← 返回地图破甲

浏览报告

仅含 CVE

239 份报告 · 本页赏金 $19,250 · 清除筛选

Complete Admin account takeover due to PhpDebugBar turned on in Uber's production server错误配置Uber低危—2023-08-23 HTML injection via insecure parameter [https://www.ubercarshare.com/]跨站脚本Uber低危—2023-03-23 DOM based XSS via insecure parameter on [ https://uberpay-mock-psp.uber.com ]跨站脚本Uber低危—2023-03-23 Golang expvar Information Disclosure信息泄露Uber低危—2022-08-24 Full read SSRF in flyte-poc-us-east4.uberinternal.com服务端请求伪造Uber低危$2,0002022-05-26 Uber Test Report 20220301业务逻辑Uber低危—2022-03-03 Exposed Golang Pprof debugger at https://cn-geo1.uber.com/信息泄露Uber低危—2022-04-07 Google Maps API Key Leakage信息泄露Uber低危—2021-09-03 CVE-2020-3452 - unauthenticated file read on anyconnect.routematch.com路径遍历Uber低危—2021-08-05 pam_ussh does not properly validate the SSH certificate authority身份认证Uber低危—2021-07-21 Chain of IDORs Between U4B and Vouchers APIs Allows Attackers to View and Modify Program/Voucher Policies and to Obtain Organization Employees' PII不安全的直接对象引用Uber中危—2022-04-07 Chain of vulnerabilities in Uber for Business Vouchers program allows for attacker to perform arbitrary charges to victim's U4B payment account不安全的直接对象引用Uber中危$5,7502021-08-12 IDOR leads to See analytics of Loyalty Program in any restaurant.不安全的直接对象引用Uber低危—2021-05-28 4 Subdomains Takeover on 2 domains ( muberscolombia.com & ubereats.pl )访问控制Uber低危$5002021-04-29 IDOR leads to leak analytics of any restaurant不安全的直接对象引用Uber低危—2021-04-29 Corss-Tenant IDOR on Business allowing escalation privilege, invitation takeover, and edition of any other Businesses' employees访问控制Uber低危—2021-05-14 Request Access for Uber Device Returns Management Platform (https://www.eats-devicereturns.com/request-access/) Bypass Allows Access to PII访问控制Uber中危—2021-05-14 RCE via npm misconfig -- installing internal libraries from the public registry代码执行Uber高危$9,0002021-02-24 Unrestricted File Upload Results in Cross-Site Scripting Attacks跨站脚本Uber低危—2021-05-14 Critical Information disclosure of rtapi token for any user via https://video-support-staging.uber.com/video/api/getPopulousUser信息泄露Uber高危—2021-03-29 Exposed█████████in apk file - devbuilds.uber.com信息泄露Uber中危—2021-04-09 Cookie Bombing cause DOS - businesses.uber.com拒绝服务Uber低危—2021-02-24 Disclosure of Co-Rider user (Uber-pooling) profile picture at Amazon AWS Cloudfront within HTTP RESPONSE信息泄露Uber低危—2021-02-25 Thumbor misconfiguration at blogapi.uber.com can lead to DoS拒绝服务Uber低危$5002021-02-25 Change the rating of any trip, therefore change the average driver rating业务逻辑Uber低危$1,5002020-04-06