Skip to content

Latest commit

 

History

History
898 lines (897 loc) · 111 KB

TOPMAILRU.md

File metadata and controls

898 lines (897 loc) · 111 KB
Raw

Top reports from Mail.ru program at HackerOne:

  1. Time-Based SQL injection at city-mobil.ru to Mail.ru - 631 upvotes, $15000
  2. touch.mail.ru / e.mail.ru memory content disclosure to Mail.ru - 409 upvotes, $10000
  3. Unrestricted file upload on [ambassador.mail.ru] to Mail.ru - 404 upvotes, $3000
  4. Account Takeover worki.ru to Mail.ru - 391 upvotes, $1700
  5. Cross-organization data access in city-mobil.ru to Mail.ru - 373 upvotes, $8000
  6. SQL injection at fleet.city-mobil.ru to Mail.ru - 372 upvotes, $10000
  7. RCE on shared.mail.ru due to "widget" plugin to Mail.ru - 359 upvotes, $10000
  8. Account TakeOver at my.33slona.ru to Mail.ru - 359 upvotes, $1700
  9. SSRF & LFR via on city-mobil.ru to Mail.ru - 343 upvotes, $0
  10. [ RCE ] Through stopping the redirect in /admin/* the attacker able to bypass Authentication And Upload Malicious File to Mail.ru - 340 upvotes, $0
  11. [windows10.hi-tech.mail.ru] Blind SQL Injection to Mail.ru - 330 upvotes, $5000
  12. [fleet.city-mobil.ru] Driver balance increasing to Mail.ru - 319 upvotes, $0
  13. SSRF on fleet.city-mobil.ru leads to local file read to Mail.ru - 272 upvotes, $0
  14. XXE on pulse.mail.ru to Mail.ru - 264 upvotes, $6000
  15. HTTP request smuggling (?) canpol.deti.mail.ru to Mail.ru - 241 upvotes, $5000
  16. SSRF & LFR on city-mobil.ru to Mail.ru - 237 upvotes, $0
  17. Boolean-based SQL Injection on relap.io to Mail.ru - 227 upvotes, $0
  18. Blind SQL Injection in city-mobil.ru domain to Mail.ru - 224 upvotes, $2000
  19. file read on MCS servers via supplying a QCOW2 image with external backing file to Mail.ru - 222 upvotes, $15000
  20. [panel.city-mobil.ru/admin/] Blind XSS into username to Mail.ru - 219 upvotes, $0
  21. SQL LIKE clauses wildcard injection to Mail.ru - 217 upvotes, $8000
  22. Cross application scripting via account.mail.ru to Mail.ru - 205 upvotes, $5000
  23. Debug Mode Leak Critical Information [ AWS Keys , SMTP , Database , Django Secret Key ( RCE ) , Dodoc , Telegram , Twilio .. ] to Mail.ru - 205 upvotes, $0
  24. read new emails from any inbox IOS APP in notification center to Mail.ru - 186 upvotes, $10000
  25. Незащищённый экземпляр Zeppelin to Mail.ru - 166 upvotes, $35000
  26. JMX RMI command injection on 195.211.131.82(Mail.ru Gaming) to Mail.ru - 163 upvotes, $2000
  27. SQL Injection [unauthenticated] with direct output at https://news.mail.ru/ to Mail.ru - 156 upvotes, $7500
  28. Information disclosure with sensitive data to Mail.ru - 156 upvotes, $1500
  29. Access to Tarantool to Mail.ru - 155 upvotes, $4000
  30. Path traversal, SSTI and RCE on a MailRu acquisition to Mail.ru - 152 upvotes, $2000
  31. [mcs.mail.ru] Пользователь с ролью наблюдателя может создавать ключи доступа для очереди сообщений (sqs.mcs.mail.ru) to Mail.ru - 147 upvotes, $15000
  32. Account Takeover at worki.ru to Mail.ru - 143 upvotes, $1500
  33. [c-api.city-mobil.ru] Client authentication bypass leads to information disclosure to Mail.ru - 143 upvotes, $0
  34. Account Takeover at vseapteki.ru to Mail.ru - 142 upvotes, $2000
  35. Account TakeOver through password recovery at am.ru to Mail.ru - 139 upvotes, $3000
  36. XSS via message subject - mobile application to Mail.ru - 139 upvotes, $1000
  37. PHP code injection at tz.mail.ru to Mail.ru - 137 upvotes, $3000
  38. worki.ru: SMS code bruteforce to Mail.ru - 136 upvotes, $1657
  39. SSRF in clients.city-mobil.ru to Mail.ru - 132 upvotes, $1500
  40. SSRF in filtering on relap.io to Mail.ru - 130 upvotes, $0
  41. [api.pandao.ru] IDOR for order delivery address to Mail.ru - 125 upvotes, $3000
  42. SMS Brute Force Possibility via https://youdrive.today/login/web/code can lead to Account Takeover to Mail.ru - 121 upvotes, $0
  43. "😂" + Unauthenticated Stored XSS in API at https://api.my.games/comments/v1/comments/update/ to Mail.ru - 118 upvotes, $0
  44. web.icq.com XSS in chat message via contact info to Mail.ru - 116 upvotes, $0
  45. [agent.33slona.ru] Recovery code bruteforce to Mail.ru - 104 upvotes, $0
  46. [city-mobil.ru] SSRF & limited LFR on /taxiserv/photoeditor/save endpoint via base64 POST parameter to Mail.ru - 95 upvotes, $0
  47. Open Selenoid instance at 188.93.63.186 leads to LFR/SSRF. to Mail.ru - 93 upvotes, $6000
  48. turboslim.lady.mail.ru - Blind sql-injection. to Mail.ru - 93 upvotes, $5000
  49. Blind SSRF in horizon-heat to Mail.ru - 91 upvotes, $2500
  50. Stored XSS to Mail.ru - 89 upvotes, $0
  51. Avatar upload allows arbitrary file overwriting to Mail.ru - 88 upvotes, $750
  52. SQL injection on jd.mail.ru to Mail.ru - 87 upvotes, $300
  53. 3igames.mail.ru SQL Injection to Mail.ru - 86 upvotes, $1500
  54. capsula.mail.ru - Admin blind stored XSS to Mail.ru - 86 upvotes, $1500
  55. Access User Tickets via IDOR in [widget.support.my.games] to Mail.ru - 86 upvotes, $0
  56. Reflected XSS in https://light.mail.ru/login via page to Mail.ru - 83 upvotes, $0
  57. Blind XSS in operator's interface for 33slona.ru to Mail.ru - 83 upvotes, $0
  58. [app-01.youdrive.club] RCE in CI/CD via dependency confusion to Mail.ru - 83 upvotes, $0
  59. SQL injection delivery-club.ru (ClickHouse) to Mail.ru - 76 upvotes, $5000
  60. Возможность зайти на любой аккаунт https://pandao.ru/ to Mail.ru - 76 upvotes, $2600
  61. [Mail.Ru Android] Typo in permission name allows to write contacts without user knowledge to Mail.ru - 75 upvotes, $0
