Mail.ru: Insufficient limitation of web page title leads to DoS against ICQ for Android

It was possible to permanently hang or crash ICQ application by posting the URI of the page with oversized TITLE header before testing and reporting DoS conditions please check @mailru rules and scope description to avoid signal/reputation loss, not every DoS report is accepted...

Mail.ru: [Web ICQ Client] XSS уязвимость в имени пользователя

Domain, site, application: WEB ICQ Client - https://web.icq.com/ Testing environment: Browser firefox Steps to reproduce 1. Устанавливаем имя пользователя, содержащее HTML код 2. Создаем канал/группу, в который приглашаем любого пользователя 3. Разрешаем/Запрещаем писать пользователю Actual resul...

Mail.ru: [API] ICQ user's avatar can be manipulated remotely

Description: При обращении к API методу установки аватара пользователя https://ub.icq.net/files/api/v1.1/avatar/set Можно передать дополнительный GET параметр: targetSn - с установленным UIN'ом любого пользователя Тем самым можем изменить аватарку у любого пользователя Steps To Reproduce: 1...

Mail.ru: [Web ICQ Client] XSS-inj in polls

Domain, site, application: WEB ICQ Client - https://web.icq.com/ Testing environment: Browser firefox Steps to reproduce - Создаем новый опрос - Указываем в варианты ответов произвольный HTML код - Отправляем Actual results - Введенный HTML код срабатывает Демонстрация работы: █████ Impact...

Mail.ru: IP address can be leaked on Image preview in ICQ for Android chat

Описание: При отправке пользователю изображения, в android версии в web и mac версии клиента этой проблемы не наблюдаю со внешнего ресурса, при открытии превью изображения "жертвой", отправляется запрос на внешний сервер с IP адреса клиента. Воспроизведение: 1. Отправляем пользователю сообщение с...

Mail.ru: FLV FILE FORMAT (AUDIOSES.DLL) Out of Bounds

Out-of-bounds read in ICQ descktop on FLV format parsing could lead to application crash...

Mail.ru: ICQ Windows Application is Vulnerable to DLL Search Order Hijacking

DLL injection via Download folder pollution during ICQ installation / first launch process was possible on some Windows installations with broken libraries dependencies Windows "Pro N" version designed for Europe is known to be affected in some installations...

Mail.ru: ICQ for macOS: lack of `com.apple.quarantine` meta-attribute on downloaded files leads to GateKeeper/Quarantine bypass for downloaded executables

Summary Quarantine & GateKeeper are important macOS security mechanisms, which prevent user/device from running unsigned executables and warn users about executables downloaded from the remote. Conceptually, Quarantine & GateKeeper are similar to MOTW on Windows. Applications that could download...

Mail.ru: ICQ 10.0.12371 icq: Uri Handler '-testability' URL File Insecure Library Loading Code Execution Vulnerability

An exploitation of combination of unsafe URI handler and insecure DLL loading could result in code execution via DLL injection in ICQ desktop application for Windows if user executes malformed .url file...

Mail.ru: Чтение системных данных приложения: данные для авторизации, логи, БД, личная переписка

Insufficient case sensitive filtering in intent URI could allow local malicious application to access local files via ICQ for Android...

Mail.ru: Загрузка png бомбы, которая начинает DDOS атаку на бота со Стикерами.

ICQ sticker bot was vulneraeble to DoS via PNG compression bomb attack...

Mail.ru: Получаем все домены и поддомены icq с помощью amazonaws.com [config,txt]

Открытый доступ к config.txt на амазоне где лежат все ваши домены и поддомены "api.icq.net": "api.ic2ster.com", "bos.icq.net": "bos.ic2ster.com", "api.login.icq.net": "apilogin.ic2ster.com", "icq.com": "www.ic2ster.com ", "www.icq.com ": "www.ic2ster.com ", "files.icq.com": "files-com.ic2ster.com...

Mail.ru: Error in processing gif images

Application crash on malformed GIF image parsing in ICQ for Desktop...

[SECURITY] Fedora 24 Update: bitlbee-3.5.1-1.fc24

Bitlbee is an IRC to other chat networks gateway. Bitlbee can be used as an IRC server which forwards everything you say to people on other chat networks like XMPP/Jabber including Google Talk and Hipchat, MSN/Skype, AIM and ICQ, the Twitter microblogging network and all other Twitter API...

[SECURITY] Fedora 25 Update: bitlbee-3.5.1-1.fc25

Bitlbee is an IRC to other chat networks gateway. Bitlbee can be used as an IRC server which forwards everything you say to people on other chat networks like XMPP/Jabber including Google Talk and Hipchat, MSN/Skype, AIM and ICQ, the Twitter microblogging network and all other Twitter API...

video.icq.com XSS vulnerability

Vulnerable URL: http://video.icq.com/search/?searchkeyword=3844522930=webid=start=lol" Details: Description| Value ---|--- Patched:| Yes, at 29.11.2016 Latest check for patch:| 29.11.2016 14:51 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

start.icq.com XSS vulnerability

Vulnerable URL: http://start.icq.com/search/?searchkeyword=3844522930=webid=start=lol" Details: Description| Value ---|--- Patched:| Yes, at 29.11.2016 Latest check for patch:| 29.11.2016 14:50 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

start.icq.com XSS vulnerability

Vulnerable URL: http://start.icq.com/?chid=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 11:06 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 15006 VIP...

video.icq.com XSS vulnerability

Vulnerable URL: http://video.icq.com/?chid=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 07.07.2017 Latest check for patch:| 07.07.2017 20:16 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 15006 VIP...

search.icq.com XSS vulnerability

Vulnerable URL: http://search.icq.com/search/?searchkeyword=3844522930=webid=start=" Details: Description| Value ---|--- Patched:| Yes, at 30.11.2016 Latest check for patch:| 30.11.2016 09:58 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculat...