Mail.ru: Reflected XSS

Reflected XSS in target.my.com/ via URI GET parameter...

Mail.ru: Vertical Privilege Escalation on {target.my.com}

target.my.com user with read-only privilege can elevate privilege to add another user to project...

Mail.ru: SSRF на https://target.my.com/

SSRF via submitting URL redirecting to internal resrouce to REST API method of target.my.com. target.my.com is not currently in the Bug Bounty scope, bounty was issued due to potential impact on different services and infrastructure...