826 matches found
Mail.ru: Stored XSS on https://community.my.games/ (Add Post)
Two stored XSS at https://community.my.games/. First XSS via upload photo title at link https://community.my.games/community/game/GameName/ . Second XSS via Discussion at the same link...
Mail.ru: Mail.Ru Top - Website Counter Bruteforcing
counter-specific password at top.mail.ru was not sufficiently protected against bruteforce...
Mail.ru: [city-mobil.ru/taxiserv/] IDOR leads to driver account takeover
IDOR vulnerability allowed partner account with manager role to takeover driver's accounts belonging to different partner...
Mail.ru: [https://fleet.city-mobil.ru] Stored XSS into driver mailing
Stored XSS via content of the message to driver in operator's interface...
Mail.ru: relap.io IDOR
IDOR vulnerability in relap.io allowed to disclosure attributes of arbitrary site...
Mail.ru: Mirror of https://city-mobil.ru admin interface
Network restrictions for admin interface could be bypassed via alternate hostnames...
Mail.ru: Possible tokens leak on ws-app.city-mobil.ru
Potentially sensitive application related information was disclosed via debug interface in ws-app.city-mobil.ru...
Mail.ru: tracker.my.com information disclosure via csrf bypass
CSRF vulnerability in tracker.my.com allowed attacker to invite himself as a project owner via crossite request...
Mail.ru: SSRF & LFR on city-mobil.ru
SSRF/LFR vulnerability via photo upload functionality of partner's cabinet of city-mobil.ru...
Mail.ru: SSRF & LFR via on city-mobil.ru
SSRF/LFR vulnerability via photo editor functionality of partner's cabinet of city-mobil.ru...
Mail.ru: SSRF on fleet.city-mobil.ru leads to local file read
SSRF/LFR vulnerability via image retrieving functionality of operator's cabinet of fleet.city-mobil.ru...
Mail.ru: [city-mobil.ru/taxiserv/] Disclosure information about drivers
IDOR vulnerabilitiy in city-mobil.ru alllowed partner account with superuser privileges to access data of drivers belonging to different partners...
Mail.ru: [https://city-mobil.ru/taxiserv] IDOR leads to information disclosure
IDOR vulnerability for orders report allowed partner's superuser account to access information related to different partners...
Mail.ru: [panel.city-mobil.ru/admin/] Blind XSS into username
Blind XSS in admin/support panel of city-mobil.ru via partner superuser's name different from 746497...
Mail.ru: [https://city-mobil.ru/taxiserv] Blind XSS into username
Blind XSS in admin/support panel of city-mobil.ru via partner superuser's name...
Mail.ru: Boolean-based SQL Injection on relap.io
Boolean/error based SQLi in relap.io due to insecure use of GET parameters...
Mail.ru: Mail.Ru Email for Android: Injecting custom screen inside adding new account flow
Intent was implicitely invoked on account refistration in Mail.ru Mail application for Android, allowing screen content spoofing via local application...
Mail.ru: SSRF in filtering on relap.io
Relap fetcher used to access external resources in relap.io project was not properly isolated from the production networks leaving potential for non-blind SSRFs. relap.io was in Ext.B scope on the moment of reporting...