Mail.ru: Stored XSS в профиле водителя [city-mobil.ru/taxiserv]

Stored XSS on city-mobil.ru/taxiserv driver cabinet via firstname and lastname of driver...

Mail.ru: CSRF in updating username https://pw.mail.ru/

CSRF vulnerability in pw.mail.ru allowed to change nickname with cross-site request...

Mail.ru: unclaimed subdomain special.rkeeper.ru to takeover from tilda.cc

Domain, site, application -- http://special.rkeeper.ru/ Testing environment -- OS version, browser information, settings and prerequisites to reproduce vulnerability, testing tools used, etc Steps to reproduce: 1. create account on tilda.cc 1. create a aproject then a domain will be assigned to...

Mail.ru: BLIND SSRF ON http://jsgames.mail.ru via avaOp parameter

Blind SSRF in jsgames.mail.ru Limited SSRF allowing to read internal images...

Mail.ru: DOM XSS on https://biz.mail.ru/domains/goto/mail/ via parameter pollution

DOM based XSS in biz.mail.ru...

Mail.ru: XSS account.mail.ru

XSS in account.mail.ru via cookie value...

Mail.ru: Exposed Git Repo at https://mini-app.delivery-club.ru

Leaking sensitive application data in configuration files at mini-app.delivery-club.ru...

Mail.ru: HTML injection in an email [delivery.city-mobil.ru]

It was possible to inject spoofed HTML content into delivery.city-mobil.ru registration e-mail message via forged user name...

Mail.ru: Database read through file attachment [content://]

Local malicious application selected as a file picker by user could obtain access to ICQ for Android local database by returning a content URI...

Mail.ru: SDC bypass cloud.mail.ru for every /api/v3/* endpoint.

SDCS cookie was not properly checked for few cloud.mail.ru endpoints, allowing to bypass SDC secure domain cookies protection for privilege separation between projects...

Mail.ru: Django Debug=True Leaks admin email addresss and serval system information

Domain, site, application weblate.ucs.ru Steps to reproduce For getting all Url Patterns 1.Open https://weblate.ucs.ru / 2.now after / enter any random string 3.It will open 404 page which contains all the Url Patterns of Website For getting all debug info 1.Open https://weblate.ucs.ru 2. Now go ...

Mail.ru: Account takeover on [support2.ucs.ru]

Password at support2.ucs.ru was not sufficiently protected against bruteforce...

Mail.ru: [com.icq.mobile.client] Любое стороннее приложение может угнать сессию, а также другие файлы приложения

Insufficient validation of sharing activity parameters for ICQ application on Android allowed access to sensitive application's files...

Mail.ru: reflected xss on learn.city-mobil.ru via redirect_url parameter

Reflected XSS in learn.city-mobil.ru via GET parameter redirecturl Назад...

Mail.ru: Clickjacking Vulnerability via https://www.donationalerts.com/help/support leads to bypass for widget.support.my.games X-Frame Options

Clickjacking protection bypass on widget.support.my.games via donationalerts.com...

Mail.ru: Disk-o Cloud application (Windows) does not validate server certificate on a TLS connection

A debugging/staging functionality disabling TLS certificate check was accidentally enabled in production code for Disk-O 20.10.0133, fixed in version 20.11.0006. 21.04 version adds integrity check for update process...

Mail.ru: file read on MCS servers via supplying a QCOW2 image with external backing file

Local file read in mcs.mail.ru by providing QCOW2 disk image with backing image pointing to external file Mail.ru Cloud Solutions allows uploading custom images for disks. This functionality supported QCOW2 disk images. A QCOW2 disk image can have a so-called "backing image" - a file to read...

Mail.ru: SQL injection delivery-club.ru (ClickHouse)

Some requests to clickhouse in delivery-club.ru were externally available potentially allowing SQL-like requests execution...

Mail.ru: [files.ucs.ru] ProFTPd mod_copy Arbitrary Read/Write

CVE-2015-3306 in opened to external network FTP server on files.ucs.ru...

Mail.ru: [api-site.city-mobil.ru] Improper access control leads to information disclosure (bypass of #977597 fix)

Authorization for api-site.city-mobil.ru endpoint was not properly checked, allowing to obtain data about arbitrary corporate.city-mobil.ru orders and users. Find a way to bypass a bad fix for 977597. There are more steps in the new scenario that allows exploiting the issue. An attacker needs to...