Mail.ru: [screenshot.mail.ru] CRLF Injection

CRLF injection in screenshot.mail.ru allowed to manipulate response headers...

Mail.ru: Apache server-info enabled

Apache server-info was available on cn-stat.ext.terrhq.ru host...

Mail.ru: ******.*****.my.com open proxy

A proxy host in my.com domain related to partner service located in external network was misconfigured as an open proxy...

Mail.ru: XSS in e.mail.ru

XSS via dom clobbering on message reply composing...

Mail.ru: Bypass security fixes by downgrading version of application

Version downgrade attack was possible in webagent web application webagent.mail.ru. It could allow attacker to force user to visit an older version of web application with known vulnerabilities...

Mail.ru: Найден build.sh в webagent.mail.ru

Source code of build script for web application was available for download. It could leak some non-sensitive information on internal build processes and configurations...

Mail.ru: Блокированный ящик ( Обход )

It was possible to bypass administrative lock for mailbox e.g. lock set by biz.mail.ru domain administrator by pre-requesting recovery link...

Mail.ru: [moba.my.com] phpinfo, logs

PHP info and fragment of access logs were available...

Mail.ru: [sj.my.com] Source Code Disclosure /.svn/wc.db

Available SVN files for sj.my.com led to source code disclosure. sj.my.com is not currently covered by Bug Bounty program...

Mail.ru: Cross-site Scripting (XSS) - Reflected vseapteki.ru

Reflected XSS via GET parameters in vseapteki.ru...

Mail.ru: Stored XSS

XSS in "Undo" functionality of message editing on replying to malformed message...

Mail.ru: ДОБАВЛЕНИЕ СВОИХ ДАТ В КАЛЕНДАРЬ ПОЛЬЗОВАТЕЛЮ !

Reporter pointed to possibility to mark scheduled meeting request sent via ICS file as accepted in calendar via CSRF by bruteforcing attachment id. Currently, this behavior is not believed to introduce real additional security risks, because meeting can be added anyway without user's intervention...

Mail.ru: ICQ 10.0.12371 icq: Uri Handler '-testability' URL File Insecure Library Loading Code Execution Vulnerability

An exploitation of combination of unsafe URI handler and insecure DLL loading could result in code execution via DLL injection in ICQ desktop application for Windows if user executes malformed .url file...

Mail.ru: XSS on New contact

Self-XSS was reported for web.icq.com. According to bug bounty program's rules, self XSS reports are not considered...

Mail.ru: Stored XSS in email

XSS in message composer if user replies to malformed message...

Mail.ru: [evo2.my.com] Internet Explorer XSS

Browser specific XSS via GET parameters in evo2.my.com. evo2.my.com is not currentl covered by bug bounty program...

Mail.ru: [rm.mail.ru] Request-Path XSS

Reflected XSS via GET paramters. rm.mail.ru is not covered by bug bounty program...

Mail.ru: Possible to Upload Local Arbitrary Private File to the Cloud against User's Will

Unchecked permission in file sharing functionality could allow malicious application user-assisted access to arbitrary file in Mail.Ru Cloud android application...

Mail.ru: XSS на странице account.mail.ru/recovery

Reflected XSS via GET parameters in account.mail.ru...

Mail.ru: Path Traversal When Sharing with Cloud Mail.Ru App via a file with Crated Name

Path traversal vulnerability via crafted file name allowed user-assisted access to arbitrary application files in Mail.Ru Cloud android application...