Uber: RCE via npm misconfig -- installing internal libraries from the public registry

The hacker spotted some orphaned references to Uber-branded Node.js library packages and claimed them on the public NPM registry to run their own proof-of-concept code. Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies...

Uber: Unrestricted File Upload Results in Cross-Site Scripting Attacks

It was found that an attacker can upload any type of file including HTML files when adding a menu during the onboarding process after signing up at https://www.ubereats.com/restaurant/en-CA/signup. The hacker identified a file upload endpoint used by restaurants applying for Uber Eats which was...

Ex-Uber CSO Joseph Sullivan charged over 2016 data breach cover up

By Zara Khan Joseph Sullivan also paid hackers $100,000 in Bitcoin. This is a post from HackRead.com Read the original post: Ex-Uber CSO Joseph Sullivan charged over 2016 data breach cover up...

A Former Uber Exec's Indictment Is a Warning Shot

Prosecutors allege that former Uber security chief Joseph Sullivan covered up a major breach, in the first high-profile case of its kind...

Former Uber CSO Charged With Paying ‘Hush Money’ in 2016 Breach Cover-Up

A former Uber security executive has been charged for his role in the cover-up of a massive 2016 data breach, in which attackers accessed the company’s Amazon Web Services accounts and stole data associated with 57 million passengers and drivers. The U.S. State Attorney for the Northern District ...

Former Uber Security Chief Charged Over Covering Up 2016 Data Breach

The federal prosecutors in the United States have charged Uber's former chief security officer,Joe Sullivan , for covering up a massive data breach that the ride-hailing company suffered in 2016. According to the press release published by the U.S. Department of Justice, Sullivan "took deliberate...

Former Uber Security Chief Charged Over Covering Up 2016 Data Breach

The federal prosecutors in the United States have charged Uber's former chief security officer, Joe Sullivan, for covering up a massive data breach that the ride-hailing company suffered in 2016. According to the press release published by the U.S. Department of Justice, Sullivan "took deliberate...

Uber: Critical Information disclosure of rtapi token for any user via https://video-support-staging.uber.com/video/api/getPopulousUser

The researcher has identified that the API endpoint can be leveraged to return a sensitivetoken that can be leveraged for access to rtapi endpoints. As example change x-uber-token value with the following found code:...

Hundreds of Uber Eats User records leaked on Dark Web

By Zara Khan User records of Uber Eats, an American online food ordering service, have been leaked by... This is a post from HackRead.com Read the original post: Hundreds of Uber Eats User records leaked on Dark Web...

SQL Injection Vulnerability in the Website Building System of Ruian Uber Technology Co. Ltd (CNVD-2020-48644)

Ltd. is a social mass to provide web design and production, Baidu / Google SEO optimization and promotion, cell phone website, WeChat public platform, foreign trade monitoring enterprise mailboxes and other network information consulting services, product albums catalogs, corporate CD-ROM design...

Verizon Media, PayPal, Twitter Top Bug-Bounty Rankings

Bug-bounty programs have become a popular way for vendors to root out security flaws in their platforms, attracting talented white-hats with the promise of big rewards. According to HackerOne’s 2020 List of the Top 10 Bug Bounty Programs on its platform, Verizon Media, PayPal and Uber are in the...

uber-partner-hr.com Improper Access Control vulnerability

Open Bug Bounty ID: OBB-1151927 Security Researcher SahilMore Helped patch 2 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting uber-partner-hr.com website and its users. Following...

Uber: Exposed█████████in apk file - devbuilds.uber.com

Sensitive information was disclosed because of internal token leakage...

Uber: Cookie Bombing cause DOS - businesses.uber.com

Cookie Bombing cause DOS on businesses.uber.com...

Uber: Disclosure of Co-Rider user (Uber-pooling) profile picture at Amazon AWS Cloudfront within HTTP RESPONSE

After booking a shared ride, an attacker is able to access the profile picture of a co-rider. It is possible during the trip to view the co-rider's picture...

About the security content of Xcode 11.3 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...

Uber: Thumbor misconfiguration at blogapi.uber.com can lead to DoS

The subdomain blogapi.uber.com is internally downloading images from external sources and resizing it to arbitrary values, then sending a response to the user...

Two Hackers Who Extorted Money From Uber and LinkedIn Plead Guilty

Two grey hat hackers have pleaded guilty to blackmailing Uber, LinkedIn, and other U.S. corporations for money in exchange for promises to delete data of millions of customers they had stolen in late 2016. In a San Jose courthouse in California on Wednesday, Brandon Charles Glover 26 of Florida a...

Two Hackers Who Extorted Money From Uber and LinkedIn Plead Guilty

Two grey hat hackers have pleaded guilty to blackmailing Uber, LinkedIn, and other U.S. corporations for money in exchange for promises to delete data of millions of customers they had stolen in late 2016. In a San Jose courthouse in California on Wednesday, Brandon Charles Glover 26 of Florida a...

Uber: Change the rating of any trip, therefore change the average driver rating

The endpoint used for rating the driver did not validate correctly if the trip corresponded to one made per user logged in, therefore knowing the tripUUID, driverUUID and userId made it possible to change the rating of any trip. Attack scenario: a bad driver with poor ratings and programming skil...