  62. Stored XSS in email to Mail.ru - 75 upvotes, $0
  63. [https://city-mobil.ru/taxiserv] Blind XSS into username to Mail.ru - 74 upvotes, $0
  64. Path traversal lead to LFR via [CVE-2019-3394] to Mail.ru - 74 upvotes, $0
  65. Дюп предметов lootdog и возможность их продавать. to Mail.ru - 73 upvotes, $5000
  66. XSS via POST request to https://account.mail.ru/signup/ to Mail.ru - 73 upvotes, $1000
  67. XSS via Cookie in Mail.ru to Mail.ru - 71 upvotes, $1000
  68. Stored XSS that allow an attacker to read victim mailboxes contacts in mail.ru and my.com application to Mail.ru - 71 upvotes, $0
  69. [API] ICQ user's avatar can be manipulated remotely to Mail.ru - 70 upvotes, $1000
  70. [account.mail.ru] XSS-уязвимость в форме авторизации to Mail.ru - 70 upvotes, $1000
  71. blind XXE in autodiscover parser to Mail.ru - 70 upvotes, $0
  72. reflected xss in e.mail.ru to Mail.ru - 68 upvotes, $1000
  73. Reflected XSS & Open Redirect at mcs main domain to Mail.ru - 68 upvotes, $0
  74. Cross-site Scripting (XSS) - DOM on https://account.mail.ru/user/garage?back_url=https://mail.ru to Mail.ru - 66 upvotes, $1000
  75. Account takeover through password reset in cups.mail.ru to Mail.ru - 66 upvotes, $0
  76. web.icq.com XSS in chat message via contact info to Mail.ru - 65 upvotes, $0
  77. SQL Injection at https://lite.r-keeper.ru/site_api/clients/derision/?lang=ru to Mail.ru - 62 upvotes, $1500
  78. [pandao.ru] Возможность списания несуществующих бонусных баллов to Mail.ru - 58 upvotes, $0
  79. [web.icq.com] Stored XSS in Account Name to Mail.ru - 57 upvotes, $1000
  80. HTML injection at face.city-mobil.ru to Mail.ru - 57 upvotes, $500
  81. Blind SQL in id_locality GET param on [city-mobil.ru/taxiserv] to Mail.ru - 55 upvotes, $3500
  82. [tanks.mail.ru] SSRF + Кража cookie to Mail.ru - 55 upvotes, $750
  83. Blind SSRF in magnum upgrade_params to Mail.ru - 54 upvotes, $2500
  84. XSS account.mail.ru to Mail.ru - 54 upvotes, $1000
  85. Possibility to attach any mobile number to any email to Mail.ru - 54 upvotes, $0
  86. XXE на webdav.mail.ru - PROPFIND/PROPPATCH to Mail.ru - 54 upvotes, $0
  87. Blind SQL Injection on news.mail.ru to Mail.ru - 52 upvotes, $3000
  88. Error in processing gif images to Mail.ru - 52 upvotes, $250
  89. BLIND SSRF ON http://jsgames.mail.ru via avaOp parameter to Mail.ru - 49 upvotes, $0
  90. molotok.m.mail.ru delegated to external entity to Mail.ru - 48 upvotes, $1500
  91. IDOR of users to Mail.ru - 48 upvotes, $500
  92. [my.games, lootdog.io] XSS via MCS Bucket to Mail.ru - 47 upvotes, $1333
  93. Stored XSS on store.my.games to Mail.ru - 47 upvotes, $200
  94. [smena.samokat.ru] Predictable JWT secret to Mail.ru - 47 upvotes, $0
  95. informations disclosure(Email,Numbers,Agreements, admin Sessions and more ...) through a PostgreSQL database belongs to (legium-back.corp.mail.ru) to Mail.ru - 46 upvotes, $0
  96. Cross-site Scripting (XSS) - Stored to Mail.ru - 45 upvotes, $0
  97. Stored XSS when you read eamils. <style> to Mail.ru - 44 upvotes, $1000
  98. SSRF to Mail.ru - 44 upvotes, $0
  99. [city-mobil.ru/taxiserv/] SQLi at /taxiserv/tariffs/dictionary at filter{"id_locality"} param to Mail.ru - 44 upvotes, $0
  100. [https://pandao.ru] - PUT method available to Mail.ru - 43 upvotes, $1000
  101. blog/wp-json/wp/v2/users FILE is enable it will used for bruteforce attack the admin panel at blog/wp-login.php to Mail.ru - 43 upvotes, $0
  102. Access to information about any video and its owner via GraphQL endpoint [dictor.mail.ru] to Mail.ru - 42 upvotes, $2500
  103. [e.mail.ru] XSS в поиске to Mail.ru - 42 upvotes, $750
  104. Leak Sensetive Data at face.city-mobil.ru to Mail.ru - 42 upvotes, $500
  105. DOM XSS on https://biz.mail.ru/domains/goto/mail/ via parameter pollution to Mail.ru - 42 upvotes, $0
  106. Multiple SQL Injections and constrained LFI in esk-static.3igames.mail.ru to Mail.ru - 41 upvotes, $1500
  107. [special.mail.ru] Information Disclosure to Mail.ru - 41 upvotes, $500
  108. Blind XSS Stored On Admin Panel Through Name Parameter In [ https://technoatom.mail.ru/] to Mail.ru - 41 upvotes, $0
  109. Forgot Password Page SMS Brute Force could lead to Account Takeover using Android/IOS app "About the house" via api.prodom.smart.space to Mail.ru - 41 upvotes, $0
  110. Unauthorized Access To Admin panel to Mail.ru - 41 upvotes, $0
  111. LRF on shared.mail.ru due to "markdown" plugin to Mail.ru - 40 upvotes, $6000
  112. [geekbrains.ru] CVE-2019-5418 Ruby on Rails File Content Disclosure to Mail.ru - 40 upvotes, $750
  113. Stored xss on message reply to Mail.ru - 40 upvotes, $500
  114. Source code disclosure to Mail.ru - 40 upvotes, $0
  115. [XSS] data-url в письмах to Mail.ru - 40 upvotes, $0
  116. Открытый Confluence и доступы к чату операторов в Skype to Mail.ru - 39 upvotes, $1500
  117. API method at api.my.games allows to enumerate user emails to Mail.ru - 39 upvotes, $400
  118. unauthorized Access To Elastic DB to Mail.ru - 39 upvotes, $150
  119. CSRF on api.my.games due to improper validation of token allows an attacker to delete other users notifications to Mail.ru - 38 upvotes, $100
  120. CSRF Vulnerability at https://aw.my.com/ to Mail.ru - 38 upvotes, $0
  121. Shell upload in http://widget.support.my.com/ to Mail.ru - 36 upvotes, $1000
  122. IDOR в списке пользователей по домену в relap.io to Mail.ru - 36 upvotes, $0
  123. Blind SSRF на calendar.mail.ru при импорте календаря to Mail.ru - 36 upvotes, $0
