Mail.ru: Web cache information leakage at sbermarket.ru

Due to invalid caching settings, attacker could obtain profile related data from the web cache by forcing victim to request vulnerable endpoint...

Mail.ru: Blindy Replace User's Session with Attacker's Session

Login CSRF via OAuth code in lootdog.io...

Mail.ru: Sidekiq Dashboard Publicly accessible at http://shopper.staging.instamart.ru/sidekiq/

Sideqiq dashboard was externally available on the http://shopper.staging.instamart.ru/ server in staging testing environment...

Mail.ru: lenta_proxy information disclosure

Sensitive application configuration data disclose on lenta.proxy.instamart.ru...

Mail.ru: [account.mail.ru] XSS-уязвимость в форме авторизации

User-assisted XSS in account.mail.ru due to unsafe usage of GET parameter Думаю, что данная XSS'шка является отличным примером того, что фильтрация HTML-символов во входных данных не всегда достаточная мера защиты. Если будем раскрывать уязвимость, то вот более удачная демонстрация, без моих куко...

Mail.ru: Private file read through file attachment

my.com MyMail application for Android could be tricked by malicious local application selected as a file picker by user to copy the file from application folder to insecure location...

Mail.ru: mail.ru/touch xss(r) debug parameter

Reflected XSS in touch version of mail.ru via GET parameter debug...

Mail.ru: Local SQL Injection in Content Provider (ru.mail.data.contact.ContactsProvider) of Mail.ru for Android, version 12.2.0.29734

Local SQL injection vulnerability in ContactsProvider of Mail.ru Mail application for Android special permissions required...

Mail.ru: Database read through provider misconfiguration

Content provider implementation in ICQ for Android allowed another local application to force ICQ private files to be copied to insecure location...

Mail.ru: SQL injection at fleet.city-mobil.ru

SQL injection in fleet.city-mobil.ru due to unsafe usage of POST parameter "param":"1'+MySQLpayload--+-"...

Mail.ru: Collected Telegraf Matrics Accessible

Perfomance metrics were available at game.tz.mail.ru...

Mail.ru: MySQL username and password leaked on [2017.russianaicup.ru]

Configuration file available via web interface could disclosure potenrially sensitive inormation Configuration file available via web interface could disclosure potentially sensitive information...

Mail.ru: User session access due to Oauth whitelist host bypass and postMessage

A destination for postMessage was not properly restricted on connect.mail.ru allowing crossite access to session, as was shown for 3k.mail.ru application session. Both connect.mail.ru and 3k.mail.ru belong to Ext.B scope, this scope does not offer a bounty for attacks with clientside vectors on t...

Mail.ru: capsula.mail.ru - Admin blind stored XSS

Stored XSS in capsula.mail.ru admin interface via vector demonstrated in 873818. Хранимый xss в панели администратора на capsula.mail.ru через окно "оценки процесса покупки"...

Mail.ru: [my.games] Stored XSS via untrusted bucket

Domain, site, application -- https://my.games/ Details -- If you check page source of https://my.games, you can notice that site gets static files scripts, styles, images using following URL declaration: https://my.games/hotbox/mygames/frontend/v3-6-13/img/share/main.png mygames here is a name of...

Mail.ru: Reflected XSS

Reflected XSS in target.my.com/ via URI GET parameter...

Mail.ru: capsula.mail.ru - reflected xss

XSS in capsula.mail.ru on support chat message lead to stored XSS in capsula.mail.ru admin interface 874387 This XSS lead to stored-xss in the admin-panel 874387 rubukkit.org...

Mail.ru: XSS on https://o2.mail.ru/jsapi/button via PostMessage

DOM XSS in PostMessage handler of o2.mail.ru...

Mail.ru: Time-Based SQL injection at city-mobil.ru

Bind time-based SQL injection in https://city-mobil.ru/ due to unsafe usage of GET parameter JSON SLEEP PROFIT! P.S. Detail summary coming soon.... possibly... watch at https://blog.deteact.com...

Mail.ru: [panel.city-mobil.ru/admin/] Blind XSS via partner name (similar to #746505)

It was possible to cause XSS condition in admin panel of Citymobil by setting malformed partner name in https://fleet.city-mobil.ru/front/ The issue is really similar to 746505. The original issue was exploited via editing an existed user - we could add blind XSS payload during user editing. The...