826 matches found
Mail.ru: IDOR смена email пользователя через Ситимобил Бизнес
It was possible to change e-mail address of the user via corporate.city-mobil.ru. An award for this report was distributed evenly between 956791 and 971422. Report 956791 demonstrated the vector for corporate.city-mobil.ru, 971422 demonstrated this vulnerability may have higher impact besides the...
Mail.ru: CSRF Delete chat invitation link.
CSRF vulnerability in api.my.games allowed to delete chat invitation link with crossite request...
Mail.ru: Пользователь может изменить способ оплаты указав чужой corporation ID
IDOR vulnerability in city-mobil.ru allowed arbitrary organization to be billed for a taxi ride...
Mail.ru: Access to git & and configuration files on backtoschool.geekbrains.ru via gitfile
Leaking sensitive application data in configuration files at backtoschool.geekbrains.ru...
Mail.ru: Stored Xss
Stored XSS in comment functionality on profile.my.games and community.my.games...
Mail.ru: Bitbucket public repo leaking credentials from the 1C Enterprise system used by Samokat
Application configuration data related to Samokat project was leaked on github.com...
Mail.ru: Возможность просмотра коментариев к чужим обращениям [corporate.city-mobil.ru]
IDOR vulnerability in corporate.city-mobil.ru interface allowed to access a feedback comments of a different users...
Mail.ru: HTTP request smuggling (?) canpol.deti.mail.ru
HTTP request smuggling in canpol.deti.mail.ru led to possibility for non-blind SSRF exploitation with access to serverside api...
Mail.ru: IDOR zakazaka (состояние заказа и перезаказ)
An IDOR vulnerability in zakazaka allowed to obtain the content of the order without personal details...
Mail.ru: Возможность изменить поле "E-Mail для доступа в личный кабинет" у другого пользователя [corporate.city-mobil.ru]
It was possible to change e-mail address of the user via corporate.city-mobil.ru. An award for this report was distributed evenly between 956791 and 971422. Report 956791 demonstrated the vector for corporate.city-mobil.ru, 971422 demonstrated this vulnerability may have higher impact besides the...
Mail.ru: Stored XSS in address on [corporate.city-mobil.ru]
Stored XSS in address setting functionality on corporate.city-mobil.ru...
Mail.ru: Stored XSS in history on [corporate.city-mobil.ru]
Stored XSS in view history functionality on corporate.city-mobil.ru...
Mail.ru: Public access to Sidekiq dashboard at shopper.sbermarket.ru
Anonymous access to Sidekiq process dashboard was available on shopper.sbermarket.ru...
Mail.ru: Possible access to the car's photo and registration by its ID on [fleet.city-mobil.ru]
Car / driver's license photo cropped with built-in photo editor of fleet.city-mobil.ru could get a predictable name...
Mail.ru: Disclosure of personal support email addresses on 'support-fleet.city-mobil.ru'
IDOR vulnerability in support-fleet.city-mobil.ru allowed to disclose the support staff e-mail addresses...
Mail.ru: HTML Injection at "city-mobil.ru"
HTML Injection in city-mobil.ru on driver recruitment page...
Mail.ru: SECRET_KEY Of Django Leaked In maps.me
Token for a internal Jenkins account of maps.me was leaked via git commit...
Mail.ru: relap.io/admin/api - административный API доступен без аутентификации
Admin interface opened to external network without authentication on relap.io...