  124. Database read through file attachment [content://] to Mail.ru - 35 upvotes, $1000
  125. Full Account Takeover In ****.ru to Mail.ru - 35 upvotes, $500
  126. Grafana SSRF in grafana.instamart.ru to Mail.ru - 35 upvotes, $0
  127. [allods.mail.ru] - WebCache Poisoning Host Header lead to Potential Stored XSS to Mail.ru - 35 upvotes, $0
  128. MCS Graphite SSRF: internal network access to Mail.ru - 34 upvotes, $2500
  129. SQL Injection at https://lite.r-keeper.ru/site_api/localize/translate/rklscommon/ru to Mail.ru - 34 upvotes, $1500
  130. OS command injection on seedr.ru to Mail.ru - 34 upvotes, $1000
  131. api.icq.com / возможность смотреть аватарку и название приватного чата to Mail.ru - 34 upvotes, $0
  132. Disable 2FA via CSRF (Leads to 2FA Bypass) to Mail.ru - 34 upvotes, $0
  133. [api-site.city-mobil.ru] Improper access control leads to information disclosure to Mail.ru - 34 upvotes, $0
  134. Bypass the reverse proxy. Request admin to Mail.ru - 34 upvotes, $0
  135. SSRF at jira.plazius.ru - CVE-2019-8451 to Mail.ru - 34 upvotes, $0
  136. [api.pandao.ru] IDOR позволяет изменять адрес любого пользователя to Mail.ru - 33 upvotes, $1000
  137. Blind SSRF on [relap.io] to Mail.ru - 33 upvotes, $1000
  138. XSS in biz.mail.ru/error to Mail.ru - 33 upvotes, $500
  139. Blind SQL injection [https://honor.hi-tech.mail.ru] to Mail.ru - 33 upvotes, $300
  140. [XSS] postMessage в jsapi/button to Mail.ru - 33 upvotes, $0
  141. IDOR смена email пользователя через Ситимобил Бизнес to Mail.ru - 33 upvotes, $0
  142. Possible access to the car's photo and registration by its ID on [fleet.city-mobil.ru] to Mail.ru - 31 upvotes, $5000
  143. SDC bypass on calendar.mail.ru to Mail.ru - 31 upvotes, $1500
  144. Race condition на market.games.mail.ru to Mail.ru - 31 upvotes, $1000
  145. XSS in message e.mail.ru to Mail.ru - 31 upvotes, $1000
  146. [o2.mail.ru] nginx alias traversal to Mail.ru - 31 upvotes, $150
  147. Code Injection in macOS Desktop Client to Mail.ru - 31 upvotes, $0
  148. [iot-hackathon.geekbrains.ru] Tilda Subdomain Takeover to Mail.ru - 31 upvotes, $0
  149. User session access due to Oauth whitelist host bypass and postMessage to Mail.ru - 31 upvotes, $0
  150. [api-site.city-mobil.ru] Improper access control leads to information disclosure (bypass of #977597 fix) to Mail.ru - 31 upvotes, $0
  151. [ii.worki.ru ] emarsys subdomain takeover to Mail.ru - 31 upvotes, $0
  152. Blind SQL injection on [city-mobil.ru/taxiserv/] in filter{"id_locality"} to Mail.ru - 30 upvotes, $3500
  153. [https://seosan.io] Account owner disclosure to Mail.ru - 30 upvotes, $150
  154. [screenshot.mail.ru] CRLF Injection to Mail.ru - 30 upvotes, $0
  155. Stored XSS on top.mail.ru to Mail.ru - 30 upvotes, $0
  156. allods.mail.ru sql injection to Mail.ru - 29 upvotes, $0
  157. Account Takeover possibility via https://awards.donationalerts.com using login with twitch.tv to Mail.ru - 29 upvotes, $0
  158. o2.mail.ru XSS to Mail.ru - 28 upvotes, $1000
  159. LFI in beta.mail.ru to Mail.ru - 28 upvotes, $150
  160. CSRF + XSS leads to ATO to Mail.ru - 28 upvotes, $0
  161. [play.skillbox.ru] CRLF Injection to Mail.ru - 28 upvotes, $0
  162. [web.icq.com] Stored XSS in "О Контакте" to Mail.ru - 27 upvotes, $500
  163. Reflected XSS at city-mobil.ru to Mail.ru - 27 upvotes, $300
  164. IP address can be leaked on Image preview in ICQ for Android chat to Mail.ru - 27 upvotes, $150
  165. Blindy Replace User's Session with Attacker's Session to Mail.ru - 27 upvotes, $150
  166. [city-mobil.ru/taxiserv/] Disclosure information about drivers to Mail.ru - 27 upvotes, $0
  167. Mail.Ru Email for Android: Injecting custom screen inside adding new account flow to Mail.ru - 26 upvotes, $750
  168. Subdomain takeover on tilda.geekbrains.ru and fl-change.geekbrains.ru to Mail.ru - 26 upvotes, $0
  169. Account takeover on [support2.ucs.ru] to Mail.ru - 26 upvotes, $0
  170. [geekbrains.ru] Node modules path disclosure due to lack of error handling to Mail.ru - 26 upvotes, $0
  171. unclaimed subdomain special.rkeeper.ru to takeover from tilda.cc to Mail.ru - 26 upvotes, $0
  172. cross site scripting bypass session to Mail.ru - 25 upvotes, $1000
  173. uninitilized server memory disclosure via ImageMagick in my.mail.ru and cloud.mail.ru to Mail.ru - 25 upvotes, $750
  174. Shell upload in partner service to Mail.ru - 25 upvotes, $500
  175. Stored XSS in history on [corporate.city-mobil.ru] to Mail.ru - 25 upvotes, $300
  176. Stored xss в пересланном сообщении. to Mail.ru - 25 upvotes, $0
  177. CSRF on draft message creation in tel.mail.ru to Mail.ru - 25 upvotes, $0
  178. Blind SSRF [ Sentry Misconfiguraton ] to Mail.ru - 25 upvotes, $0
  179. Un Authencitated Quartz Pannel with Scheduling tasks to Mail.ru - 25 upvotes, $0
  180. Disk-o Cloud application (Windows) does not validate server certificate on a TLS connection to Mail.ru - 24 upvotes, $2500
  181. Reflected XSS on https://e.mail.ru/compose/ via Body parameter to Mail.ru - 24 upvotes, $1000
  182. XSS via the lang parameter in a POST request on light.mail.ru to Mail.ru - 24 upvotes, $500
  183. Stored XSS in api.icq.net to Mail.ru - 24 upvotes, $150
  184. XSS in touch.mail.ru to Mail.ru - 24 upvotes, $0
  185. [XSS] iframe в payments/phones to Mail.ru - 24 upvotes, $0
  186. [e.mail.ru] Stored xss in Mpop cookie to Mail.ru - 24 upvotes, $0
  187. JSONP hijacking to Mail.ru - 24 upvotes, $0
  188. Stored XSS in Review Section https://games.mail.ru/ to Mail.ru - 24 upvotes, $0
