826 matches found
Mail.ru: CSRF на biz.mail.ru
Здравствуйте, Я обнаружил CSRF на biz.mail.ru PoC: система думает что мы хотели добавить эти домены в свой аккаунт через час мы получим майли: "Нужна помощь с подтверждением домена .com?" F239336 Благодарю за внимание. С уважением, Джейхун Джафаров c37hun...
Mail.ru: Self-xss via drag&drop in email form
User-assisted XSS in message composer's drag-n-drop feature via alt property of emoji-style image...
Mail.ru: Possibility to view subdepartments for arbitrary domain
By directly referencing to department ID in biz.mail.ru, it was possible to see the names of departments without knowledge of which organization this department belongs to Leakage of every existing department/unit of every domain via changing parameters directly in http request...
Mail.ru: Download attachments with traversal path into any sdcard directory (incomplete fix 106097)
Привет 106097 был исправлен не полностью, все еще можно скачать вложение в письме мимо downloads директории на sdcard. Если имя файла будет что-от вроде "../file.txt" то такой файл будет скачен мимо /sdcard/download. Для файлов "%2e%2e%2f/file.txt" скачивает правильно. Скачать можно только на...
Mail.ru: [health.mail.ru] Раскрытие SSI сценариев
SSI template content leaked on invalid HTTP request in health.mail.ru and few more projects. On the moment of reporting, health.mail.ru was in Main scope of bug bounty program...
Mail.ru: XSS через подгрузку ссылки.
Доброго времени суток. Я нашел новую xss в https://connect.mail.ru/ POC: 1. Переходим на неизвестную ветку википедии, например эту https://io.wikipedia.org/wiki/Nenufaro 2. Вставляем туда скрипт " F232448 3. Подгружаем страничку википедии через наш сервис...
Mail.ru: Stored self-XSS pubg.mail.ru в нескольких местах
Stored self-XSS in pubg.mail.ru via account name if login via social network is used. pubg.mail.ru is not currently in bug bounty scope...
Mail.ru: [lk-cdn.3igames.mail.ru] apc.php
APC UPS status monitoring script was available from outside on lk-cdn.3igames.mail.ru 3igames.mail.ru is not currently covered with bug bounty program...
Mail.ru: blind XXE when uploading avatar in mymail phone app
Blind XML external ENTITY / DTD injection via avatar upload feature in My.Com's MyMail backend results in potential SSRF...
Mail.ru: XSS в теле письма, в блочных стилях.
Здравствуйте! Бага в тестируемом HTML парсере. В блочных стилях Рабочий код: \test background-image:url'//\27\29\3Bcw:;a:'\3b\3C/style/\20;a:\28\27\27'; background-image:url'//\27\29\3Bcw:;a:'\3b;a:\28\27\27'; \p background-image:url'//\27\29\3Bcw:;a:'\3b;a:\28\27\27'; В аттаче txt файл с...
Mail.ru: reflected XSS on healt.mail.ru
Reflected XSS via GET paramters in quiz game on promo site in health.mail.ru subdomain. .health.mail.ru was in the bug bounty program's scope on the moment of report submission...
Mail.ru: XSS на e.mail.ru в мобильном приложении!
Cross application scripting via message content in mobile mail application. Vulnerability affected a limited number of external domains connected in Mail.Ru mail application. Users of Mail.Ru mailboxes and largest mailbox providers were not affected, no access to confidential data was possible as...
Mail.ru: Blind XXE on my.mail.ru
Blind XXE in my.mail.ru Moi Mir avatar upload feature. Moi Mir is not covered by regular Bug Bounty program, a bounty was awarded as a bones due to high potential impact. Blind OOB XXE issue was found in upload avatar feature...
Mail.ru: touch.mail.ru/messages - Stored XSS
XSS in touch.mail.ru image preview feature via crafted attachment filename...
Mail.ru: Stored XSS when you read eamils. <style>
Hello team, I have found stored XSS when you read emails via html tag. PoC: div background-image: url"data:image/jpg;base64,"; background-color: cccccc; lol F226715...
Mail.ru: Unupdated ImageMagic leads to uninitialized server memory disclosure
It was possible to disclosure the part of server memory from uncontrolled location on account.my.com project via uploaded GIF image header manipulation. account.my.com is not currently in the Bug Bounty scope, reward was paid as a bonus due to potential severity. CVE-2017-15277...
Mail.ru: XSS в письме, в теле письма.
Здравствуйте! XSS срабатывает на e.mail.ru, m.mail.ru, light.mail.ru и в мобильном приложении. Уязвимость присутствует в параметрах стилей, в ...здесь... срабатывает, если экранировать символы. Рабочий вектор здесь одиночные бэкслэш, в примере ещё ниже хостинг обрезал до одиночных: i\\ Отправка...
Mail.ru: XSS on https://account.mail.ru/login via postMessage
Обработчик сообщений на страничке https://account.mail.ru/login не проверяет источник, что позволяет вызвать любую доступную команду с произвольного ресурса: js // https://img.imgsmail.ru/ag/0.3.3/authGate.js:formatted function ca a = a || window.event; var c, d, h = , i = a.data, j = a.source; i...
Mail.ru: XSS in biz.mail.ru/error
Hello again! I've found an open redirect issue and possibility to bypass your filters to add direct links in tag Domain, site, application: biz.mail.ru/error Testing environment: latest Chrome Steps to reproduce: 1 go to https://biz.mail.ru/error/500/?from=%20https://www.google.com 2 click Refres...
Mail.ru: A manager of a determinate group of users still might have access to any user account from any group that he doesn't administrate anymore.
Domain, site, application: biz.mail.ru Testing environment: Lastest Chrome Steps to reproduce: Ok, this one is pretty much depending on scenario, so lets assume that there is the Evil Manager exists with network knowledge on higher than medium level. At first lets say that there is such role as...