Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameter Analysed #542340 Valid Information Disclosure – 2019-09-09 – 643 [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repo Analysed #591813 Valid Information Disclosure – 2021-02-25 $40,000 458 Chained Bugs to Leak Victim's Uber's FB Oauth Token Analysed #202781 Valid Authentication – 2019-01-25 – 427 Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sg Analysed #340431 Valid Cryptography – 2020-04-30 $4,000 376 RCE via npm misconfig -- installing internal libraries from the public registry Analysed #1007014 Valid Command and Code Injection – 2021-02-24 $9,000 325 Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical) Analysed #143717 Valid Authentication – 2016-07-14 – 312 Stored XSS in developer.uber.com #131450 Valid Cross-site Scripting – 2016-06-27 $7,500 223 Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system. #530441 Valid Access Control – 2021-03-06 $4,500 210 Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.com #219205 Valid Authentication – 2017-07-13 – 183 Open Redirect on central.uber.com allows for account takeover #206591 Valid Authentication – 2019-01-25 – 144 Reading Emails in Uber Subdomains #156536 Valid Authentication – 2016-09-14 – 141 uber.com may RCE by Flask Jinja2 Template Injection #125980 Valid Command and Code Injection – 2016-04-06 $10,000 137 [First 30] Stored XSS on login.uber.com/oauth/v2/authorize via redirect_uri parameter #392106 Valid Cross-site Scripting – 2021-02-25 $3,000 131 Client secret, server tokens for developer applications returned by internal API #419655 Valid Information Disclosure – 2019-02-08 – 125 IDOR leads to leak analytics of any restaurant #1116387 Valid Insecure Direct Object Reference – 2021-04-29 – 123 Reflected XSS on https://www.uber.com #390386 Valid No weakness recorded – 2021-03-15 – 114 IDOR leads to See analytics of Loyalty Program in any restaurant. #1137819 Valid Insecure Direct Object Reference – 2021-05-28 – 112 ubernycmarketplace.com is vulnerable to the Heartbleed Bug #304190 Valid Information Disclosure – 2020-04-23 $1,500 112 Stored XSS on any page in most Uber domains #217739 Valid Cross-site Scripting – 2018-11-20 $6,000 107 password reset token leaking allowed for ATO of an Uber account #173551 Valid Authentication – 2017-05-17 $10,000 100 SQL Injection on sctrack.email.uber.com.cn #150156 Valid SQL Injection – 2016-07-25 $4,000 93 private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") events #174404 Valid Information Disclosure – 2021-05-14 – 91 Complete Admin account takeover due to PhpDebugBar turned on in Uber's production server #1883806 Valid Misconfiguration and Insecure Design – 2023-08-23 – 90 [CRITICAL] -- Complete Account Takeover #136885 Valid Authentication – 2016-08-15 $8,000 89 SAML Authentication Bypass on uchat.uberinternal.com #223014 Valid Authentication – 2017-09-05 $8,500 88 OneLogin authentication bypass on WordPress sites via XMLRPC #138869 Valid Command and Code Injection – 2016-07-15 $7,000 83 Lack of proper paymentProfileUUID validation allows any number of free rides without any outstanding balance #574638 Valid Input Validation and Logic – 2019-07-18 – 82 Possibility to get private email using UUID #127158 Valid Information Disclosure – 2016-06-15 – 82 Pre-auth Remote Code Execution on multiple Uber SSL VPN servers #540242 Valid Command and Code Injection – 2021-02-24 $2,000 80 Subdomain takeover at signup.uber.com #197489 Valid Access Control – 2019-01-25 – 79 Changing paymentProfileUuid when booking a trip allows free rides #162809 Valid Cross-Site Request Forgery – 2016-09-15 – 73 Open AWS S3 bucket at ubergreece.s3.amazonaws.com exposes confidential internal documents and files #361438 Valid Information Disclosure – 2021-03-12 $500 70 Subdomain takeover on rider.uber.com due to non-existent distribution on Cloudfront #175070 Valid Access Control – 2016-12-12 – 69 Lack of payment type validation in dial.uber.com allows for free rides #162199 Valid Input Validation and Logic – 2018-11-20 – 68 Chain of IDORs Between U4B and Vouchers APIs Allows Attackers to View and Modify Program/Voucher Policies and to Obtain Organization Employees' PII #1148697 Valid Insecure Direct Object Reference – 2022-04-07 – 64 xss in https://www.uber.com #145278 Valid Cross-site Scripting – 2016-07-25 – 64 Authorization issue in Google G Suite allows DoS through HTTP redirect #191196 Valid Denial of Service – 2017-02-09 – 62 Hack The World 2017 Top 2 Bonus #300779 Valid No weakness recorded – 2018-11-13 $5,000 61 SQL injection in 3rd party software Anomali #206872 Valid SQL Injection – 2017-03-21 $2,500 61 Chain of vulnerabilities in Uber for Business Vouchers program allows for attacker to perform arbitrary charges to victim's U4B payment account #1145428 Valid Insecure Direct Object Reference – 2021-08-12 $5,750 58 Unrestricted File Upload Results in Cross-Site Scripting Attacks #1005355 Valid Cross-site Scripting – 2021-05-14 – 58 OneLogin authentication bypass on WordPress sites #136169 Valid Authentication – 2016-06-06 $10,000 58 Blind OOB XXE At "http://ubermovement.com/" #154096 Valid Command and Code Injection – 2016-08-08 $500 56 Multiple vulnerabilities in a WordPress plugin at drive.uber.com #135288 Valid SQL Injection – 2016-08-23 – 55 [manage.jumpbikes.com] Blind XSS on Jump admin panel via user name #472470 Valid Cross-site Scripting – 2021-02-23 – 54 Stored XSS on auth.uber.com/oauth/v2/authorize via redirect_uri parameter leads to Account Takeover #397497 Valid Cross-site Scripting – 2021-02-25 $3,000 52 Possibility to inject a malicious JavaScript code in any file on tags.tiqcdn.com results in a stored XSS on any page in most Uber domains #256152 Valid Cross-site Scripting – 2018-11-13 $6,000 51 [uchat.uberinternals.com] Mattermost doesn't check Origin in Websockets, which leads to the Critical Inforamation Leakage. #201326 Valid Cross-Site Request Forgery – 2023-03-23 $2,000 50 Critical Information disclosure of rtapi token for any user via https://video-support-staging.uber.com/video/api/getPopulousUser #953649 Valid Information Disclosure – 2021-03-29 – 49 Avoiding Surge Pricing #125250 Valid Misconfiguration and Insecure Design – 2016-08-11 – 45