  189. Sensitive information exposure via git commit to Mail.ru - 24 upvotes, $0
  190. [int.ucs.ru] Доступ ко внутренней сети UCS через забытый прокси Fiddler на 217.25.235.214:7459 to Mail.ru - 24 upvotes, $0
  191. При передаче в ID сообщения нулевого байта, происходит вывод какого-то буфера. to Mail.ru - 23 upvotes, $3500
  192. ICQ Android APP remote DoS to Mail.ru - 23 upvotes, $1000
  193. REST API Endpoint leads to Unauthorized user disclosed private [ issue ] details to Mail.ru - 23 upvotes, $1000
  194. Blind XXE on my.mail.ru to Mail.ru - 23 upvotes, $800
  195. Apache server-info enabled to Mail.ru - 23 upvotes, $0
  196. Account takeover in cups.mail.ru using punycode characters to Mail.ru - 23 upvotes, $0
  197. relap.io/admin/api - административный API доступен без аутентификации to Mail.ru - 23 upvotes, $0
  198. [Plazius] SSRF через некорректно сконфигурированный Fiddler 46.148.201.206:10121 to Mail.ru - 23 upvotes, $0
  199. Subdomain takeover on "info-edcrunch.skillfactory.ru" to Mail.ru - 23 upvotes, $0
  200. Account Takeover on https://www.delivery-club.ru через партнерский аккаунт. to Mail.ru - 22 upvotes, $1000
  201. Web cache information leakage at sbermarket.ru to Mail.ru - 22 upvotes, $400
  202. Mirror of https://city-mobil.ru admin interface to Mail.ru - 22 upvotes, $150
  203. IDOR widget.support.my.com to Mail.ru - 22 upvotes, $0
  204. СКР инжект to Mail.ru - 22 upvotes, $0
  205. Django Debug=True Leaks admin email addresss and serval system information to Mail.ru - 22 upvotes, $0
  206. CVE-2020-11110: Grafana Unauthenticated Stored XSS -████.bizml.ru to Mail.ru - 22 upvotes, $0
  207. Возможность изменить поле "E-Mail для доступа в личный кабинет" у другого пользователя [corporate.city-mobil.ru] to Mail.ru - 21 upvotes, $2500
  208. [Web ICQ Client] XSS уязвимость в имени пользователя to Mail.ru - 21 upvotes, $1000
  209. Private file read through file attachment to Mail.ru - 21 upvotes, $1000
  210. Stored XSS in e.mail.ru (payload affect multiple users) to Mail.ru - 21 upvotes, $750
  211. ssrf xspa [https://prt.mail.ru/] 2 to Mail.ru - 21 upvotes, $150
  212. source code leak to Mail.ru - 21 upvotes, $0
  213. ICQ 10.0.12371 icq: Uri Handler '-testability' URL File Insecure Library Loading Code Execution Vulnerability to Mail.ru - 21 upvotes, $0
  214. XSS web.icq.com double linkify to Mail.ru - 21 upvotes, $0
  215. XSS in messages on geekbrains.ru to Mail.ru - 21 upvotes, $0
  216. Xss Reflected On spgw.terrhq.ru [ url ] to Mail.ru - 21 upvotes, $0
  217. Reflected XSS on https://go.mail.ru/search?fr=mn&q=<payload> to Mail.ru - 21 upvotes, $0
  218. Cross-site Scripting (XSS) - Reflected vseapteki.ru to Mail.ru - 21 upvotes, $0
  219. [icq.im] Reflected XSS via chat invite link to Mail.ru - 21 upvotes, $0
  220. subdomain takeover disney.samokat.ru to Mail.ru - 21 upvotes, $0
  221. add class vulnerable Stored XSS to Mail.ru - 21 upvotes, $0
  222. SDC bypass cloud.mail.ru for every /api/v3/* endpoint. to Mail.ru - 20 upvotes, $1500
  223. слепая XSS в админ панели torg.mail.ru через отзыв to Mail.ru - 20 upvotes, $500
  224. Data URI Stored XSS on Donations Page to Mail.ru - 20 upvotes, $200
  225. IDOR in tracking driver logs at city-mobil.ru to Mail.ru - 20 upvotes, $150
  226. Stored XSS In mlbootcamp.ru to Mail.ru - 20 upvotes, $0
  227. Path traversal on bank.mail.ru ( CVE-2013-3827 ) to Mail.ru - 20 upvotes, $0
  228. Redmin API Key Exposed In GIthub to Mail.ru - 20 upvotes, $0
  229. [webvpn.city-srv.ru] Path traversal via CVE-2020-3452 to Mail.ru - 20 upvotes, $0
  230. [int.ucs.ru] Атаки на внутреннюю сеть UCS через СУБД Clickhouse to Mail.ru - 20 upvotes, $0
  231. XSS in e.mail.ru to Mail.ru - 19 upvotes, $500
  232. URL redirection to Mail.ru - 19 upvotes, $0
  233. *..my.com open proxy to Mail.ru - 19 upvotes, $0
  234. XSS at go.mail.ru to Mail.ru - 19 upvotes, $0
  235. Disclosure of personal support email addresses on 'support-fleet.city-mobil.ru' to Mail.ru - 19 upvotes, $0
  236. Stored XSS in calendar via UID parameter to Mail.ru - 19 upvotes, $0
  237. Blind XSS Stored and CORS misconfiguration в отчете "События" сервиса top.mail.ru to Mail.ru - 19 upvotes, $0
  238. [Biz] [Mailer] Кроп любых* изображений расположенных на сервере to Mail.ru - 19 upvotes, $0
  239. [pandao.ru] possibility to attach arbitrary phone number to account registered via social network to Mail.ru - 18 upvotes, $750
  240. ICQ for macOS: lack of com.apple.quarantine meta-attribute on downloaded files leads to GateKeeper/Quarantine bypass for downloaded executables to Mail.ru - 18 upvotes, $150
  241. Account TakeOver at kvartira.city-mobil.ru to Mail.ru - 18 upvotes, $150
  242. XSS on https://account.mail.ru/login via postMessage to Mail.ru - 18 upvotes, $0
  243. [mobs.mail.ru] nginx path traversal via misconfigured alias to Mail.ru - 18 upvotes, $0
  244. ОДМИН ТЭСТ to Mail.ru - 18 upvotes, $0
  245. Account takeover via CORS misconfigutation on https://beta.delivery-club.ru to Mail.ru - 18 upvotes, $0
  246. Gitlab search exposing personal data of employees on gitlab-edu.geekbrains.ru to Mail.ru - 18 upvotes, $0
  247. XSS (reflected, and then, cookie persisted) on api documentation site theme selector (old version of dokuwiki) to Mail.ru - 18 upvotes, $0
  248. Subdomain Takeover to Mail.ru - 18 upvotes, $0
  249. [Web ICQ Client] XSS-inj in polls to Mail.ru - 17 upvotes, $1000
  250. Blind SSRF on sentry.dev-my.com due to Sentry misconfiguration to Mail.ru - 17 upvotes, $500
