826 matches found
Mail.ru: [e.mail.ru] XSS в поиске
Reflected XSS in e.mail.ru via GET paramters Multiple reflected XSS in the mailbox via the search param Timeline: Friday, July 6 2018, 23:26 – reported Saturday, July 7 2018, 01:13 – triaged Saturday, July 7 2018, 11:12 – temporary fix Monday, July 23 2018, 14:25 – resolved...
Mail.ru: molotok.m.mail.ru delegated to external entity
SDC bypass secure cookies access vulnerability in m.mail.ru due to subdomain name pointing to uncontrolled external host...
Mail.ru: Launch Any Activity in MyMail App
An exported activity in My.Com Mail application could be used to launch protected activities...
Mail.ru: Чтение системных данных приложения: данные для авторизации, логи, БД, личная переписка
Insufficient case sensitive filtering in intent URI could allow local malicious application to access local files via ICQ for Android...
Mail.ru: Shell upload in partner service
Shell code upload RCE vulnerability in partner service provided as an additional functionality withing mail.ru branded service. On the moment of reporting, partner services are not covered by bug bounty program, the bounty was awarded due to potential problem criticality...
Mail.ru: XSS в теле письма, в новой версии почты.
DOM clobbering in new "Octavius" interface beta feature led to stored XSS on message reading...
Mail.ru: XSS via message subject - mobile application
XSS in message compose window on forwarding message with crafted subject / sender name / content in mobile application for android...
blog-mail.ru XSS vulnerability
Open Bug Bounty ID: OBB-633210 Description| Value ---|--- Affected Website:| blog-mail.ru Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Mail.ru: слепая XSS в админ панели torg.mail.ru через отзыв
Blind XSS in admin panel for torg.mail.ru. torg.mail.ru is not in bug bounty program's scope, a bounty was awarded due to high potential impact. Недостаточная фильтрация приводит к XSS в административной панели в одном из поддоменов mail.ru через имя пользователя при оставлении отзыва...
Mail.ru: Stealing Arbitrary Private Files of MyMail App
It was possible for local malware application to steal sensitive local files of MyMail / Mail.Ru Mail application due to specifics of file:// schema URI handling in SharingActivity...
Mail.ru: SQL injection on jd.mail.ru
SQL injection via POST parameter in user registration at jd.mail.ru. die ███████████████████████████ ███████▀▀▀░░░░░░░▀▀▀███████ ████▀░░░░░░░░░░░░░░░░░▀████ ███│░░░░░░░░░░░░░░░░░░░│███ ██▌│░░░░░░░░░░░░░░░░░░░│▐██ ██░└┐░░░░░░░░░░░░░░░░░┌┘░██ ██░░└┐░░░░░░░░░░░░░░░┌┘░░██ ██░░┌┘▄▄▄▄▄░░░░░▄▄▄▄▄└┐░░██...
Mail.ru: Stored XSS in api.icq.net
Crossite scripting in api.icq.net domain. icq.net is considered as a sandbox domain, it does not use HTTP authentication or cookies, but XSS could be used to facilitate phishing attack...
Mail.ru: Reflected XSS in delivery-club.ru
Reflected XSS via GET argument. On the time of reporting, XSS in delivery-club.ru are not covered with bug bounty program...
Mail.ru: XSS https://health.mail.ru/my/ через внешнее имя аккаунта
Здравствуйте. Раньше репортил багу связанную с ником в одноклассниках так вот нашел еще одно место. На мобильной версии https://health.mail.ru/my/ в никнейме мы можем видеть self-stored xss. F305597 Так выглядит имя: F305599 Impact XSS...
Mail.ru: DNS Misconfiguration
Your localhost.mail.ru has address 127.0.0.1 and this may lead to "Same- Site" Scripting. Here is detailed description of this minor security issue by Tavis Ormandy: http://www.securityfocus.com/archive/1/486606/30/0/threaded I can also ping the localhost network from mail.ru, as in the image...
Mail.ru: XSS at https://icq.com/people
DOM Based XSS existed in old people search subservice icq.com/people. This functionality was removed...
Mail.ru: [account.mail.ru] XSS на странице восстановления пароля
При генерации формы восстановления пароля значение email подставляется туда как есть: https://account.mail.ru/recovery/support?email=%3Csvg%20onload=alertdocument.domain%3E Domain, site, application -- https://account.mail.ru/recovery/support Testing environment -- Firefox 60.0 Chrome 66.0 Steps ...
Mail.ru: [account.mail.ru] XSS на странице удаления аккаунта через backUrl
Недостаточная валидация параметра backUrl даёт возможность указать javascript-ссылку: https://account.mail.ru/user/delete?backUrl=javascript:alertdocument.domain javascript getBackUrl: function url return /^http/.testurl ? url : this.urlData.backUrl || this.config.get'backUrl' ||...
Mail.ru: Clickjacking Vulnerability on https://support.my.com/games/ticket/xxxx/
Hi There, I have found a Clickjacking vulnerability on your site. Steps to reproduce: 1.Go to https://support.my.com this site 2.Generate a Clickjacking script, save it as .html and run into your browser Script: iframe width: 800px; height: 500px; position: absolute; top: 0; left: 0; filter:...