826 matches found
Mail.ru: SMTP Header Injection at http://abonement.ucs.ru
It was possible to abuse the functionality of abonement.ucs.ru to send messages to arbitrary e-mail via CRLF injection vulnerability...
Mail.ru: Пользователь может изменить номер телефона в профиле без СМС подтверждения
SMS code for phone number change in zakazaka.ru was not sufficiently protected against bruteforce...
Mail.ru: Брутфорс sms кода подтверждения для смены номера телефона в аккаунте LootDog.
SMS code for phone number change in lootdog.io was not sufficiently protected against bruteforce...
Mail.ru: Redmin API Key Exposed In GIthub
Sensitive application configuration data related to tracker.ucs.ru was leaked on github.com...
Mail.ru: Reflected XSS on http://info.ucs.ru/settings/check/
Reflected XSS due to unsafe usage of POST parameter in info.ucs.ru...
Mail.ru: Blind SSRF on http://info.ucs.ru/settings/check/
Blind SSRF in info.ucs.ru...
Mail.ru: Логи/sql запросы на http://mx36.ucs.ru/ и reflected XSS.
Sensitive application information disclosure and stored XSS via log files on mx36.ucs.ru...
Mail.ru: SQL Injection at https://lite.r-keeper.ru/site_api/clients/derision/?lang=ru
SQL Injections in lite.r-keeper.ru due to unsafe usage of URI parameters...
Mail.ru: SQL Injection at https://lite.r-keeper.ru/site_api/localize/translate/rklscommon/ru
SQL Injection in lite.r-keeper.ru due to unsafe usage of PATH from GET Request...
Mail.ru: xss on [storehouse5.ucs.ru]
Reflected XSS via POST parameter in storehouse5.ucs.ru I die ███████████████████████████ ███████▀▀▀░░░░░░░▀▀▀███████ ████▀░░░░░░░░░░░░░░░░░▀████ ███│░░░░░░░░░░░░░░░░░░░│███ ██▌│░░░░░░░░░░░░░░░░░░░│▐██ ██░└┐░░░░░░░░░░░░░░░░░┌┘░██ ██░░└┐░░░░░░░░░░░░░░░┌┘░░██ ██░░┌┘▄▄▄▄▄░░░░░▄▄▄▄▄└┐░░██...
Mail.ru: Stored XSS that allow an attacker to read victim mailboxes contacts in mail.ru and my.com application
Mail.ru Mail IOS app was vulnerable to local files access on some iOS versions due to cross-application scripting if malcrafted SVG attachment is viewed by user Write-up is here...
Mail.ru: Source code and internal credentials disclosure
Sensitive application configuration data disclose on registry.infra.mail.ru...
Mail.ru: Reflected XSS in "keywords" parameter at "https://sbermarket.ru/metro/search"
Reflected XSS via GET parameter in sbermarket.ru...
Mail.ru: Открытая админка 1C эмулятора
Staging testing versions of 1C-emulator and Adminer interfaces was available from external network without authentication on geekbrains.ru. This interfaces had no access to production data...
Mail.ru: Получение гарантированного дохода и бонусов без фактического исполнения заказов, при этом используя аккаунты не существующих людей.
Reported demonstrated a possibility to bypass an anti-fraud protection in Citymobil taxi service...
Mail.ru: Grafana SSRF in grafana.instamart.ru
non-blind SSRF in grafana.instamart.ru...
Mail.ru: Subdomain takeover on tilda.geekbrains.ru and fl-change.geekbrains.ru
Few unused subdomains of geekbrains.ru were delegated to tilda.cc and were not claimed...
Mail.ru: Subdomain Takeover at blog.instamart.ru
It was possible to claim unused instamart.ru subdomain delegated to external cloud service...