  251. An implementation flaw in Mail.ru can be exploited for DKIM signature spoofing and email spoofing to Mail.ru - 17 upvotes, $150
  252. Stored XSS на странице "Изменить клиента", вкладка "История" [city-mobil.ru/taxiserv] to Mail.ru - 17 upvotes, $150
  253. SSRF On [ allods.mail.ru ] to Mail.ru - 17 upvotes, $0
  254. Web Cache Poisoning to Mail.ru - 17 upvotes, $0
  255. CSRF in attach phone API endpoint on delivery-club.ru to Mail.ru - 17 upvotes, $0
  256. CVE-2016-6415 on api-staging.plazius.ru [46.148.201.218] to Mail.ru - 17 upvotes, $0
  257. Account Takeover on [ls5-dev.ucs.ru] to Mail.ru - 17 upvotes, $0
  258. Development configurations file with a sensitive data exposure could be leads to take down the social media accounts and the DB to Mail.ru - 17 upvotes, $0
  259. Exposed Golang debugger on tier3.riot.mail.ru:9090, 9080 to Mail.ru - 17 upvotes, $0
  260. XSS в теле письма. to Mail.ru - 16 upvotes, $1000
  261. [la.mail.ru] - SSRF + кража cookie to Mail.ru - 16 upvotes, $750
  262. uchi.ru check_lessons Blind SQL Injection to Mail.ru - 16 upvotes, $750
  263. Blind Stored XSS to Mail.ru - 16 upvotes, $550
  264. Bypass security fixes by downgrading version of application to Mail.ru - 16 upvotes, $250
  265. IDOR of contracts on dictor.mail.ru to Mail.ru - 16 upvotes, $150
  266. Stored XSS на странице "Измененить водителя" [city-mobil.ru/taxiserv] to Mail.ru - 16 upvotes, $150
  267. XSS on https://www.delivery-club.ru to Mail.ru - 16 upvotes, $100
  268. XSS in e.mail.ru to Mail.ru - 16 upvotes, $0
  269. Open Redirect to Mail.ru - 16 upvotes, $0
  270. relap.io IDOR to Mail.ru - 16 upvotes, $0
  271. Пользователь может изменить номер телефона в профиле без СМС подтверждения to Mail.ru - 16 upvotes, $0
  272. Mail.ru for Android - Theft of sensitive data to Mail.ru - 16 upvotes, $0
  273. Stored XSS on {https://calendar.mail.ru/} to Mail.ru - 16 upvotes, $0
  274. [185.30.178.57:8080] - Vulnerable to Jetleak to Mail.ru - 16 upvotes, $0
  275. Deliviry Club Courier app (v. 3.9.25.0); Disclosure phone number of client. to Mail.ru - 16 upvotes, $0
  276. SSRF + RCE через fastCGI в POST /api/nr/video to Mail.ru - 16 upvotes, $0
  277. Account takeover at geekbrains.ru to Mail.ru - 15 upvotes, $1500
  278. Gain access to random information via group chat "about" property to Mail.ru - 15 upvotes, $1000
  279. XSS на странице account.mail.ru/recovery to Mail.ru - 15 upvotes, $500
  280. [pulse.mail.ru] Доступ к статистике чужих площадок to Mail.ru - 15 upvotes, $400
  281. Potential SSRF in sales.mail.ru to Mail.ru - 15 upvotes, $300
  282. Вывод значений переменных Nginx в теле страницы to Mail.ru - 15 upvotes, $300
  283. mailer.i.bizml.ru viber service preprod information disclosure to Mail.ru - 15 upvotes, $300
  284. Stored XSS на странице "Изменить клиента" [city-mobil.ru/taxiserv] to Mail.ru - 15 upvotes, $150
  285. [cfire.mail.ru] CSRF Bypassed - Changing anyone's 'User Info' to Mail.ru - 15 upvotes, $0
  286. Stored XSS to Mail.ru - 15 upvotes, $0
  287. BruteForce Any [My.com] Account Credentials. to Mail.ru - 15 upvotes, $0
  288. Same origin policy bypass on e.mail.ru via Cross-Site Flashing to Mail.ru - 15 upvotes, $0
  289. Cross site scripting vulnerability in JW Player SWF to Mail.ru - 15 upvotes, $0
  290. Cross-site Scripting (XSS) - Stored in ru.mail.mailapp to Mail.ru - 15 upvotes, $0
  291. Race condition при покупке подарков на games.mail.ru to Mail.ru - 15 upvotes, $0
  292. idor leads to leak order information to Mail.ru - 15 upvotes, $0
  293. Reflected XSS on http://info.ucs.ru/settings/check/ to Mail.ru - 15 upvotes, $0
  294. SSRF на https://target.my.com/ to Mail.ru - 14 upvotes, $800
  295. Partner Account Takeover on https://www.delivery-club.ru через пользовательский аккаунт. to Mail.ru - 14 upvotes, $500
  296. XSS в нике при запросе в контакты. to Mail.ru - 14 upvotes, $250
  297. XSS при добавлении в чат пользователя to Mail.ru - 14 upvotes, $250
  298. IDOR on mcs.mail.ru to Mail.ru - 14 upvotes, $150
  299. XSS при Изменения машины на странице "Контроль" [city-mobil.ru/taxiserv] to Mail.ru - 14 upvotes, $150
  300. Reflected XSS on https://www.delivery-club.ru/ to Mail.ru - 14 upvotes, $100
  301. Подмена фотографий автомобиля [city-mobil.ru/taxiserv/] to Mail.ru - 14 upvotes, $100
  302. [element.mail.ru] /.svn/entries to Mail.ru - 14 upvotes, $0
  303. Open Redirect on [My.com] to Mail.ru - 14 upvotes, $0
  304. Make user buy items via clickjacking possibility to Mail.ru - 14 upvotes, $0
  305. Bash History file log to Mail.ru - 14 upvotes, $0
  306. Reflected XSS on am.ru and subdomains to Mail.ru - 14 upvotes, $0
  307. [geekbrains.ru] Reflected XSS via Angular Template Injection to Mail.ru - 14 upvotes, $0
  308. Account Takeover via Forgot Password Page at https://3k.mail.ru/send_password.php? to Mail.ru - 14 upvotes, $0
  309. Subdomain Takeover to Mail.ru - 14 upvotes, $0
  310. Reflected XSS on https://deti.mail.ru to Mail.ru - 14 upvotes, $0
  311. Local SQL Injection in Content Provider (ru.mail.data.contact.ContactsProvider) of Mail.ru for Android, version 12.2.0.29734 to Mail.ru - 14 upvotes, $0
  312. [https://geekbrains.ru/profile] - authenticity_token not tied to user session leads to CSRF attacks to Mail.ru - 14 upvotes, $0
  313. XSS в теле письма, в новой версии почты. to Mail.ru - 13 upvotes, $1000
  314. Attacker can send requests from mail.ru server to Mail.ru - 13 upvotes, $800
  315. [supportlocal.delivery-club.ru] Subdomain Takeover to Mail.ru - 13 upvotes, $500
  316. CSRF на calendar.mail.ru to Mail.ru - 13 upvotes, $250
