826 matches found
Mail.ru: mailer.i.bizml.ru viber service preprod information disclosure
DEBUG mode enabled on http://52.29.101.127:1060/ leading to DB login and passwd leaks...
Mail.ru: Improper access control leading to deletion of Greeting videos on {https://smtp.8mar.mail.ru/}
smtp.8mar.mail.ru was pointing to partner-operated service where it was possible to delete uploaded greetings videos. No risks for Mail.ru users or active projects were identified...
Mail.ru: Stored xss on https://go.mail.ru/
Reflected XSS via GET parameter in go.mail.ru...
Mail.ru: [pulse.mail.ru] Доступ к статистике чужих площадок
Few API methods of pulse.mail.ru were not properly restricted and could be used to obtain statistics information for arbitrary domains...
Mail.ru: [icq.com/people/*uin*/edit] Отсутствует фильтр и проверка на дубли в поле "Никнейм"
It was possible to create account with a same nickname wih existing one...
Mail.ru: o2.mail.ru XSS
Reflected XSS in o2.mail.ru via GET parameter state...
Mail.ru: relap.io CSRF bypass on adding domain to use relap widgets
The lack of CSRF protection in API endpoint in relap.io allowed to force user to add domain to the widget...
Mail.ru: Stored XSS In mlbootcamp.ru
XSS in mlbootcamp.ru via forum post...
Mail.ru: [api.33slona.ru] Доступ к API из за неправильной конфигурации сервера 302 редирет.
A 302 reply for non-authenticated request to api.33slona.ru could leak some static content with HTML body...
Mail.ru: xss in ub.icq.net
XSS in ub.icq.net via HTML file upload. icq.net is a sandbox API domain without cookies or HTTP authentication...
Mail.ru: mailgun subdomain takeover on "email.mail.geekbrains.ru"
Unused email.mail.geekbrains.ru domain was delegated to Mailgun and was not claimed, allowing to use it Mailgun service...
Mail.ru: SQL Injection [unauthenticated] with direct output at https://news.mail.ru/
Unsafe usage of GET parameter led to SQL injection in news.mail.ru...
Mail.ru: MCS Graphite SSRF: internal network access
Blind SSRF in mcs.mail.ru via unpatched Graphite...
Mail.ru: [staging.tarantool.org] Github Pages Subdomain-take-over
Unused staging.tarantool.org subdomain was delegated to github pages and was not claimed...
Mail.ru: web.icq.com XSS in chat message via contact info
XSS in web.icq.com via chat message with contact details...
Mail.ru: [v7lk.relap.io] Sending arbitrary emails to any user
Mail sending API endpoint at relap.io was publicly accessible...
Mail.ru: OTP bypass on user account deletion
Account deletion procedure was not sufficiently protected against bruteforce and allowed icq.com account delition valid session to victim account was required...
Mail.ru: [aw.mail.ru] XSS on /quiztank page
Reflected XSS in aw.mail.ru via URI...
Mail.ru: Insufficient limitation of web page title leads to DoS against ICQ for Android
It was possible to permanently hang or crash ICQ application by posting the URI of the page with oversized TITLE header before testing and reporting DoS conditions please check @mailru rules and scope description to avoid signal/reputation loss, not every DoS report is accepted...