826 matches found
Mail.ru: astrumnival.com subdomain
Hostname in astrumnival.com domain was unintentionally delegated to external service. astrumnival.com domain is not currently in use...
Mail.ru: Cross application scripting via account.mail.ru
Crossapplication scripting via User-Agent on push login confirmation functionality in mobile application in the context of account.mail.ru domain allowed session hijacking with minimal user interaction...
Mail.ru: Дюп предметов lootdog и возможность их продавать.
It was possible to duplicated item for sale infinitely via modified request on lootdog.io...
Mail.ru: [lootdog.io] User phone number disclosure
User phone could be self-disclosed on lootdog.io...
Mail.ru: Открытая панель
Non-production dashboad with random testing data was available on tarantool.org subdomain...
Mail.ru: [e.mail.ru] Stored xss in Mpop cookie
XSS on e.mail.ru domain via cookie content XSS in cookie via mitm. Good article - https://habr.com/en/post/460101/ by @w2w...
Mail.ru: sql
SQL interface for web analytics was available at terrhq.ru subdomain...
Mail.ru: ОДМИН ТЭСТ
Test script on jw-cn-test-1.ext.terrhq.ru could be used to disclosure local database account. Database itself was not accessible...
Mail.ru: сервант статус
Apache server status was available at jw-cn-test-1.ext.terrhq.ru...
Mail.ru: source code leak
A fragment of source code was available for download on flash.terrhq.ru...
Mail.ru: xss
XSS was reported for bb.cdn.gmru.net domain. This domain is considered sandbox with no security impact for XSS, but same XSS also existed in bb.mail.ru subdomain...
Mail.ru: XXE крит
XXE injection in partner service with delegated my.com subdomain...
Mail.ru: benchmark metrics available at 5.61.239.154
Benchmark data for 3rd party product was available from outside. Benchmarking was performed using generated data in isolated testing evironment, so no actual data or production information was leaked...
Mail.ru: Open Redirect In passport.maps.me/logout/?next=//fb.com/
Open redirect on passport.maps.me page...
Mail.ru: [o2.mail.ru] nginx alias traversal
Invalid nginx configuration allowed limited path traversal in o2.mail.ru...
Mail.ru: [Mail.Ru Android] Typo in permission name allows to write contacts without user knowledge
Hi, Mail.Ru app registers permission writecontacts xml but uses write xml which is unclaimed, has normal protection level by default and automatically granted to all apps. It means that any third-party apps have ability to insert any data into that database PoC xml java ContentValues contentValue...
Mail.ru: SSRF на api.icq.net
SSRF in api.icq.net due to invalid handling of non-zero Content-Length value in GET requests...
Mail.ru: Reference to external uncontrolled resource in terrhq.ru
Domain name esrv3.wartune-fra.ext.terrhq.ru was erroneously pointing to external resource outside of organizational control. terrhq.ru domain belongs to mail.ru but is not currently used to host any resources...