Mail.ru: RCE в .api/nr/report/{id}/download

Domain, site, application -- app.nativeroll.tv Steps to reproduce -- Нужен аккаунт рекламодателя, можно зарегистрировать здесь https://seedr.ru/register-user/advertiser 1. Войти как рекламодатель https://seedr.ru/login/advertiser 2. Пощелкать что-нибудь, поперехватывать запросы, нужен accesstoken...

TikTok: Information Disclosure of Advertiser Account on TikTok Ads Portal

In the TikTok Ads portal, if both invited Ad Accounts are part of the same business group, an exposed endpoint could potentially be exploited to view email address, phone number, company, and name of the Ad Account owner. We thank @emanuelharijanto for reporting this to our team and confirming th...

Inout Adserver SQL Injection

Inout Adserver id Remote SQL injection -X | |/ / || |/ | / | \ \ \ / / | \ / / \ | ' | | || | / | \ // / / / | , / ||\|||| ||| // // / // Red n'black i dress eagle on my chest. It's good to be an ALBANIAN Keep my head up high for that flag i die. Im proud to be an ALBANIAN Author :...

Inout Adserver (id) Remote SQL injection Vulnerability

No description provided by source. Inout Adserver id Remote SQL injection -X | |/ / || |/ | / | \ \ \ / / | \ / / \ | ' | | || | / | \ // / / / | , / ||\|||| ||| // // / // Red n'black i dress eagle on my chest. It's good to be an ALBANIAN Keep my head up high for that flag i die. Im...

Inout Adserver - 'id' SQL Injection

Inout Adserver id Remote SQL injection -X | |/ / || |/ | / | \ \ \ / / | \ / / \ | ' | | || | / | \ // / / / | , / ||\|||| ||| // // / // Red n'black i dress eagle on my chest. It's good to be an ALBANIAN Keep my head up high for that flag i die. Im proud to be an ALBANIAN Author :...