Uber: Get organization info base on uuid

Hi Uber, I found issue on https://business.uber.com/server/employees Step to reproduce: 1. Send post request to https://business.uber.com/server/employees: 2. Change userUuid of other user and then see organization info if they has valid organization and their persinol info Best ragards, Severus...

Uber: newsroom.uber.com is vulnerable to 'SOME' XSS attack via plupload.flash.swf

Limited disclosure @jamesclyde's request...

Uber: Subdomain takeover of translate.uber.com, de.uber.com and fr.uber.com

Limited disclosure at @rojanr's request Subdomains including translate.uber.com, fr.uber.com and de.uber.com were pointing to a CNAME for a site that was not claimed. I was able to claim the site and add any content. For PoC purposes, I showcased my blog on translate.uber.com and de.uber.com...

Uber: Server version disclosure

Hi uber, maybe this is a low risk but i want to report that the nginx and openresty server version are being disclosed. For openresty: Accessing this url: https://chef.uberinternal.com/ will give you an error "502 Bad Gateway" but you can see on the page that the server version was disclose...

Uber: Wordpress Vulnerabilities in transparencyreport.uber.com and eng.uber.com domains

Limited disclosure at @vivek-p's request...

Get the passenger and the owner of the personal information? This note Uber logical vulnerability“combination punches”worth a look-vulnerability warning-the black bar safety net

! Uber recently finally opened up its vulnerability reward program, and encourage white-hat gate expand on the Uber online service vulnerability mining. Please with FreeBuf xiaobian together look at this a few logical loopholes the formation of“combination of Boxing” it. Information collected...

Uber promo code vulnerability allows hackers a free ride-vulnerability warning-the black bar safety net

! Do you want to by Uber taxi services to travel free? If you are the Uber taxi service loyal users,or you've ever used Uber to call a car service,then this article will definitely make you excited. Because there is a name from the Egypt independent security researcher in the Uber app found a...

HackerOne: Know undisclosed Bounty Amount when Bounty Statistics are enabled.

Hi, When a program does not disclose How much bounty is paid to particular report , but if bounty statics is enabled then undisclosed Bounty Amount can be enumerated. For example Uber does not disclose bounty awarded to particular researcher but show bounty statics so we can write a script that...

Uber Hack lets anyone find Unlimited Promo Codes for Free Uber Rides

An Independent Security Researcher from Egypt has discovered a critical vulnerability in Uber app that could allow an attacker to brute force Uber promo code value and get valid codes with the high amount of up to $25,000 for more than one free rides. Mohamed M.Fouad has discovered a "promo codes...

Uber: Command Injection, Information

Dear Sir, I am going to share information about content spoofing vulnerability present in 404 page. This vulnerability may not consider as in-scope but you can put it as informative. Description : "Content spoofing, also referred to as content injection or virtual defacement, is an attack targeti...

Uber: Server version disclosure: team.uberinternal.com

In the HTTP response header from team.uberinternal.com, the nginx web server version is disclosed. HTTP/1.1 301 Moved Permanently Server: nginx/1.8.1 Date: Tue, 21 Jun 2016 22:45:53 GMT Content-Type: text/html Content-Length: 184 Connection: keep-alive Location: https://team.uberinternal.com/...

Uber: Error Message on 404 page

Hi, I know this is not really...

Uber: Self-XSS in Partners Profile

Hi , I have found an XSS stored vulnerability in the page paterns uber profile edit. the vulnerability in the vat number. Steps to reproduce: 1. Login to partners.uber.com 2. Go to a page https://partners.uber.com/profile/ 3. In the vat number enter a payload xss : " " alert0 4. save thank you,...

Uber: xss in https://www.uber.com

Hey, this vulnerability is essentially the same as bug 145276, i'm reporting it again just in case. there's a cross site scripting vulnerability in https://www.uber.com/. steps to reproduce: 1.visit...

Uber: Bruteforce INVITE codes easy way

As soon as i read the vulnerability disclosed on h1 regarding Possibility to brute force invite codes in riders.uber.com "https://hackerone.com/reports/125505" . I have found similar & easy way to bruteforce invite codes but in different manner . Also, 1680 public invites are waiting for...

Uber: Newsroom.uber HTML form without CSRF protection

Hi, The link that exists CSRF vulnerability https://newsroom.uber.com/india/how-to-refer/ Attack details Form name: Empty Form action: https://newsroom.uber.com/india/wp-login.php?action=postpass&wpe-login=ubernewblog Form method: POST Reproduction Steps 1-Create a file named submit.html 2-Write...

Uber: Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)

Through the endpoint at /rt/users/passwordless-signup it is possible to change the password of any Uber user, given knowledge of their phone number or by just enumerating phone numbers until one is found that is registered with Uber - not too hard given the number of Uber users. I've tested this...

Uber paid found the login bypass vulnerability researcher 1 million dollars-vulnerability warning-the black bar safety net

! Car share company Uber recently to repair the company's website, a vulnerability that can allow an attacker without the password can also log some “. uber.com” the website, and further on its internal network attacks. Uber rewards in the last month found that the vulnerability of the Finnish...

Uber Pays Researcher $10K for Login Bypass Exploit

Ridesharing company Uber recently patched a vulnerability in its site that could have allowed an attacker to log into some “.uber.com” sites without a password and further compromise its internal network. Uber awarded Finnish security researcher Jouko Pynnönen $10,000 for discovering the flaw las...

Uber: Password Reset Does Not Confirm the Existence of an Email Address

issue: 1.click forget password as driver or rider https://login.uber.com/login 2.input an email which not signed up! 3. press reset password. there will be 'We've sent you an email with a link to reset your password.' message. because it can not verify email is signed up or not! I'd tried with my...