Mail.ru: [xss] passrestore на m/touch/tel

Reflected XSS in touch.mail.ru, m.mail.ru, light.mail.ru, tel.mail.ru via GET parameter error...

Mail.ru: [c-api.city-mobil.ru] Client authentication bypass leads to information disclosure

API endpoint at c-api.city-mobil.ru allowed access to subset of order and client related information without proper authorization Broken authentication in the client API allowed retrieving sensitive information about clients: finished trips w/o departure and destination points, payments type,...

Mail.ru: Insecure storage of private files

"Send to myself" activity of Mail.ru Mail application for Android could be locally manipulated via external content provider to access the files in application folder...

Mail.ru: XSS на сайте https://warofdragons.my.games/.

Reflected XSS via GET parameter in https://warofdragons.my.games...

Mail.ru: Ability to find out the name of the database table and its columns

Verbose errors were not disabled on api.iconjob.co An attacker can learn the name of a database table and its columns from an error message. This can help implement other SQL injection type attacks...

Mail.ru: [myMail Android] Access to protected app components via RegistrationPhoneActivity

RegistrationPhoneActivity of My.com MyMail application for Android could be locally exploited by malicious application to access internal activities as was demonstrated by spoofing logon screen to send authentication request to arbitrary site...

Mail.ru: Blind XSS Stored On Admin Panel Through Name Parameter In [ https://technoatom.mail.ru/]

Blind XSS via username in admin panel of technoatom.mail.ru...

Mail.ru: Stored XSS in Review Section https://games.mail.ru/

Stored XSS via malcrafted link bbcode in review editor...

Mail.ru: information disclosure via IDOR on "https://target.my.com/api/v2/coverage/segment.json?id={id}" endpoint

IDOR in target.my.com allowed to get numeric segmentation identifiers by site id. No sensitive information or associated security risks identified...

Mail.ru: Account takeover at geekbrains.ru

It was possible to takeover Geekbrains account registered via Google account due to misuse of unconfirmed attached e-mail as account id...

Mail.ru: Reflected XSS with WAF Bypass https://pw.mail.ru

Reflected user-assisted XSS in https://pw.mail.ru...

Mail.ru: Customer domain information disclosure at https://biz.mail.ru/api/domains/*

IDOR vulnerability in biz.mail.ru could be used to enumerate registered domains...

Mail.ru: XSS via POST request to https://account.mail.ru/signup/

Reflected XSS in account.mail.ru via POST parameter back...

Mail.ru: XXE на webdav.mail.ru - PROPFIND/PROPPATCH

XXE injection in webdav.mail.ru...

Mail.ru: Blind SSRF на calendar.mail.ru при импорте календаря

Blind SSRF in calendar.mail.ru via calendar import functionality...

Mail.ru: Stored XSS in calendar via UID parameter

Stored XSS in calendar.mail.ru via UUID of calendar...

Mail.ru: API method at api.my.games allows to enumerate user emails

API method which allowed to enumerate emails at https://api.my.games/ was not sufficiently protected...

Mail.ru: HTML injection at face.city-mobil.ru

Browser-specific IE HTML injection in city-mobil.ru On the moment of reporting, HTML injection within this scope was considered under same condition with XSS. Under current rules, HTML injection without proven XSS execution may be not eligible for bounty. https://rdot.org/forum/showthread.php?t=2...

Mail.ru: Leak Sensetive Data at face.city-mobil.ru

Unrestricted git directory in face.city-mobil.ru could leak sensitive data including access token for internal repository...

Mail.ru: Public available Sensitive Information about drivers

Domain, site, application -- API for client app Citimobil https://c-api.city-mobil.ru/ Version 4.33.0 and others Testing environment -- Device on any OS with internet connection Any software to send https requests Steps to reproduce -- Send POST request to url...