Mail.ru: Settings page in https://support.my.com is vulnerable to clickjacking

Researcher found that settings page on support.my.com was vulnerable to clickjacking...

Mail.ru: Shell upload in http://widget.support.my.com/

PHP shell upload was possible on widget.support.my.com support frontend site. This report was accepted within lootdog.io preliminary bug bounty program, because lootdog.io is supported via support.my.com...

Mail.ru: [support.my.com] Reflected XSS

Reflected XSS via POST parameters in support.my.com. support.my.com is not covered by bug bounty scope...

Mail.ru: [support.my.com] Internet Explorer XSS

PoC Internet Explorer: http://blackfan.ru/x?r=http://support.my.com/"-alertdocument.domain-"/%252e%252e/games HTTP Response: "continue": "http://support.my.com/"-alertdocument.domain-"/%2e%2e/games", "signupmethod": "email,phone", "signupcontinue":...