 Valid Misconfiguration and Insecure Design Medium 2023-08-23 – 90 Lack of proper paymentProfileUUID validation allows any number of free rides without any outstanding balance Analysed #574638 Valid Input Validation and Logic Medium 2019-07-18 – 82 Unrestricted File Upload Results in Cross-Site Scripting Attacks Analysed #1005355 Valid Cross-site Scripting Medium 2021-05-14 – 58 Stored XSS on auth.uber.com/oauth/v2/authorize via redirect_uri parameter leads to Account Takeover #397497 Valid Cross-site Scripting Medium 2021-02-25 $3,000 52 Change the rating of any trip, therefore change the average driver rating #724522 Valid Input Validation and Logic Medium 2020-04-06 $1,500 43 Reflected XSS on multiple uberinternal.com domains #326449 Valid Cross-site Scripting Medium 2018-11-13 $2,000 41 DOM based XSS via insecure parameter on [ https://uberpay-mock-psp.uber.com ] #1767151 Valid Cross-site Scripting Medium 2023-03-23 – 39 CVE-2020-3452 - unauthenticated file read on anyconnect.routematch.com #1257100 Valid File and Path Handling Medium 2021-08-05 – 39 Reflected XSS in lert.uber.com #191810 Valid Cross-site Scripting Medium 2018-12-19 – 39 Reflected XSS on https://www.uber.com #708081 Valid Cross-site Scripting Medium 2021-02-24 $1,000 37 phone number exposure for riders/drivers given email/uuid #225243 Valid Information Disclosure Medium 2017-06-02 – 36 HTML injection via insecure parameter [https://www.ubercarshare.com/] #1790444 Valid Cross-site Scripting Medium 2023-03-23 – 35 pam_ussh does not properly validate the SSH certificate authority #1177356 Valid Authentication Medium 2021-07-21 – 31 Full read SSRF in flyte-poc-us-east4.uberinternal.com #1540906 Valid Server-Side Request Forgery Medium 2022-05-26 $2,000 30 Subdomain takeover on mta1a1.spmail.uber.com #707748 Valid Access Control Medium 2020-04-06 – 30 4 Subdomains Takeover on 2 domains ( muberscolombia.com & ubereats.pl ) #1116545 Valid Access Control Medium 2021-04-29 $500 29 Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employees #1063022 Valid Access Control Medium 2021-05-14 – 29 SQLI on desafio5estrelas.com #476150 Valid SQL Injection Medium 2021-03-29 $2,500 29 Information Leakage - GitHub - VCenter configuration scripts, StorMagic usernames and password along with default ESXi root password #365199 Valid No weakness recorded Medium 2018-08-27 $1,000 29 Outdated Wordpress installation and plugins at www.uberxgermany.com create CSRF and XSS vulnerabilities #323899 Valid Cross-Site Request Forgery Medium 2021-02-25 $500 29 pam-ussh may be tricked into using another logged in user's ssh-agent #204802 Valid Authentication Medium 2017-03-20 – 23 IDOR on partners.uber.com allows for a driver to override administrator documents #194594 Valid Insecure Direct Object Reference Medium 2018-12-19 – 23 Uber Test Report 20220301 #1496297 Valid Input Validation and Logic Medium 2022-03-03 – 22 Cleartext password exposure allows access to the desafio5estrelas.com admin panel #344566 Valid Cryptography Medium 2021-03-30 $500 20 Reflected XSS in https://eng.uberinternal.com and https://coeshift.corp.uber.internal/ #354686 Valid Cross-site Scripting Medium 2018-11-13 $500 16 Lack of CSRF protection on uberps.com makes every form vulnerable to CSRF #343120 Valid Cross-Site Request Forgery Medium 2021-03-15 $500 15 Unsecured Dropwizard Admin Panel on display.uber-adsystem.com exposes sensitive server information #651355 Valid Cryptography Medium 2021-03-15 $500 12 No rate limiting on https://biz.uber.com/confirm allowed an attacker to join arbitrary business.uber.com accounts #281344 Valid Authentication Medium 2018-11-13 – 12 XSS in ubermovement.com via editable Google Sheets #193799 Valid Cross-site Scripting Medium 2018-12-19 $2,000 11 Information Leak - GitHub - Endpoint Configuration Details #378558 Valid Information Disclosure Medium 2018-08-27 – 8 stack trace exposed on https://receipts.uber.com/ #204568 Informative Information Disclosure Medium 2021-02-25 – 8 It's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without #298862 Informative Authentication Medium 2017-12-26 – 7 Thumbor misconfiguration at blogapi.uber.com can lead to DoS #787240 Valid Denial of Service Medium 2021-02-25 $500 6 Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication #298990 Informative Authentication Medium 2017-12-26 – 6 [experience.uber.com] Node.js source code disclosure & anonymous access to internal Uber documents, templates and tools #389078 Valid Information Disclosure Medium 2021-02-23 – 5 The Microsoft Store Uber App Does Not Implement Server-side Token Revocation #293363 Informative Authentication Medium 2017-12-24 – 3