826 matches found
Mail.ru: Cross-organization data access in city-mobil.ru
A legitimate partner's superuser account could have access to information of driver belonging to different partner, including passport and driving license data. Combined Improrer Access + IDOR It was possible to get access to passport, drive license any taxi driver. As well as changed settings...
Mail.ru: bit.games - sql-inj
Привет комманда. У bit.games есть сервис по загрузке картинок. На нём я обнаружил sql-inj. Домен: https://bit5.ru/ Уязвимый запрос: POST /filter/ajaxgetnewcontents?style=icons&sort=order&ord=desc&folders=42446&lastcontentid=1 HTTP/1.1 Host: bit5.ru User-Agent: Java Accept: application/json,...
Mail.ru: [capsula.mail.ru] overriding order info
IDOR vulnerability in order editing functionality of capsula.mail.ru allowed to override the incomplete unsubmitted order saved for later...
Mail.ru: XSS on https://deti.mail.ru/
deti.mail.ru allowed to insert javascript: links into post content leading to self XSS possibility on message editing...
Mail.ru: Cross-Site Request Forgery (CSRF) in comment update - api.my.games
CSRF vulnerability in api.my.games allowed to update store.my.gamesb log comment with crossite request...
Mail.ru: Cross-Site Request Forgery (CSRF) in my.games API
CSRF vulnerability allowed to add/delete/edit store.my.games comments...
Mail.ru: Vertical Privilege Escalation on {target.my.com}
target.my.com user with read-only privilege can elevate privilege to add another user to project...
Mail.ru: Unrestricted file upload on [ambassador.mail.ru]
PHP code execution was possible via file upload functionality in ambassador.mail.ru An attacker was able to execute arbitrary PHP code on the server through the image uploading functionality. The vulnerability was quickly fixed by the Mail.ru team...
Mail.ru: SQL LIKE clauses wildcard injection
LIKE clause was misused for session validation in one of https://c-api.city-mobil.ru/v2 API calls, allowing character-by-character session bruterofce. The session validation logic mistakenly allowed wildcards in the authorization token...
Mail.ru: [c-api.city-mobil.ru] IDOR chat messages between driver and customer
UUIDv1 was used as identifier in c-api.city-mobil.ru for some APIs where identifier was intended to be non-brutable while UUIDv1 entropy is insufficient...
Mail.ru: Reflected XSS in city-mobil.ru/
Reflected XSS in city-mobil.ru due to unsafe usage of GET parameter...
Mail.ru: XSS in [community.my.games]
Crossite scripting in community.my.games via post comments All we say is Thank You for an Account Takeover Flaw!...
Mail.ru: IDOR in tracking driver logs at city-mobil.ru
IDOR vulnerability in taxiserv interface allowed to access a track log of a different driver...
Mail.ru: Content injection on shared event (calendar.mail.ru)
Allowed tags/attributes for calendar events in calendar.mail.ru were not properly restricted allowing interface elements spoofing...
Mail.ru: Information Disclosure on {http://pro.tracker.my.com}
Prometheus performance metrics were publicly available on pro.tracker.my.com...
Mail.ru: XSS at go.mail.ru
DOM-based self XSS in go.mail.ru social search functionality...
Mail.ru: Account takeover through password reset in cups.mail.ru
An IDOR vulnerability in password recovery procedure allowed arbitrary cups.mail.ru account rakeover. Write-up is here. : https://medium.com/kminthein/account-takeover-in-cups-mail-ru-bdab1483f92c...
Mail.ru: Http Response Splitting on thumb.cloud.mail.ru
Limited CRLF injection at thumb.cloud.mail.ru allowed to manipulate cookies...