Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Program | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|---|
| BAD Code !#180074 | N/A | Paragon Initiative Enterprises | Command and Code Injection | None | 2016-11-04 | – | 549 |
| Partial disclosure of report activity through new "Export as .zip" featureAnalysed#182358 | Valid | HackerOne | Information Disclosure | High | 2016-11-29 | $10,000 | 355 |
| Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Analysed#143717 | Valid | Uber | Authentication | – | 2016-07-14 | – | 312 |
| Internal attachments can be exported via "Export as .zip" featureAnalysed#186230 | Valid | HackerOne | Information Disclosure | High | 2016-11-30 | $12,500 | 269 |
| XSS At "pages.et.uber.com"#156098 | N/A | Uber | Cross-site Scripting | – | 2016-08-19 | – | 267 |
| Oracle Webcenter Sites administrative and hi-privilege access available directly from the internet (/cs/Satellite)#170532 | No longer public | LocalTapiola | Denial of Service | – | 2016-12-15 | $18,000 | 264 |
| Stored XSS in developer.uber.comAnalysed#131450 | Valid | Uber | Cross-site Scripting | – | 2016-06-27 | $7,500 | 223 |
| Web Authentication Endpoint Credentials Brute-Force VulnerabilityAnalysed#127844 | Valid | HackerOne | Authentication | – | 2016-06-23 | – | 161 |
| Hacker.One Subdomain TakeoverAnalysed#159156 | Valid | HackerOne | Misconfiguration and Insecure Design | Low | 2016-09-20 | – | 154 |
| DMARC Not found for paragonie.com URGENT#179828 | Spam | Paragon Initiative Enterprises | Injection and Smuggling | Critical | 2016-11-03 | – | 147 |
| Reading Emails in Uber SubdomainsAnalysed#156536 | Valid | Uber | Authentication | – | 2016-09-14 | – | 141 |
| uber.com may RCE by Flask Jinja2 Template InjectionAnalysed#125980 | Valid | Uber | Command and Code Injection | – | 2016-04-06 | $10,000 | 137 |
| Race Conditions in Popular reports feature.Analysed#146845 | Valid | HackerOne | Memory Corruption | – | 2016-08-03 | – | 125 |
| [Critical] Delete any account#158872 | No longer public | OLX | Misconfiguration and Insecure Design | – | 2016-09-01 | – | 115 |
| Read files on application server, leads to RCEAnalysed#178152 | Valid | GitLab | Information Disclosure | Critical | 2016-11-03 | – | 114 |
| Subdomain takeover on http://fastly.sc-cdn.net/Analysed#154425 | Valid | Snapchat | Misconfiguration and Insecure Design | – | 2016-08-22 | $3,000 | 114 |
| Bypassing Digits web authentication's host validation with HPPAnalysed#114169 | Valid | X / xAI | Authentication | – | 2016-08-12 | – | 108 |
| Subdomain takeover on happymondays.starbucks.com due to non-used AWS S3 DNS recordAnalysed#186766 | Valid | Starbucks | Access Control | High | 2016-12-19 | – | 105 |
| Stored XSS on team.slack.com using new Markdown editor of posts inside the Editing mode and using javascript-URIsAnalysed#132104 | Valid | Slack | Cross-site Scripting | – | 2016-09-01 | – | 103 |
| Base alpha version code exposureAnalysed#167859 | Valid | Eternal | Information Disclosure | – | 2016-10-14 | – | 99 |
| SQL Injection on sctrack.email.uber.com.cnAnalysed#150156 | Valid | Uber | SQL Injection | – | 2016-07-25 | $4,000 | 93 |
| Unauthenticated Docker registryAnalysed#179103 | Valid | Imgur | Authentication | – | 2016-11-22 | – | 92 |
| [CRITICAL] -- Complete Account Takeover#136885 | Valid | Uber | Authentication | – | 2016-08-15 | $8,000 | 89 |
| Html Injection and Possible XSS in sms-be-vip.twitter.comAnalysed#150179 | Valid | X / xAI | Cross-site Scripting | – | 2016-08-28 | – | 83 |
| OneLogin authentication bypass on WordPress sites via XMLRPCAnalysed#138869 | Valid | Uber | Command and Code Injection | – | 2016-07-15 | $7,000 | 83 |
