Uber: Site-wide CSRF on eats.uber.com

There was a lack of CSRF protections on eats.uber.com which allowed an attacker to add a credit card to another account. Shortly after reporting, @vijaykumar1110 noticed other endpoints on the same domain which also lacked CSRF protections and added them to his report. Following further...