HackerOne: Know undisclosed Bounty Amount when Bounty Statistics are enabled.

Hi, When a program does not disclose How much bounty is paid to particular report , but if bounty statics is enabled then undisclosed Bounty Amount can be enumerated. For example Uber does not disclose bounty awarded to particular researcher but show bounty statics so we can write a script that...

Uber Hack lets anyone find Unlimited Promo Codes for Free Uber Rides

An Independent Security Researcher from Egypt has discovered a critical vulnerability in Uber app that could allow an attacker to brute force Uber promo code value and get valid codes with the high amount of up to $25,000 for more than one free rides. Mohamed M.Fouad has discovered a "promo codes...

Uber: Command Injection, Information

Dear Sir, I am going to share information about content spoofing vulnerability present in 404 page. This vulnerability may not consider as in-scope but you can put it as informative. Description : "Content spoofing, also referred to as content injection or virtual defacement, is an attack targeti...

Uber: Server version disclosure: team.uberinternal.com

In the HTTP response header from team.uberinternal.com, the nginx web server version is disclosed. HTTP/1.1 301 Moved Permanently Server: nginx/1.8.1 Date: Tue, 21 Jun 2016 22:45:53 GMT Content-Type: text/html Content-Length: 184 Connection: keep-alive Location: https://team.uberinternal.com/...

Uber: Error Message on 404 page

Hi, I know this is not really...

Uber: Self-XSS in Partners Profile

Hi , I have found an XSS stored vulnerability in the page paterns uber profile edit. the vulnerability in the vat number. Steps to reproduce: 1. Login to partners.uber.com 2. Go to a page https://partners.uber.com/profile/ 3. In the vat number enter a payload xss : " " alert0 4. save thank you,...

Uber: xss in https://www.uber.com

Hey, this vulnerability is essentially the same as bug 145276, i'm reporting it again just in case. there's a cross site scripting vulnerability in https://www.uber.com/. steps to reproduce: 1.visit...

Uber: Bruteforce INVITE codes easy way

As soon as i read the vulnerability disclosed on h1 regarding Possibility to brute force invite codes in riders.uber.com "https://hackerone.com/reports/125505" . I have found similar & easy way to bruteforce invite codes but in different manner . Also, 1680 public invites are waiting for...

Uber: Newsroom.uber HTML form without CSRF protection

Hi, The link that exists CSRF vulnerability https://newsroom.uber.com/india/how-to-refer/ Attack details Form name: Empty Form action: https://newsroom.uber.com/india/wp-login.php?action=postpass&wpe-login=ubernewblog Form method: POST Reproduction Steps 1-Create a file named submit.html 2-Write...

Uber: Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical)

Through the endpoint at /rt/users/passwordless-signup it is possible to change the password of any Uber user, given knowledge of their phone number or by just enumerating phone numbers until one is found that is registered with Uber - not too hard given the number of Uber users. I've tested this...

Uber paid found the login bypass vulnerability researcher 1 million dollars-vulnerability warning-the black bar safety net

! Car share company Uber recently to repair the company's website, a vulnerability that can allow an attacker without the password can also log some “. uber.com” the website, and further on its internal network attacks. Uber rewards in the last month found that the vulnerability of the Finnish...

Uber Pays Researcher $10K for Login Bypass Exploit

Ridesharing company Uber recently patched a vulnerability in its site that could have allowed an attacker to log into some “.uber.com” sites without a password and further compromise its internal network. Uber awarded Finnish security researcher Jouko Pynnönen $10,000 for discovering the flaw las...

Uber: Password Reset Does Not Confirm the Existence of an Email Address

issue: 1.click forget password as driver or rider https://login.uber.com/login 2.input an email which not signed up! 3. press reset password. there will be 'We've sent you an email with a link to reset your password.' message. because it can not verify email is signed up or not! I'd tried with my...

Uber: Uber is Flooding my Mobile with SMS Daily like a cron JOB

The Issue is with the design of sending SMS by the uber referrals system, and every day it's flodding my phone number with driver invitaion message To reproduce this scenario i have Fuzz the below request Through OWSAP Zap I fuzzed for 10,000 requests , keep the same Phone number I have used my...

careers-uber.icims.com XSS vulnerability

Vulnerable URL:...

Uber: Phone Number Enumeration

I discovered it is possible to retrieve all Uber's customer's cell phone numbers using an API endpoint. While going through a sign up form, I noticed that the page was making an ajax call to an API to validate the email address being entered and to make sure it doesn't already belong to an accoun...

Uber: Self-XSS on partners.uber.com

Hi, I found a reflected XSS vulnerability in password reset page https://partners.uber.com/reset-password. I have tested this vulnerability in the latest Chrome and Firefox browsers. Reproduction Steps: 1- Go to https://login.uber.com/forgot-password and reset password. Then, Click password reset...

Uber: Clickjacking in love.uber.com

Hi , Your domain love.uber.com is vulnerable to Clickjacking. I'm able to load the domain love.uber.com in an iframe , so an attacker can certainly take advantage of this clickjacking bug in love.uber.com Click-jacking is a process of “stealing” clicks on your site, redirecting them to other...

Uber: [CRITICAL] -- Complete Account Takeover

Thanks for another great find @parth!...

Uber: Compromising Atlassian Confluence (team.uberinternal.com) via WordPress (newsroom.uber.com)

This issue has some relevance to most of my previous submissions so I thought it's clearer if I open a new ticket about it. I understood you've intended the various .uber.com WordPress sites to be isolated so that compromising them wouldn't impact Uber's internal network or user data. This has be...