Browse / Uber

Uber

See its reports on the map

What gets reported to Uber

• Cross-site Scripting52
• Information Disclosure50
• Authentication42
• Misconfiguration19
• Code Execution11
• Access Control11

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameterInformation Disclosure · high
   643 votes
2. [Pre-Submission][H1-4420-2019] API access to Phabricator on code.uberinternal.com from leaked certificate in git repoInsecure Storage of Sensitive Information · critical
   $40,000458 votes
3. Chained Bugs to Leak Victim's Uber's FB Oauth TokenImproper Authentication - Generic · high
   427 votes
4. Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sgCleartext Transmission of Sensitive Information · high
   $4,000376 votes
5. RCE via npm misconfig -- installing internal libraries from the public registryCode Injection · critical
   $9,000325 votes
6. Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)Improper Authentication - Generic
   312 votes
7. XSS At "pages.et.uber.com"N/ACross-site Scripting (XSS) - Generic
   267 votes
8. Stored XSS in developer.uber.comCross-site Scripting (XSS) - Generic
   $7,500223 votes
9. Unauthorized access to █████████.com allows access to Uber Brazil tax documents and system.Improper Access Control - Generic · low
   $4,500210 votes
10. Authentication bypass on auth.uber.com via subdomain takeover of saostatic.uber.comImproper Authentication - Generic · critical
    183 votes
11. Open Redirect on central.uber.com allows for account takeoverImproper Authentication - Generic · high
    144 votes
12. Reading Emails in Uber SubdomainsImproper Authentication - Generic
    141 votes
13. uber.com may RCE by Flask Jinja2 Template InjectionCode Injection
    $10,000137 votes
14. [First 30] Stored XSS on login.uber.com/oauth/v2/authorize via redirect_uri parameterCross-site Scripting (XSS) - Stored · high
    $3,000131 votes
15. Client secret, server tokens for developer applications returned by internal APIInformation Disclosure
    125 votes
16. IDOR leads to leak analytics of any restaurantInsecure Direct Object Reference (IDOR) · medium
    123 votes
17. Reflected XSS on https://www.uber.com Cross-site Scripting (XSS) - Reflected · high
    114 votes
18. IDOR leads to See analytics of Loyalty Program in any restaurant.Insecure Direct Object Reference (IDOR) · medium
    112 votes
19. ubernycmarketplace.com is vulnerable to the Heartbleed BugInformation Disclosure · low
    $1,500112 votes
20. Stored XSS on any page in most Uber domainsCross-site Scripting (XSS) - Stored · high
    $6,000107 votes
21. password reset token leaking allowed for ATO of an Uber accountImproper Authentication - Generic · critical
    $10,000100 votes
22. SQL Injection on sctrack.email.uber.com.cnSQL Injection
    $4,00093 votes
23. private passenger information is exposed to the Uber Driver app during ride dispatch ("Ping") eventsInformation Disclosure · medium
    91 votes
24. Complete Admin account takeover due to PhpDebugBar turned on in Uber's production serverMisconfiguration · medium
    90 votes
25. [CRITICAL] -- Complete Account TakeoverImproper Authentication - Generic
    $8,00089 votes
26. SAML Authentication Bypass on uchat.uberinternal.comImproper Authentication - Generic · high
    $8,50088 votes
27. OneLogin authentication bypass on WordPress sites via XMLRPCCode Injection
    $7,00083 votes
28. Lack of proper paymentProfileUUID validation allows any number of free rides without any outstanding balanceBusiness Logic Errors · medium
    82 votes
29. Possibility to get private email using UUIDInformation Disclosure
    82 votes
30. Pre-auth Remote Code Execution on multiple Uber SSL VPN serversCommand Injection - Generic · critical
    $2,00080 votes
31. Subdomain takeover at signup.uber.comPrivilege Escalation · high
    79 votes
32. Changing paymentProfileUuid when booking a trip allows free ridesCross-Site Request Forgery (CSRF)
    73 votes
33. Open AWS S3 bucket at ubergreece.s3.amazonaws.com exposes confidential internal documents and filesInformation Disclosure · low
    $50070 votes
