Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical) Analysed #143717 Valid Authentication – 2016-07-14 – 312 XSS At "pages.et.uber.com" #156098 N/A Cross-site Scripting – 2016-08-19 – 267 Stored XSS in developer.uber.com Analysed #131450 Valid Cross-site Scripting – 2016-06-27 $7,500 223 Reading Emails in Uber Subdomains Analysed #156536 Valid Authentication – 2016-09-14 – 141 uber.com may RCE by Flask Jinja2 Template Injection Analysed #125980 Valid Command and Code Injection – 2016-04-06 $10,000 137 SQL Injection on sctrack.email.uber.com.cn Analysed #150156 Valid SQL Injection – 2016-07-25 $4,000 93 [CRITICAL] -- Complete Account Takeover #136885 Valid Authentication – 2016-08-15 $8,000 89 OneLogin authentication bypass on WordPress sites via XMLRPC Analysed #138869 Valid Command and Code Injection – 2016-07-15 $7,000 83 Possibility to get private email using UUID Analysed #127158 Valid Information Disclosure – 2016-06-15 – 82 Changing paymentProfileUuid when booking a trip allows free rides Analysed #162809 Valid Cross-Site Request Forgery – 2016-09-15 – 73 Subdomain takeover on rider.uber.com due to non-existent distribution on Cloudfront Analysed #175070 Valid Access Control – 2016-12-12 – 69 xss in https://www.uber.com #145278 Valid Cross-site Scripting – 2016-07-25 – 64 OneLogin authentication bypass on WordPress sites #136169 Valid Authentication – 2016-06-06 $10,000 58 Blind OOB XXE At "http://ubermovement.com/" #154096 Valid Command and Code Injection – 2016-08-08 $500 56 Multiple vulnerabilities in a WordPress plugin at drive.uber.com #135288 Valid SQL Injection – 2016-08-23 – 55 Avoiding Surge Pricing #125250 Valid Misconfiguration and Insecure Design – 2016-08-11 – 45 SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/ #125932 Valid SQL Injection – 2016-06-14 $3,000 39 Stored XSS on developer.uber.com via admin account compromise #152067 Valid Cross-site Scripting – 2016-08-12 $5,000 37 Attacker could setup reminder remotely using brute force #158393 N/A Cross-Site Request Forgery – 2016-09-19 – 36 Stealing users password (Limited Scenario) #163067 Valid Misconfiguration and Insecure Design – 2016-09-29 – 35 Possibility to brute force invite codes in riders.uber.com #125505 Valid Misconfiguration and Insecure Design – 2016-06-13 $5,000 35 Reflected XSS on developer.uber.com via Angular template injection #125027 Valid Cross-site Scripting – 2016-04-04 $3,000 35 Get organization info base on uuid #151465 Valid Authentication – 2016-09-02 $3,000 26 Possible to View Driver Waybill via Driver UUID #127087 Valid Information Disclosure – 2016-06-14 – 24 CBC "cut and paste" attack may cause Open Redirect(even XSS) #126203 Valid Cryptography – 2016-08-12 $500 22 Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.com #149679 Valid Access Control – 2016-07-25 – 21 XSS @ love.uber.com #117068 Valid Cross-site Scripting – 2016-05-07 – 21 Stored XSS on newsroom.uber.com admin panel / Stream WordPress plugin #127948 Valid Cross-site Scripting – 2016-07-27 $5,000 18 Multiple Vulnerabilities (Including SQLi) in love.uber.com #117080 Duplicate No weakness recorded – 2016-06-14 – 18 Missing authorization checks leading to the exposure of ubernihao.com administrator accounts #154762 Valid Information Disclosure – 2016-08-15 – 15 Information regarding trips from other users #127161 Valid Information Disclosure – 2016-07-12 – 15 xss vulnerability in http://ubermovement.com/community/daniel #142946 Valid Cross-site Scripting – 2016-07-21 – 14 Server version disclosure #149483 Informative Information Disclosure – 2016-07-07 – 13 Lack of rate limiting on get.uber.com leads to enumeration of promotion codes and estimation of a lower bound on the number of Uber drivers #125200 Valid Information Disclosure – 2016-08-12 $3,000 13 Lack of CNAME/A Record Trimming Pointing Uber Domains to Insecure Non-Uber AWS Instances/Sites #125118 Valid Information Disclosure – 2016-07-13 – 13 Bulk UUID enumeration via invite codes #145150 Valid Information Disclosure – 2016-09-08 – 12 Reflected XSS via Unvalidated / Open Redirect in uber.com #125791 Valid No weakness recorded – 2016-05-09 $3,000 11 Open Redirection on Uber.com #119236 Valid Open Redirect – 2016-04-22 $500 11 [IODR] Get business trip via organization id #151470 Valid Authentication – 2016-08-15 $2,000 10 Bruteforce INVITE codes easy way #144877 Duplicate Misconfiguration and Insecure Design – 2016-07-26 – 10 Mass Assignment Vulnerability in partners.uber.com #99424 Valid Command and Code Injection – 2016-05-09 $1,000 10 Open Redirect in m.uber.com #125000 Valid No weakness recorded – 2016-09-27 $500 9 Can add employee in business.uber.com without add payment method #153175 Informative Authentication – 2016-07-26 – 8 Bypassing Uber Partner's 3 Cancel Limit #125218 Valid Command and Code Injection – 2016-05-26 $2,000 8 Reflected XSS on Uber.com careers #117190 Valid Cross-site Scripting – 2016-04-06 – 8 Users can falsely declare their own Uber account info on the monthly billing application #168453 Valid Authentication – 2016-10-20 – 7 Stored XSS in drive.uber.com WordPress admin panel #126099 Valid Cross-site Scripting – 2016-05-14 $2,000 7 newsroom.uber.com is vulnerable to 'SOME' XSS attack via plupload.flash.swf #150375 Valid Command and Code Injection – 2016-08-22 – 6 Reflected XSS via Livefyre Media Wall in newsroom.uber.com #134061 Valid Cross-site Scripting – 2016-05-09 $2,000 6 CSV Injection in business.uber.com #126109 Valid Information Disclosure – 2016-04-06 $1,000 6