Mail.ru: OTP bypass on user account deletion

Account deletion procedure was not sufficiently protected against bruteforce and allowed icq.com account delition valid session to victim account was required...

Mail.ru: XSS at https://icq.com/people

DOM Based XSS existed in old people search subservice icq.com/people. This functionality was removed...