826 matches found
Mail.ru: [gamesventures.mail.ru] Publicly accessible GIT directory
Publicliy accessible git-related file in gamesventures.mail.ru gamesventures.mail.ru is not currently covered with bug bounty program...
Mail.ru: CSRF. Удаление адресной книги, добавление контактов
Привет! Мною был обнаружен старый интерфейс управления контактами в почте: https://e.mail.ru/cgi-bin/newabsetup Не весь функционал там рабочий, но пару CSRF удалось найти: https://e.mail.ru/cgi-bin/newabsetup?remove&confirm=1 - запрос полностью стирает адресную книгу...
Mail.ru: XSS в портальной навигации
Stored self-XSS in portal navigation via external account name...
Mail.ru: Xss в https://e.mail.ru/
Привет, Я обнаружил xss на https://e.mail.ru/ , похоже, это self-xss, но вдруг в будущем планируется возможность расшаривать данную функциональность и это будет не self-xss, также атака csrf logout/csrf login может расширить её функционал. В том числе, это self-xss обходит текущие правила CSP. Дл...
Mail.ru: IDOR in tender.mail.ru leading to Information Disclosure
tender.mail.ru could partially leak information about few organizations with accounts in incomplete registration state. Information leaked was public non confidential organization registry information, such as name, ИНН ITN, ОГРН PSRN, etc. tender.mail.ru is not currently in bug bounty scope...
Mail.ru: Android MailRu Email: Thirdparty can access private data files with small user interaction
Hello, Team Domain, site, application --- Android Mail.Ru Email v. 5.5.1.21258 Testing environment --- Tested on non rooted Nexus 5x Android 7.1.2, Intro --- I found that 90693 was fixed incompletely and additionaly the attack can be improved using self sending activity. Steps --- 1. Create some...
Mail.ru: Дубликат: https://hackerone.com/reports/219171 (доступ к аккаунту, через сброс пароля)
duplicate: https://hackerone.com/reports/219171...
Mail.ru: Open Redirection at https://it.mail.ru/
Open redirection in it.mail.ru. it.mail.ru is not currently in the bug bounty scope...
Mail.ru: Open Redirect
Open redirection in certification.mail.ru. certification.mail.ru is not currently in the bug bounty scope...
Mail.ru: ssrf xspa [https://prt.mail.ru/] 2
Potential SSRF in prt.mail.ru. On the time of reporting, extended scope was not covered by bug bounty, a bounty for this report was awarded as a bonus...
Mail.ru: Cross-Site Request Forgery
CSRF in whiskas.ny.mail.ru "like" feature. whiskas.ny.mail.ru is not currently in the bug bounty scope...
Mail.ru: Stored XSS
Clickjacking and self-XSS in http://whiskas.ny.mail.ru/. This project is not currently in the bug bounty scope. I've found a Stored Self-XSS and turned it to be exploitable through Clickjacking...
Mail.ru: Open Redirect
Hey I would like to report an open redirect issue it.mail.ru Proof of Concept: 1. go to Register page https://it.mail.ru/en/users/register/?next=////www.evil.com/%2e%2e and Register a account 2. now open your mail and click the activation link This will redirect you to evil.com after click the...
Mail.ru: CRLF инъекция на https://tz.mail.ru
HTTP response header CRLF injection via GET parameters in tz.mail.ru. tz.mail.ru is not currently in the Bug bounty scope...
Mail.ru: Disclosure of information on static.dl.mail.ru
Greeting, I discovered a server with disclosure of information: http://static.dl.mail.ru/ F155883 With this /webstat/ , we can access various information from the server like paths, name of files and other precious information. http://static.dl.mail.ru/webstat/ F155884 F155885 F155887 We also...
Mail.ru: [tanks.mail.ru] Open Redirect
tanks.mail.ru had an open redirect in the form of https://tanks.mail.ru/index.php.example.com Reporter also noted this redirect can be used for double redirection from https://auth.mail.ru/cgi-bin/logout page, this is known behavior. Neither tank.mail.ru nor open redirects without additional impa...
Mail.ru: SSRF на https://target.my.com/
SSRF via submitting URL redirecting to internal resrouce to REST API method of target.my.com. target.my.com is not currently in the Bug Bounty scope, bounty was issued due to potential impact on different services and infrastructure...
Mail.ru: CSRF Send a message at street-combats.mail.ru
Hi again, I have that there is no CSRF token when sending a new message so you can CSRF anyone and make him send a message to anyone : this is the code...
Mail.ru: Излишние права при авторизации через интерфейс mail.ru
account.mail.ru allows user to be authenticated by external mail password. If user is authenticated with external e-mail and e-mail's password via account.mail.ru interface, he can access some of the gaming sites without additional authentication, though these sites can use different account...