34. Subdomain takeover on rider.uber.com due to non-existent distribution on CloudfrontPrivilege Escalation
    69 votes
35. Lack of payment type validation in dial.uber.com allows for free ridesBusiness Logic Errors · high
    68 votes
36. Chain of IDORs Between U4B and Vouchers APIs Allows Attackers to View and Modify Program/Voucher Policies and to Obtain Organization Employees' PIIInsecure Direct Object Reference (IDOR) · high
    64 votes
37. xss in https://www.uber.comCross-site Scripting (XSS) - Generic
    64 votes
38. Authorization issue in Google G Suite allows DoS through HTTP redirectUncontrolled Resource Consumption · high
    62 votes
39. Hack The World 2017 Top 2 Bonus
    $5,00061 votes
40. SQL injection in 3rd party software AnomaliSQL Injection · high
    $2,50061 votes
41. Chain of vulnerabilities in Uber for Business Vouchers program allows for attacker to perform arbitrary charges to victim's U4B payment accountInsecure Direct Object Reference (IDOR) · high
    $5,75058 votes
42. Unrestricted File Upload Results in Cross-Site Scripting AttacksCross-site Scripting (XSS) - Stored · medium
    58 votes
43. OneLogin authentication bypass on WordPress sitesImproper Authentication - Generic
    $10,00058 votes
44. Blind OOB XXE At "http://ubermovement.com/"Command Injection - Generic
    $50056 votes
45. Multiple vulnerabilities in a WordPress plugin at drive.uber.comSQL Injection
    55 votes
46. [manage.jumpbikes.com] Blind XSS on Jump admin panel via user nameCross-site Scripting (XSS) - Stored · critical
    54 votes
47. Stored XSS on auth.uber.com/oauth/v2/authorize via redirect_uri parameter leads to Account TakeoverCross-site Scripting (XSS) - Stored · medium
    $3,00052 votes
48. Possibility to inject a malicious JavaScript code in any file on tags.tiqcdn.com results in a stored XSS on any page in most Uber domainsCross-site Scripting (XSS) - Stored · high
    $6,00051 votes
49. [uchat.uberinternals.com] Mattermost doesn't check Origin in Websockets, which leads to the Critical Inforamation Leakage.Cross-Site Request Forgery (CSRF) · critical
    $2,00050 votes
50. Critical Information disclosure of rtapi token for any user via https://video-support-staging.uber.com/video/api/getPopulousUserInformation Disclosure · critical
    49 votes
51. Avoiding Surge PricingViolation of Secure Design Principles
    45 votes
52. Change the rating of any trip, therefore change the average driver ratingBusiness Logic Errors · medium
    $1,50043 votes
53. Publicly exposed HashiCorp Vault (Secrets management) at usec-gcp-staging.uberinternal.com & usec-gcp.uberinternal.comInformation Disclosure
    43 votes
54. SQLI on uberpartner.eu leads to exposure of sensitive user data of Uber partnersSQL Injection · high
    $1,50043 votes
55. Reflected XSS on multiple uberinternal.com domainsCross-site Scripting (XSS) - Reflected · medium
    $2,00041 votes
56. DOM based XSS via insecure parameter on [ https://uberpay-mock-psp.uber.com ]Cross-site Scripting (XSS) - DOM · medium
    39 votes
57. CVE-2020-3452 - unauthenticated file read on anyconnect.routematch.comPath Traversal · medium
    39 votes
58. Reflected XSS in lert.uber.comCross-site Scripting (XSS) - Reflected · medium
    39 votes
59. SQL injection in Wordpress Plugin Huge IT Video Gallery at https://drive.uber.com/frmarketplace/SQL Injection
    $3,00039 votes
60. Arbitrary File Reading on Uber SSL VPNPlaintext Storage of a Password · high
    $6,50038 votes
61. Reflected XSS on https://www.uber.comCross-site Scripting (XSS) - Reflected · medium
    $1,00037 votes
62. [data-07.uberinternal.com] SSRF in Portainer app lead to access to Internal Docker API without AuthServer-Side Request Forgery (SSRF) · critical
    $50037 votes
63. Stored XSS on developer.uber.com via admin account compromiseCross-site Scripting (XSS) - Generic
    $5,00037 votes
64. phone number exposure for riders/drivers given email/uuidInformation Exposure Through an Error Message · medium
    36 votes
65. Attacker could setup reminder remotely using brute forceN/ACross-Site Request Forgery (CSRF)
    36 votes
