General Motors GM Vulnerability Disclosure Program

General Motors’ new vulnerability disclosure program puts it alongside Tesla as the only major automakers with a mechanism for security researchers to report flaws. Unlike Tesla’s program, however, GM’s does not offer a monetary reward. GM launched its program last week via the HackerOne platform...

Uber: Drivers can change profile picture

Riders are able to change their profile picture whenever they want and they should be allowed to either way. When a rider becomes a driver they should not be able to change their profile picture due to the fact they can change their pictures to something inappropriate. Replicate: Login into the...

Uber: Issue with Password reset functionality

Dear Team, There are password change issues with uber. there are two issues: 1User is not receiving notification when he reset password via password reset link. 2Password reset link is not expiring after used once. Good thing: when user change his info like profile update, password change. User g...

Uber to Quadruple Security Staff by 2016

Ride-sharing company Uber, which has already battled a database compromise and hackers selling stolen user accounts this year, announced over the weekend that it will bulk up its security division. Uber will quadruple the number of employees that currently oversee security at the San...

Hackers Selling Uber Credentials on Underground Market

The alternative taxi service Uber denies insinuations that its systems were breached following reports claiming that underground forums are offering Uber user-credentials for as little as $1. First reported by Vice Magazine’s Motherboard spinoff, the information for sale also includes names, the...

Thousands of Hacked Uber Accounts Selling on Dark Web for $1

$US1 may be a very little amount, but it is enough to buy you a stolen Uber account and free car rides around the city. Two separate vendors on AlphaBay, a relatively new Dark Web marketplace launched in late 2014, are selling active Uber accounts with usernames and passwords for $1 each,...

Uber Announces Breach of 'Partner' Information

The enormously popular alternative taxi service, Uber, admitted late Friday that an unauthorized third party gained access to the company’s database, stealing driver but not customer information in the process. In a statement, Uber claims there was a “one-time access” of its databases, spilling t...

Uber: XSS on partners.uber.com

Hello, I have discovered a reflected XSS on partners.uber.com When accessing https://partners.uber.com/signup/global/ with the appropriate parameters, for example:...

Uber’s Android app is Literally Malware?

The popular ride-sharing service Uber has been hit by various controversies lately, but now the things gone even worse for the company when a security researcher made a worrying discovery this week and claims, "Uber’s app is literally malware." The ride-hailing company is in disputes of handling...

CVE-2014-5766

The Uber B2B aka de.mobileeventguide.uberb2b application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Uber B2B aka de.mobileeventguide.uberb2b application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5766

The CVE-2014-5766 entry concerns the Uber B2B Android application version 1.9, which does not verify X.509 certificates from SSL servers. This misconfiguration enables man-in-the-middle attackers to spoof legitimate servers and obtain sensitive information via a crafted certificate. The available...

CVE-2014-5766

The Uber B2B aka de.mobileeventguide.uberb2b application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5766: Undefined Security Weakness

The Uber B2B aka de.mobileeventguide.uberb2b application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2007-6676

The default configuration of Uber Uploader UU 5.3.6 and earlier does not block uploads of 1 .html, 2 .asp, and other possibly dangerous extensions, which allows remote attackers to use these extensions in uploads via a uufileupload.php, related to uufileupload.js and b uberuploaderfile.php, relat...

CVE-2007-6676

The default configuration of Uber Uploader UU 5.3.6 and earlier does not block uploads of 1 .html, 2 .asp, and other possibly dangerous extensions, which allows remote attackers to use these extensions in uploads via a uufileupload.php, related to uufileupload.js and b uberuploaderfile.php, relat...

Default configuration

The default configuration of Uber Uploader UU 5.3.6 and earlier does not block uploads of 1 .html, 2 .asp, and other possibly dangerous extensions, which allows remote attackers to use these extensions in uploads via a uufileupload.php, related to uufileupload.js and b uberuploaderfile.php, relat...

CVE-2007-6676

The default configuration of Uber Uploader UU 5.3.6 and earlier does not block uploads of 1 .html, 2 .asp, and other possibly dangerous extensions, which allows remote attackers to use these extensions in uploads via a uufileupload.php, related to uufileupload.js and b uberuploaderfile.php, relat...

CVE-2007-6676

The CVE relates to Uber Uploader (UU) where the default configuration in UU 5.3.6 and earlier fails to block uploads of dangerous extensions (e.g., .html, .asp). This allows remote attackers to use these extensions in uploads via uu_file_upload.php (and related uu_file_upload.js) and uber_uploade...

CVE-2007-6676: Undefined Security Weakness

The default configuration of Uber Uploader UU 5.3.6 and earlier does not block uploads of 1 .html, 2 .asp, and other possibly dangerous extensions, which allows remote attackers to use these extensions in uploads via a uufileupload.php, related to uufileupload.js and b uberuploaderfile.php, relat...