  317. XSS at af.attachmail.ru to Mail.ru - 13 upvotes, $150
  318. Modifying application settings via clickjacking on o2.mail.ru to Mail.ru - 13 upvotes, $150
  319. Path Traversal When Sharing with Cloud Mail.Ru App via a file with Crated Name to Mail.ru - 13 upvotes, $150
  320. [health.mail.ru] Раскрытие SSI сценариев to Mail.ru - 13 upvotes, $150
  321. MySQL username and password leaked on [2017.russianaicup.ru] to Mail.ru - 13 upvotes, $150
  322. Stored XSS в профиле водителя [city-mobil.ru/taxiserv] to Mail.ru - 13 upvotes, $150
  323. Stored XSS на странице "Почты" [city-mobil.ru/taxiserv] to Mail.ru - 13 upvotes, $150
  324. XSS на странице "Создать водителя" [city-mobil.ru/taxiserv] to Mail.ru - 13 upvotes, $150
  325. lootdog.io XSS to Mail.ru - 13 upvotes, $100
  326. CSRF on lootdog.io to Mail.ru - 13 upvotes, $100
  327. 3rd party shop admin panel blind XSS to Mail.ru - 13 upvotes, $0
  328. [3k.mail.ru] - Content spoofing to Mail.ru - 13 upvotes, $0
  329. CSRF на лайк к отзыву (Pandao) to Mail.ru - 13 upvotes, $0
  330. Unrestricted File Upload To Xss Stored [ https://ideas.browser.mail.ru/ ] to Mail.ru - 13 upvotes, $0
  331. RCE Jira(CVE-2019–11581) [my-com.atlassian.net] to Mail.ru - 13 upvotes, $0
  332. HTTP-Response-Splitting leads to information disclosure (email, firstname, lastname) at https://tz.mail.ru to Mail.ru - 13 upvotes, $0
  333. HTML/iframe/XSS injection on https://www.ucs.ru/online/shelter/settings/check/ to Mail.ru - 13 upvotes, $0
  334. NPM_API_KEY Leak to Mail.ru - 13 upvotes, $0
  335. Improper Restriction of Excessive Authentication Attempts at http://terrafoot.ru/login.php (Rate Limit bypass via IP Rotation) to Mail.ru - 13 upvotes, $0
  336. IDOR to edit test/poll/quiz on relap.io to Mail.ru - 13 upvotes, $0
  337. Bypassing SOP with XSS on account.my.games leading to steal CSRF token and user information to Mail.ru - 13 upvotes, $0
  338. [http://kiwi.youdrive.today/] Information disclosure via Kiwi TCMS vulnerability to Mail.ru - 13 upvotes, $0
  339. Partner's manager can aсccess statistics of all drivers [city-mobil.ru/taxiserv] to Mail.ru - 12 upvotes, $1500
  340. XSS в письме, в поле отправителя. to Mail.ru - 12 upvotes, $1000
  341. blind XXE when uploading avatar in mymail phone app to Mail.ru - 12 upvotes, $1000
  342. Source code and internal credentials disclosure to Mail.ru - 12 upvotes, $1000
  343. reflected XSS on healt.mail.ru to Mail.ru - 12 upvotes, $500
  344. Возможность залить шелл на https://widget.operator.mail.ru to Mail.ru - 12 upvotes, $500
  345. Launch Any Activity in MyMail App to Mail.ru - 12 upvotes, $500
  346. OOB XXE to Mail.ru - 12 upvotes, $500
  347. Android MailRu Email: Thirdparty can access private data files with small user interaction to Mail.ru - 12 upvotes, $300
  348. XSS в названии лайвчата to Mail.ru - 12 upvotes, $250
  349. Раскрытие серии/номера паспорта и снилс пользователя lootdog.io to Mail.ru - 12 upvotes, $250
  350. stored xss путём загрузки вредоносного файла + обход загрузки файлов. to Mail.ru - 12 upvotes, $200
  351. Eval-based XSS in Game JS API (mailru.core.js) via cross-origin postMessage() to Mail.ru - 12 upvotes, $200
  352. Activities are not Protected and able to crash app using other app (Can Malware or third parry app). to Mail.ru - 12 upvotes, $150
  353. filin.mail.ru user's e-mail address disclosure to Mail.ru - 12 upvotes, $150
  354. [ICQ] nwwwstg-d01.ops.icq.com check mk agent exposed to public to Mail.ru - 12 upvotes, $150
  355. Code source discloure & ability to get database information "SQL injection" in [townwars.mail.ru] to Mail.ru - 12 upvotes, $0
  356. Дубликат: https://hackerone.com/reports/219171 (доступ к аккаунту, через сброс пароля) to Mail.ru - 12 upvotes, $0
  357. api.icq.com / возможность присоединиться к любому чату (даже закрытому). to Mail.ru - 12 upvotes, $0
  358. CRLF injection mcs.mail.ru (leads to XSS) to Mail.ru - 12 upvotes, $0
  359. [rm.mail.ru] Request-Path XSS to Mail.ru - 12 upvotes, $0
  360. XSS to Mail.ru - 12 upvotes, $0
  361. Найден build.sh в webagent.mail.ru to Mail.ru - 12 upvotes, $0
  362. Full Path Disclosure to Mail.ru - 12 upvotes, $0
  363. Publicly Accessible Harshi Corp Consul to Mail.ru - 12 upvotes, $0
  364. Race condition на покупке призов за баллы to Mail.ru - 12 upvotes, $0
  365. Stored xss on https://go.mail.ru/ to Mail.ru - 12 upvotes, $0
  366. XSS in [community.my.games] to Mail.ru - 12 upvotes, $0
  367. [my.games] Stored XSS via untrusted bucket to Mail.ru - 12 upvotes, $0
  368. Reflected XSS to Mail.ru - 12 upvotes, $0
  369. warofdragons.my.games: configuration files with database account are accessible to Mail.ru - 12 upvotes, $0
  370. reflected xss on learn.city-mobil.ru via redirect_url parameter to Mail.ru - 12 upvotes, $0
  371. [myMail Android] Access to protected app components via RegistrationPhoneActivity to Mail.ru - 12 upvotes, $0
  372. stand.pw.mail.ru xss to Mail.ru - 12 upvotes, $0
  373. bit.games - sql-inj to Mail.ru - 11 upvotes, $1500
  374. XSS в теле письма, в блочных стилях. to Mail.ru - 11 upvotes, $1000
  375. Stored xss in calendar via call link to Mail.ru - 11 upvotes, $1000
  376. Xss в https://e.mail.ru/ to Mail.ru - 11 upvotes, $500
  377. [account.mail.ru] XSS на странице восстановления пароля to Mail.ru - 11 upvotes, $500
  378. Stored Blind XSS to Mail.ru - 11 upvotes, $500
  379. [dobro.city-mobil.ru] Недостаточная аутентификация (доступ к панели администратора) to Mail.ru - 11 upvotes, $500