| Access to internal CMS containing private DataAnalysed#100926 | Valid | Yelp | Authentication | – | 2016-10-07 | – | 83 |
| Possibility to get private email using UUIDAnalysed#127158 | Valid | Uber | Information Disclosure | – | 2016-06-15 | – | 82 |
| Subdomain takeover due to unclaimed Amazon S3 bucket on a2.bime.ioAnalysed#121461 | Valid | Bime | Cross-site Scripting | – | 2016-06-22 | – | 77 |
| Bypass rate limiting on /users/password (possibly site-wide rate limit bypass?)Analysed#170310 | Valid | HackerOne | Misconfiguration and Insecure Design | None | 2016-12-08 | – | 76 |
| RCE on facebooksearch.algolia.comAnalysed#134321 | Valid | Algolia | Command and Code Injection | – | 2016-10-01 | $500 | 74 |
| Changing paymentProfileUuid when booking a trip allows free ridesAnalysed#162809 | Valid | Uber | Cross-Site Request Forgery | – | 2016-09-15 | – | 73 |
| OSX slack:// protocol handler javascript injectionAnalysed#79348 | Valid | Slack | Command and Code Injection | – | 2016-06-24 | – | 72 |
| Stealing livechat token and using it to chat as the user - user information disclosureAnalysed#151058 | Valid | Shopify | Authentication | – | 2016-07-19 | – | 71 |
| Blind Stored XSS Against Lahitapiola Employees - Session and Information leakage#135154 | No longer public | LocalTapiola | Cross-site Scripting | – | 2016-07-13 | $5,000 | 70 |
| WordPress Flash XSS in *flashmediaelement.swf*Analysed#134546 | Valid | Automattic | Cross-site Scripting | – | 2016-07-10 | – | 70 |
| CSRF protection bypass on any Django powered site via Google AnalyticsAnalysed#26647 | Valid | Django | No weakness recorded | – | 2016-09-26 | – | 70 |
| Subdomain takeover on rider.uber.com due to non-existent distribution on CloudfrontAnalysed#175070 | Valid | Uber | Access Control | – | 2016-12-12 | – | 69 |
| xss in https://www.uber.comAnalysed#145278 | Valid | Uber | Cross-site Scripting | – | 2016-07-25 | – | 64 |
| [CRITICAL] Full account takeover using CSRFAnalysed#127703 | Valid | Bumble | Cross-Site Request Forgery | – | 2016-04-12 | – | 63 |
| Ability to access all user authentication tokens, leads to RCEAnalysed#158330 | Valid | GitLab | Access Control | Critical | 2016-11-03 | – | 61 |
| Remote Code Execution (upload)Analysed#116575 | Valid | Legal Robot | Misconfiguration and Insecure Design | – | 2016-08-26 | – | 60 |
| OneLogin authentication bypass on WordPress sitesAnalysed#136169 | Valid | Uber | Authentication | – | 2016-06-06 | $10,000 | 58 |
| Subdomain takeover on partners.ubnt.com due to non-used CloudFront DNS entryAnalysed#145224 | Valid | Ubiquiti Inc. | Access Control | – | 2016-11-27 | – | 57 |
| Blind OOB XXE At "http://ubermovement.com/"Analysed#154096 | Valid | Uber | Command and Code Injection | – | 2016-08-08 | $500 | 56 |
| Urgent: attacker can access every data source on BimeAnalysed#149907 | Valid | Bime | Information Disclosure | – | 2016-07-27 | – | 56 |
| Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com#172137 | Duplicate | Ubiquiti Inc. | Cross-Site Request Forgery | High | 2016-11-29 | – | 55 |
| Multiple vulnerabilities in a WordPress plugin at drive.uber.comAnalysed#135288 | Valid | Uber | SQL Injection | – | 2016-08-23 | – | 55 |
| Administrator access to a Django Administration Panel on *.sc-corp.net via bruteforced credentialsAnalysed#128114 | Valid | Snapchat | Authentication | – | 2016-07-14 | $1,000 | 54 |
| Possibility to attach any mobile number to any email#18992 | No longer public | Mail.ru | Authentication | – | 2016-07-18 | – | 54 |
| SSRF in https://imgur.com/vidgif/urlAnalysed#115748 | Valid | Imgur | Denial of Service | – | 2016-03-12 | – | 52 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,614 analysed so far), which can be wrong. Data as of 2026-11-15.