826 matches found
Mail.ru: В самокате можно просматривать и изменять данные любого заказа без авторизации
IDOR in smart.space API allowed to change orders and list items of order content...
Mail.ru: REFLECTED XSS On http://jsgames.mail.ru/bad_browser.php via back_url paramter
Reflected XSS in jsgames.mail.ru via GET paramter...
Mail.ru: NPM_API_KEY Leak
Sensitive application configuration data related to samokat.ru was leaked on github.com...
Mail.ru: Forgot Password Page SMS Brute Force could lead to Account Takeover using Android/IOS app "About the house" via api.prodom.smart.space
Password recovery procedure was not sufficiently protected against bruteforce and allowed arbitrary smart.space account takeover...
Mail.ru: tmgame.mail.ru - Blind sql injection
https://tmgame.mail.ru/action.php?xml=1&acode=comein&buildtype=all&bldID=selectfromselectsleep20a&bldlocID=8 bldID уязвимый get-параметор. Impact Получение данных из бд...
Mail.ru: Subdomain Takeover at analyticstest.geekbrains.ru
Unused analyticstest.geekbrains.ru subdomain was delegated to tilda.cc and not claimed...
Mail.ru: Information Disclosure
Domain, site, application www7.promo.plazius.ru Steps to reproduce 1. By nmap port scanning we know port 9049 is open 2. After that dirsearch Metrics are shown result open in browser. 3.Now open http://www7.promo.plazius.ru:9049/Metrics Here you will get internal metrics of system Impact This is...
Mail.ru: cross site scripting bypass session
Reflected XSS in cloud.mail.ru via cookie value...
Mail.ru: Information Disclosure on www7.promo.plazius.ru
Performance metrics were available at www7.promo.plazius.ru...
Mail.ru: Information Disclosure on qa-delivery-srv.plazius.ru
Performance metrics were available at qa-delivery-srv.plazius.ru...
Mail.ru: Improper Restriction of Excessive Authentication Attempts at http://terrafoot.ru/login.php (Rate Limit bypass via IP Rotation)
Password at terrafoot.ru was not sufficiently protected against bruteforce...
Mail.ru: Un Authencitated Quartz Pannel with Scheduling tasks
Access to staging testing host task control panel was not restricted and allowed to stop or start scheduled task...
Mail.ru: XSS via "gp" cookie reflected in source code
Reflected XSS in mail.ru via cookie value...
Mail.ru: [performancemarketing.geekbrains.ru] Tilda Subdomain Takeover
Unused subdomain of geekbrains.ru was delegated to tilda.cc and unclaimed...
Mail.ru: Bypass OTP on contact back request at https://driver.city-mobil.ru/
It was possible to bypass phone verification for support call back request...
Mail.ru: Access to information about any video and its owner via GraphQL endpoint [dictor.mail.ru]
An IDOR vulnerability in dictor.mail.ru allowed to obtain arbitrary video information via direct GraphQL query...
Mail.ru: Path traversal on bank.mail.ru ( CVE-2013-3827 )
Defects in Oracle’s JSF2 implementation allowed limited path traversal in tbank.mail.ru...
Mail.ru: IDOR of contracts on dictor.mail.ru
API endpoint at dictor.mail.ru disclosed e-mails of registered users...
Mail.ru: Account takeover in cups.mail.ru using punycode characters
A logical bug in database collation usage for string comparison during access recovery process allowed to takover account in cups.mail.ru by registering colliding Unicode domain...