826 matches found
Mail.ru: JMX RMI command injection on 195.211.131.82(Mail.ru Gaming)
Externally available Jolokia interface in Mail.Ru Gaming network allowed JMX RMI commands injection Сommand injection in Jolokia JMX. Reading the docs helps. A lot. Also, having good friends who can help you when you need it:...
Mail.ru: Information disclosure with sensitive data
Apache server status was available at touch.mail.ru, leaking some requests information...
Mail.ru: Information Disclosure [ https://curious.ru/api/submissions ]
API endpoint at curious.ru disclosed e-mails of subscribed users...
Mail.ru: worki.ru: SMS code bruteforce
SMS code verification process in worki.ru was not sufficiently protected against bruteforce attack Common flaws of SMS auth: https://blog.deteact.com/common-flaws-of-sms-auth/...
Mail.ru: Stored XSS on go.mail.ru
Page URI in search results output on go.mail.ru was not properly sanitized...
Mail.ru: CSRF in attach phone API endpoint on delivery-club.ru
Legacy delivery-club.ru API endpoint allowed to attach arbitrary phone without checking the validation code and without additional CSRF protection...
Mail.ru: OOB XXE
Limited XXE on XML request processing led to blind SSRF possibility OOB XXE on one of Ext. B Mail.ru domains, which could be exploited as blind SSRF...
Mail.ru: OOB XXE
Limited XXE on XML request processing led to blind SSRF possibility OOB XXE on one of Ext. B Mail.ru domains, which could be exploited as blind SSRF...
Mail.ru: XSS via Cookie in Mail.ru
Unfiltered cookie content was used in DOM manipulation, leading to XSS possibility...
Mail.ru: Blind SSRF on sentry.dev-my.com due to Sentry misconfiguration
Insufficient isolation of Sentry installation could potentially lead to blind SSRF...
Mail.ru: Race condition при покупке подарков на games.mail.ru
TOCTOU conditions in games.mail.ru gift purchase functionality allowed to spend bonus points above balance...
Mail.ru: Account takeover via CORS misconfigutation on https://beta.delivery-club.ru
Insufficient check for request origin allowed crossite access to beta.delivery-club.ru...
Mail.ru: [ RCE ] Through stopping the redirect in /admin/* the attacker able to bypass Authentication And Upload Malicious File
Combination of improper access control and unrestricted files upload in non-production service led to RCE possibility...
Mail.ru: Delete images of users with clickjacking in https://pw.mail.ru
Researcher found site-wide Clickjacking on https://pw.mail.ru which potentially could be used to trick user to delete avatar or change his/her profile data...
Mail.ru: Bash History file log
Researcher found a publicly accessible .bashhistory file on one of servers. File contained commands without sensitive data in them...
Mail.ru: Avatar upload allows arbitrary file overwriting
Directory traversal via filename extension for avatar upload allowed to overwrite arbitrary files in S3-compatible bucket for static files in pandao.ru. Pandao.ru belongs to extended scope...
Mail.ru: [agent.33slona.ru] Recovery code bruteforce
It was possible to bruteforce mobile recovery code...
Mail.ru: Disable 2FA via CSRF (Leads to 2FA Bypass)
CSRF vulnerability in pandao.ru allowed to disable 2FA. pandao.ru belongs to extended scope...