Mail.ru: Content Spoofing vulnerability in Mail.ru mobile

Hi , I found a content spoofing or content injection vulnerability in m.mail.ru URL :https://m.mail.ru/login?email=Content%20spoofing%[email protected]&fail=1 Paramater email is vulnerable to content injection . The value assigned to parameter email gets reflected in the input field which...

Nasty Covert Redirect Vulnerability found in OAuth and OpenID

After Heartbleed bug, a security flaw in widely used open-source software OpenSSL that puts countless websites at risk, another vulnerability has been found in popular authentication software OpenID and authorization software OAuth. Wang Jing, a Chinese mathematics Ph.D student at the Nanyang...

Mail.ru: SQL inj

GET /guide/ HTTP/1.1 User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko Chrome/28.0.1500.63 Safari/537.36 Via: ifnow=sysdate,sleep10,0/'XORifnow=sysdate,sleep10,0OR'"XORifnow=sysdate,sleep10,0 and 1=1"/ X-Requested-With: XMLHttpRequest Referer: http://bw.mail.ru/...

Mail.ru: Persistent XSS in afisha.mail.ru

Adding a comment to article, this makes javascript execution possible. POST: http://afisha.mail.ru/ext/addcomment/ Post Content alias=article&id=42797&pid=&count=20&commentbody=%5Btesting%5D+%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&ok=%D0%94%D0%BE%D0%B1%D0%B0%D0%B2%D0%B8%D1%82%D1%8C also the...

Mail.ru: SQL

для SQL inj. GET /registration.php HTTP/1.1 Host: botva.mail.ru User-Agent: Mozilla/5.0 Windows NT 6.2; WOW64; rv:28.0 Gecko/20100101 Firefox/28.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: ru,en-us;q=0.7,en;q=0.3 Accept-Encoding: gzip, deflate Cookie:...

Mail.ru: SQL inj

http://parapa.mail.ru/gallery/BirthdayParaPa/-1%27%20or%201=IF%28LENGTH%28ASCII%28%28SELECT%20USER%28%29%29%29%29=3,%201,%200%29%20--%20//...

Mail.ru: Login without SSL-Protection

Hallo, e.mail.ru is not properly protected with SSL encryption It is possible to login without using HTTPS, this could to lead man-in-the-middle password-disclosure. The best, Simon...

Mail.ru: Time based sql injection

Оригинальный запрос http://kv.mail.ru/?ref=horde6 Запрос с задержкой http://kv.mail.ru/?ref=horde6'%2bbenchmark10000000%2csha11%2b'...

Mail.ru: SQL injection [дырка в движке форума]

URL: http://kv.mail.ru/forum/search.php?do=process POST DATA:...

Mail.ru: Home page reflected XSS

There is an XSS on the front page of mail.ru which can be exploited by manipulating the regionConfirm page parameter. The parameter is included without proper escaping in JavaScript code featured on the page. Because of the nature of the exploit, browser XSS protection may be bypassed...

Mail.ru: Unproper usage of Mobile Number that will lead to Information Disclosure

We know that our mobile number is connected to some subdomains of mail.ru like calendar, cloud and etc. I found out that using 1 Mobile Number can create or use it to MANY ACCOUNTS. This is what I did.. I have a main account in mail.ru Email: [email protected] with Mobile Number of: 639154219078...

Mail.ru: localStorage не чистится после выхода

Steps to reproduce: 1. Идем https://e.mail.ru/login 2. Авторизуемся и при этом снимаем галочку с чекбоска "запомнить почту" не обязательно, в принципе 3. После удачной авторизации жмём "Выход" 4. После того как вышли, идем опять https://e.mail.ru/login 5. Смотрим локальное хранилище localStorage...

Mail.ru: Admin panel of http://tp-test1.corp.mail.ru/ is acccessible publicly

http://tp-test1.corp.mail.ru/ link has various operations which should not be accessible to an anonymous user. As admin panel is accessible an attacker can use this information in targeted attack and he can bruteforce the username and password. on the other side server information is easily...

Mail.ru: Clickjacking

URL :- http://promo.calendar.mail.ru/ POC :- Clickjack test page Website is vulnerable to clickjacking!...

Mail.ru: Reflected XSS

http://cards.mail.ru/search/?search= Vulnreable to reflected XSS Payload "!-- See Screen Shot...

Mail.ru: Clicjacking on Login panel

i am able to run on frame which lead to click jacking, Find Details on screen shot...

Mail.ru: Xss On http://my.mail.ru/

http://my.mail.ru/video/search? plyload "alert'XSS BY CK' Find ON screens hot...

Mail.ru: rs.mail.ru - Flash Based XSS

Hi, I found a flash based XSS in rs.mail.ru. Vulnerable link: http://rs.mail.ru/b27161485.swf?link1=javascript:alertdocument.domain Just click on the page and you will see the alert. Tested on Mozilla Firefox Regards, Florin...

Swiss Firm Digs Up 300,000+ Usernames/Passwords on Pastebin

More than 300,000 credentials, usernames and passwords, were posted on the clipboard website Pastebin.com in the year 2013 alone according to a recent analysis by a Swiss security firm. As part of an experiment to determine how big the hacking industry is, High-Tech Bridge, a company until now...

U.S. and Russia–Not China–Lead List of Malicious Hosting Providers

China has become the go-to bogeyman behind every cyber attack or malware campaign, but if you’re looking for the most malicious hosting providers on the Web, you won’t find any of the top 10 in China. In fact, the United States and Russia have many more bad hosting providers in the top 20 than...