Mail.ru: Получение гарантированного дохода и бонусов без фактического исполнения заказов, при этом используя аккаунты не существующих людей.

Reported demonstrated a possibility to bypass an anti-fraud protection in Citymobil taxi service...

Mail.ru: [panel.city-mobil.ru/admin/] Blind XSS via partner name (similar to #746505)

It was possible to cause XSS condition in admin panel of Citymobil by setting malformed partner name in https://fleet.city-mobil.ru/front/ The issue is really similar to 746505. The original issue was exploited via editing an existed user - we could add blind XSS payload during user editing. The...

Mail.ru: [dobro.city-mobil.ru] Недостаточная аутентификация (доступ к панели администратора)

Authentication bypass for admin interface access on dobro.city-mobil.ru the report was submitted before the launch of dedicated bug bounty scope for Citymobil...