Browse / Uber

Uber

See its reports on the map

Attack surface: 11,394 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Uber

• Cross-site Scripting52
• Information Disclosure50
• Authentication42
• Misconfiguration19
• Code Execution11
• Access Control11

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Server version disclosureInformativeInformation Disclosure
   13 votes
2. Google Maps API Key LeakageInformativeInformation Disclosure
   8 votes
3. stack trace exposed on https://receipts.uber.com/InformativeInformation Disclosure · medium
   8 votes
4. Can add employee in business.uber.com without add payment methodInformativeImproper Authentication - Generic
   8 votes
5. It's possible to view configuration and/or source code on uchat.awscorp.uberinternal.com without InformativeImproper Authentication - Generic · medium
   7 votes
6. Configuration and/or source code files on uchat-staging.uberinternal.com can be viewed without OneLogin SSO Authentication InformativeImproper Authentication - Generic · medium
   6 votes
7. Stored Cross Site Scripting [SELF] in partners.uber.comInformativeCross-site Scripting (XSS) - Generic
   6 votes
8. The Uber Promo Customer Endpoint Does Not Implement Multifactor Authentication, Blacklisting or Rate LimitingInformativeImproper Restriction of Authentication Attempts · high
   5 votes
9. Email Address EnumerationInformativeViolation of Secure Design Principles
   5 votes
10. Password Reset Does Not Confirm the Existence of an Email AddressInformativeImproper Authentication - Generic
    5 votes
11. Defect-Security | Driver-Broken Authentication | Able to update the Subscription Setting anonymouslyInformativeImproper Authentication - Generic
    5 votes
12. XSS in uber oauthInformativeCross-site Scripting (XSS) - Generic
    5 votes
13. Authentication Issue for easter egg on bonjour.uber.comInformativeImproper Authentication - Generic
    4 votes
14. Header Injection InformativeUncontrolled Resource Consumption
    4 votes
15. Missing authentication on Notification setting .InformativeImproper Authentication - Generic
    4 votes
16. XSS via password recoveringInformativeCross-site Scripting (XSS) - Generic
    4 votes
17. Disclosure of ways to the site rootInformativeInformation Disclosure
    4 votes
18. text injection in get.uber.com/check-otpInformativeViolation of Secure Design Principles
    4 votes
19. LIsting of http://archive.uber.com/pypi/simple/InformativeInformation Disclosure
    4 votes
20. The Microsoft Store Uber App Does Not Implement Server-side Token RevocationInformativeInsufficient Session Expiration · medium
    3 votes
21. Text Only Content Spoofing on ubermovement.com Community PageInformativeViolation of Secure Design Principles
    3 votes
22. Newsroom.uber HTML form without CSRF protectionInformativeCross-Site Request Forgery (CSRF)
    3 votes
23. Email Enumeration VulnerabilityInformativeInformation Disclosure
    3 votes
24. Phone Number EnumerationInformativeInformation Disclosure
    3 votes
25. Self-XSS on partners.uber.comInformativeCross-site Scripting (XSS) - Generic
    3 votes
26. Uber for Business Allows Administrators to Change Uber Driver Ratings Due to Failure to Authenticate `fast-rating` Endpoint InformativeImproper Authentication - Generic
    3 votes
27. Information Disclosure on lite.uber.comInformativeInformation Disclosure
    3 votes
28. Unsubscribe any user from receiving emailInformativeViolation of Secure Design Principles
    3 votes
29. Create account in uber without signup formInformativeImproper Authentication - Generic
    3 votes
30. User Enumeration and Information DisclosureInformativeInformation Disclosure
    2 votes
31. faspex.uber.com uses an invalid SSL certificateInformativeCryptographic Issues - Generic
    2 votes
32. Server version disclosure: team.uberinternal.comInformativeInformation Disclosure
    2 votes
33. Information disclosure at lite.uber.comInformativeInformation Disclosure
    2 votes
34. Session Impersonation in riders.uber.comInformativeImproper Authentication - Generic
    2 votes
35. It is possible to re-rate a driver after a very long time InformativeViolation of Secure Design Principles
    2 votes
36. Pixel flood attack in https://riders.uber.com/profileInformativeUncontrolled Resource Consumption
    2 votes
37. Disclosure of ip addresses in local network of uberInformativeInformation Disclosure
    2 votes
38. Cross-site Scripting (XSS) autocomplete generation in https://www.uber.com/InformativeCross-site Scripting (XSS) - Generic
    2 votes
39. Active Email Hyperlink Sent on riders.uber.comInformativeViolation of Secure Design Principles
    2 votes
40. Design Issue at riders.uber.com/profileInformativeBusiness Logic Errors
    1 votes
41. Command Injection, Information InformativeCommand Injection - Generic
    1 votes
42. Error Message on 404 pageInformative
    1 votes
43. DOM based XSS onInformativeCode Injection
    1 votes
44. Clickjacking in love.uber.comInformativeViolation of Secure Design Principles
    1 votes
45. developer.uber.com/404 and developer.uber.com/docs/404 are susceptible to iframesInformative
    1 votes
46. Brute Forcing rider-view Endpoint Allows for Counting Number of Active Uber DriversInformativeInformation Disclosure
    1 votes
47. Changing Driver Passwords With Only an Authenticated Session (no password, no email)InformativeViolation of Secure Design Principles
    1 votes
48. Uploading Plain Text to uber-documents.s3.amazonaws.com Through the Driver Document Upload PageInformativeViolation of Secure Design Principles
    1 votes
49. Brute Force Amplification AttackInformativeViolation of Secure Design Principles
    1 votes