826 matches found
Mail.ru: XSS on https://www.delivery-club.ru/sd/test_330933/info/
Stored XSS on www.delivery-club.ru domain. On the time of reporting, delivery-club.ru client-side vulnerabilities are not covered by bug bounty program...
Mail.ru: Full account takeover am.ru
m.am.ru had no sufficient protection against bruteforce for SMS OTP. am.ru is not currently covered by Bug Bounty program...
Mail.ru: IDOR widget.support.my.com
На lootdog.io можно обратиться в службу поддержки. Когда мы создали тикет и хотим его подгрузить, то выполняется запрос...
Atlassian Jira Mail.ru Calendar plugin cross-site scripting vulnerability
Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of issues and defects in the workplace.Mail.ru Calendar plugin is one of the calendar plugins. A cross-site scripting vulnerability exists in Atlassian Jira...
Mail.ru: Stored Blind XSS
Blind XSS via support.my.com request ticket kayako.support.my.com is not covered with bug bounty, the bounty was awarded because because lootdog.io users were potentially affected...
CVE-2016-10716
The Mail.ru Calendar plugin before 2.5.0.61 for Atlassian Jira has XSS via the Name field in a Create Calender action, related to a MailRuCalendar.jspaperiod/month URI...
Information disclosure
The Mail.ru Calendar plugin before 2.5.0.61 for Atlassian Jira has XSS via the Name field in a Create Calender action, related to a MailRuCalendar.jspaperiod/month URI...
CVE-2016-10716
The Mail.ru Calendar plugin before 2.5.0.61 for Atlassian Jira has XSS via the Name field in a Create Calender action, related to a MailRuCalendar.jspaperiod/month URI...
CVE-2016-10716
The CVE refers to a cross-site scripting (XSS) vulnerability in the Mail.ru Calendar plugin for Atlassian Jira, affecting versions before 2.5.0.61. The XSS is triggered via the Name field in a Create Calendar action and is linked to the MailRuCalendar.jspa#period/month URI. Several connected sour...
CVE-2016-10716
The Mail.ru Calendar plugin before 2.5.0.61 for Atlassian Jira has XSS via the Name field in a Create Calender action, related to a MailRuCalendar.jspaperiod/month URI...
Honeypot strategy is no longer effectively preventing spam account signup
panel:title=Fix From 3.9.5 onwards we have turned off the honeypot in favour of using captcha anyone affected by this issue just needs to switch the CAPTCHA on...
Mail.ru: Account Takeover on https://www.delivery-club.ru через партнерский аккаунт.
Improper access control allowed partner account to perform privileged actions for user's account with same ID. Некорректная проверки сессии...
Mail.ru: Double authentication bypass
Report describes current behavior of "Bind session to IP" and "Disable parallel session" security settings and is unrelated to authentication. While behavior doesn't match to reporter's expectation e.g. mobile and desktop sessions may exist in parallel despite of the settings current behavior is...
Mail.ru: Local paths disclosure through error message
bonus.mail.ru disclosed trace information with absolute paths via 5xx error messages bonus.mail.ru is not covered by bug bounty scope...
Mail.ru: XSS в нике при запросе в контакты.
Stored XSS in web.icq.com via nickname in contact add request...
Mail.ru: XSS в названии лайвчата
Stored XSS in web.icq.com via livechat name...
Mail.ru: Stored self-xss and its escalation to a victim account in e.mail.ru
Stored XSS via external OAuth account data...
Mail.ru: [online.games.mail.ru] - Sensitive information disclosure
include files with potentially sensitive configuration information were available via HTTP. online.games.mail.ru is not covered by bug bounty, an award was issued as a bonus...