Mail.ru: В самокат имеется возможность просмотра суммы заказа и номера заказа по ID [smart.space]

IDOR in smart.space API allowed to list number and amount of order without attribution to user...

Mail.ru: В самокате можно просматривать и изменять данные любого заказа без авторизации

IDOR in smart.space API allowed to change orders and list items of order content...

Mail.ru: Forgot Password Page SMS Brute Force could lead to Account Takeover using Android/IOS app "About the house" via api.prodom.smart.space

Password recovery procedure was not sufficiently protected against bruteforce and allowed arbitrary smart.space account takeover...