  380. [et.mail.ru] ssrf 2 to Mail.ru - 11 upvotes, $150
  381. Disclosure of the account email by phone number on [corporate.city-mobil.ru] to Mail.ru - 11 upvotes, $150
  382. XSS on https://www.delivery-club.ru/sd/test_330933/info/ to Mail.ru - 11 upvotes, $100
  383. CSRF на покупку товара https://lootdog.io/ to Mail.ru - 11 upvotes, $100
  384. Stored self-XSS pubg.mail.ru в нескольких местах to Mail.ru - 11 upvotes, $0
  385. XSS через подгрузку ссылки. to Mail.ru - 11 upvotes, $0
  386. [web.icq.com] Stored XSS in link when sending message to Mail.ru - 11 upvotes, $0
  387. Блокированный ящик ( Обход ) to Mail.ru - 11 upvotes, $0
  388. Disclosure of user email address and Deanonymization [mail.ru] + Blind | Stored XSS pets.mail.ru to Mail.ru - 11 upvotes, $0
  389. [moba.my.com] phpinfo, logs to Mail.ru - 11 upvotes, $0
  390. Open Redirect In passport.maps.me/logout/?next=//fb.com/ to Mail.ru - 11 upvotes, $0
  391. Unsafe downloaded file execution to Mail.ru - 11 upvotes, $0
  392. Stored self XSS at auto.mail.ru using add_review functionality to Mail.ru - 11 upvotes, $0
  393. Sidekiq Dashboard Publicly accessible at http://shopper.staging.instamart.ru/sidekiq/ to Mail.ru - 11 upvotes, $0
  394. xss while uploading a file to Mail.ru - 11 upvotes, $0
  395. Insufficient limitation of web page title leads to DoS against ICQ for Android to Mail.ru - 11 upvotes, $0
  396. HTML Injection at "city-mobil.ru" to Mail.ru - 11 upvotes, $0
  397. Reflected XSS https://tracker.my.com to Mail.ru - 11 upvotes, $0
  398. mail.ru/touch xss(r) debug parameter to Mail.ru - 11 upvotes, $0
  399. Bitbucket public repo leaking credentials from the 1C Enterprise system used by Samokat to Mail.ru - 11 upvotes, $0
  400. Угон домена photo-test.gb.ru (возможно) to Mail.ru - 11 upvotes, $0
  401. XSS в письме, в теле письма. to Mail.ru - 10 upvotes, $2000
  402. Database read through provider misconfiguration to Mail.ru - 10 upvotes, $1000
  403. [com.icq.mobile.client] Любое стороннее приложение может угнать сессию, а также другие файлы приложения to Mail.ru - 10 upvotes, $1000
  404. Xss в https://e.mail.ru/ to Mail.ru - 10 upvotes, $500
  405. Reflected XSS in https://e.mail.ru/ to Mail.ru - 10 upvotes, $500
  406. SSRF на api.icq.net to Mail.ru - 10 upvotes, $500
  407. Users information leak at sbermarket.ru to Mail.ru - 10 upvotes, $400
  408. Stored XSS in address on [corporate.city-mobil.ru] to Mail.ru - 10 upvotes, $300
  409. SSRF/XSPA [parapa.mail.ru] 2 to Mail.ru - 10 upvotes, $150
  410. SECRET_KEY Of Django Leaked In maps.me to Mail.ru - 10 upvotes, $150
  411. [com.icq.mobile.client] Любое стороннее приложение может отправить произвольное сообщение от имени пользователя to Mail.ru - 10 upvotes, $150
  412. IDOR in tender.mail.ru leading to Information Disclosure to Mail.ru - 10 upvotes, $0
  413. reflected xss on cycloferon.health.mail.ru to Mail.ru - 10 upvotes, $0
  414. Отраженная XSS на cloud.mail.ru в URL в функционале создания и редактировании презентации. to Mail.ru - 10 upvotes, $0
  415. XSS bypass Script execute,Read any file,execute any javascript code--UXSS to Mail.ru - 10 upvotes, $0
  416. Хранимая XSS ( API ) to Mail.ru - 10 upvotes, $0
  417. Seven DOM-Based XSS Vulnerabilities | Execution in Login Sequence to Mail.ru - 10 upvotes, $0
  418. Server side request forgery to Mail.ru - 10 upvotes, $0
  419. CSRF на отправку вопроса на [games.mail.ru] to Mail.ru - 10 upvotes, $0
  420. [authdl.mail.ru] Spoofing IP address to Mail.ru - 10 upvotes, $0
  421. Content spoofing в http://my.mail.ru/cgi-bin/app/paymentm to Mail.ru - 10 upvotes, $0
  422. Insecure Storage and Overly Permissive Google Maps API Key in Android App to Mail.ru - 10 upvotes, $0
  423. unauthorized access to add admin endpoint to Mail.ru - 10 upvotes, $0
  424. Reflected XSS with WAF Bypass https://pw.mail.ru to Mail.ru - 10 upvotes, $0
  425. vk.com profile page takeover on https://cabinet.am.ru/ to Mail.ru - 10 upvotes, $0
  426. [panel.city-mobil.ru/admin/] Blind XSS via partner name (similar to #746505) to Mail.ru - 10 upvotes, $0
  427. Exposed Git Repo at https://mini-app.delivery-club.ru to Mail.ru - 10 upvotes, $0
  428. [city-mobil.ru/taxiserv/] SQLi at /taxiserv/requests path at driver_company param to Mail.ru - 10 upvotes, $0
  429. Improper Restriction of Excessive Authentication Attempts at https://top.mail.ru/edit? for site counter (Rate Limit bypass via IP Rotation) to Mail.ru - 10 upvotes, $0
  430. [samokat.ru] PHP modules path disclosure due to lack of error handling to Mail.ru - 10 upvotes, $0
  431. XSS в отправителе, БЕТА-версия почты to Mail.ru - 9 upvotes, $500
  432. Stealing Arbitrary Private Files of MyMail App to Mail.ru - 9 upvotes, $500
  433. Full Account Takeover Student Account In https://********.ru/signin/main/student/email to Mail.ru - 9 upvotes, $500
  434. Логи/sql запросы на http://mx36.ucs.ru/ и reflected XSS. to Mail.ru - 9 upvotes, $400
  435. Time-based sql-injection на https://puzzle.mail.ru to Mail.ru - 9 upvotes, $300
  436. Reflected XSS in city-mobil.ru/ to Mail.ru - 9 upvotes, $300
  437. XSS с помощью специально сформированного файла. to Mail.ru - 9 upvotes, $250
  438. easyXDM allows cross domain postmessaging with any origin, leaking sensitive info to Mail.ru - 9 upvotes, $250
  439. XSS на e.mail.ru в мобильном приложении! to Mail.ru - 9 upvotes, $250
  440. XSS https://health.mail.ru/my/ через внешнее имя аккаунта to Mail.ru - 9 upvotes, $150