66. HTML injection via insecure parameter [https://www.ubercarshare.com/]Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · medium
    35 votes
67. API on campus-vtc.com allows access to ~100 Uber users full names, email addresses and telephone numbers.Information Disclosure · high
    $75035 votes
68. Stealing users password (Limited Scenario)Violation of Secure Design Principles
    35 votes
69. Possibility to brute force invite codes in riders.uber.comViolation of Secure Design Principles
    $5,00035 votes
70. Reflected XSS on developer.uber.com via Angular template injectionCross-site Scripting (XSS) - Generic
    $3,00035 votes
71. Full Path and internal information disclosure+ SQLNet.log file disclose internal network informationInformation Disclosure · low
    34 votes
72. pam_ussh does not properly validate the SSH certificate authorityImproper Authentication - Generic · medium
    31 votes
73. Reflected XSS on Partners SubdomainCross-site Scripting (XSS) - Reflected · high
    $2,00031 votes
74. Reflected XSS POST method at partners.uber.comCross-site Scripting (XSS) - Reflected · medium
    $3,00031 votes
75. Full read SSRF in flyte-poc-us-east4.uberinternal.comServer-Side Request Forgery (SSRF) · medium
    $2,00030 votes
76. Subdomain takeover on mta1a1.spmail.uber.comImproper Access Control - Generic · medium
    30 votes
77. Site-wide CSRF on eats.uber.comCross-Site Request Forgery (CSRF) · high
    30 votes
78. 4 Subdomains Takeover on 2 domains ( muberscolombia.com & ubereats.pl )Privilege Escalation · medium
    $50029 votes
79. Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employeesPrivilege Escalation · medium
    29 votes
80. SQLI on desafio5estrelas.com SQL Injection · medium
    $2,50029 votes
81. Information Leakage - GitHub - VCenter configuration scripts, StorMagic usernames and password along with default ESXi root passwordImproper Authentication - Generic · medium
    $1,00029 votes
82. Improper Access Control on Onelogin in multi-layered architectureImproper Access Control - Generic
    $50029 votes
83. Outdated Wordpress installation and plugins at www.uberxgermany.com create CSRF and XSS vulnerabilitiesCross-Site Request Forgery (CSRF) · medium
    $50029 votes
84. Exposed█████████in apk file - devbuilds.uber.comInformation Disclosure · high
    28 votes
85. IDOR in activateFuelCard id allows bulk lookup of driver uuidsInsecure Direct Object Reference (IDOR) · low
    28 votes
86. duplicate hsts headers lead to firefox ignoring hsts on business.uber.comMisconfiguration · low
    $50027 votes
87. Get organization info base on uuidImproper Authentication - Generic
    $3,00026 votes
88. Possible to View Driver Waybill via Driver UUIDInformation Disclosure
    24 votes
89. Possibility to enumerate and bruteforce promotion codes in Uber iOS AppImproper Restriction of Authentication Attempts · medium
    $3,00024 votes
90. pam-ussh may be tricked into using another logged in user's ssh-agentImproper Authentication - Generic · medium
    23 votes
91. IDOR on partners.uber.com allows for a driver to override administrator documentsInsecure Direct Object Reference (IDOR) · medium
    23 votes
92. Uber Test Report 20220301Business Logic Errors · medium
    22 votes
93. CBC "cut and paste" attack may cause Open Redirect(even XSS)Cryptographic Issues - Generic
    $50022 votes
94. Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.comPrivilege Escalation
    21 votes
95. XSS @ love.uber.comCross-site Scripting (XSS) - Generic
    21 votes
96. Cleartext password exposure allows access to the desafio5estrelas.com admin panelCleartext Storage of Sensitive Information · medium
    $50020 votes
97. deleting payment profile during active trip puts account into arrears but active trip is temporarily “free”Business Logic Errors
    20 votes
98. XSS on partners.uber.com due to no user input sanitisation Cross-site Scripting (XSS) - Generic · low
    $1,00018 votes
99. Stored XSS on newsroom.uber.com admin panel / Stream WordPress pluginCross-site Scripting (XSS) - Generic
    $5,00018 votes
100. Multiple Vulnerabilities (Including SQLi) in love.uber.comDuplicateSQL Injection
     18 votes