  441. Чтение системных данных приложения: данные для авторизации, логи, БД, личная переписка to Mail.ru - 9 upvotes, $150
  442. Log files Leaked In mcsblog.ru to Mail.ru - 9 upvotes, $150
  443. Открытая админка 1C эмулятора to Mail.ru - 9 upvotes, $150
  444. CSRF на добавление товара на продажу to Mail.ru - 9 upvotes, $100
  445. Cross Site Request Forgery (CSRF) to Mail.ru - 9 upvotes, $0
  446. [tanks.mail.ru] Internet Explorer XSS via Request-URI to Mail.ru - 9 upvotes, $0
  447. [realty.mail.ru] XSS, SSI Injection to Mail.ru - 9 upvotes, $0
  448. [pokerist.mail.ru] XSS Request-URI to Mail.ru - 9 upvotes, $0
  449. CSRF Send a message at street-combats.mail.ru to Mail.ru - 9 upvotes, $0
  450. XSS account.mail.ru in state JSON script to Mail.ru - 9 upvotes, $0
  451. ДОБАВЛЕНИЕ СВОИХ ДАТ В КАЛЕНДАРЬ ПОЛЬЗОВАТЕЛЮ ! to Mail.ru - 9 upvotes, $0
  452. Blind XSS pets.mail.ru/admin/ to Mail.ru - 9 upvotes, $0
  453. CSRF уязвимость позволяет взять беспроцентный кредит пользователю cfire.mail.ru to Mail.ru - 9 upvotes, $0
  454. Delete images of users with clickjacking in https://pw.mail.ru to Mail.ru - 9 upvotes, $0
  455. [https://city-mobil.ru/taxiserv] IDOR leads to information disclosure to Mail.ru - 9 upvotes, $0
  456. xss in ub.icq.net to Mail.ru - 9 upvotes, $0
  457. Broken twitter link hijacking at https://games.mail.ru/pc/search/ to Mail.ru - 9 upvotes, $0
  458. Improper Restriction of Excessive Authentication Attempts at https://ucs.ru/login to Mail.ru - 9 upvotes, $0
  459. IDOR zakazaka (состояние заказа и перезаказ) to Mail.ru - 9 upvotes, $0
  460. Improper Restriction of Excessive Authentication Attempts via https://certification.mail.ru/auth-form/?form=auth_certy (Rate limit Bypass) to Mail.ru - 9 upvotes, $0
  461. [xss] setTheme в ajax_attach_action to Mail.ru - 9 upvotes, $0
  462. XSS on https://o2.mail.ru/jsapi/button via PostMessage to Mail.ru - 9 upvotes, $0
  463. IDOR to delete test/poll/quiz on relap.io to Mail.ru - 9 upvotes, $0
  464. Brute Force due to Weak security credentials lead access to LICENSE SYSTEM Web Server on [l.ucs.ru] to Mail.ru - 9 upvotes, $0
  465. Possibility to view subdepartments for arbitrary domain to Mail.ru - 8 upvotes, $500
  466. A manager of a determinate group of users still might have access to any user account from any group that he doesn't administrate anymore. to Mail.ru - 8 upvotes, $500
  467. [account.mail.ru] XSS на странице удаления аккаунта через backUrl to Mail.ru - 8 upvotes, $500
  468. Stored Xss to Mail.ru - 8 upvotes, $200
  469. [upload-X.my.mail.ru] /uploadphoto Insecure Direct Object References to Mail.ru - 8 upvotes, $160
  470. Possible to Upload Local Arbitrary Private File to the Cloud against User's Will to Mail.ru - 8 upvotes, $150
  471. HTML injection in an email [delivery.city-mobil.ru] to Mail.ru - 8 upvotes, $150
  472. CSRF Delete chat invitation link. to Mail.ru - 8 upvotes, $100
  473. Cross site scripting to Mail.ru - 8 upvotes, $0
  474. [odnoklassniki.ru] XSS via Host to Mail.ru - 8 upvotes, $0
  475. XSS when replying / forwarding to a malicious email on iOS to Mail.ru - 8 upvotes, $0
  476. XSS on account.mail.ru/login to Mail.ru - 8 upvotes, $0
  477. Stored self-xss and its escalation to a victim account in e.mail.ru to Mail.ru - 8 upvotes, $0
  478. XSS in delivery club to Mail.ru - 8 upvotes, $0
  479. Double authentication bypass to Mail.ru - 8 upvotes, $0
  480. Full account takeover am.ru to Mail.ru - 8 upvotes, $0
  481. [lk-cdn.3igames.mail.ru] apc.php to Mail.ru - 8 upvotes, $0
  482. Reflected cross site scripting at https://auto.mail.ru/reviews/add_review/ via problems_text parameter. to Mail.ru - 8 upvotes, $0
  483. XSS при загрузке изображения на [games.mail.ru] to Mail.ru - 8 upvotes, $0
  484. Information Disclosure - Получаем доступ к работам и к приватным презентациям к курсам to Mail.ru - 8 upvotes, $0
  485. XSS via HTTP request version in account.my.games to Mail.ru - 8 upvotes, $0
  486. CSRF on https://market.my.games to Mail.ru - 8 upvotes, $0
  487. Http Response Splitting on thumb.cloud.mail.ru to Mail.ru - 8 upvotes, $0
  488. Subdomain Takeover at blog.instamart.ru to Mail.ru - 8 upvotes, $0
  489. [api.my.games/social/chat/multi/add] Privilege escalation on adding new members to group chat to Mail.ru - 8 upvotes, $0
  490. Blind SSRF on http://info.ucs.ru/settings/check/ to Mail.ru - 8 upvotes, $0
  491. Получение гарантированного дохода и бонусов без фактического исполнения заказов, при этом используя аккаунты не существующих людей. to Mail.ru - 8 upvotes, $0
  492. [xss] passrestore на m/touch/tel to Mail.ru - 8 upvotes, $0
  493. CVE-2020-3187 на ip адресе 91.231.115.30 to Mail.ru - 8 upvotes, $0
  494. prometheus server monitoring System publicly accessible to Mail.ru - 8 upvotes, $0
  495. internal path disclosure via error message to Mail.ru - 8 upvotes, $0
  496. Чтение файлов на сервере и раскрытие директорий mediator.media to Mail.ru - 7 upvotes, $800
  497. touch.mail.ru/messages - Stored XSS to Mail.ru - 7 upvotes, $750
  498. VERY DANGEROUS XSS STORED inside emails to Mail.ru - 7 upvotes, $600
  499. Открытая админка Tarantool to Mail.ru - 7 upvotes, $500
  500. [connect.mail.ru] Memory Disclosure / IE XSS to Mail.ru - 7 upvotes, $250
  501. Stored XSS and html injection in biz.mail.ru to Mail.ru - 7 upvotes, $250
  502. Download attachments with traversal path into any sdcard directory (incomplete fix 106097) to Mail.ru - 7 upvotes, $200
  503. [cfire.mail.ru] Time Based SQL Injection 2 to Mail.ru - 7 upvotes, $200
  504. DOM based XSS via postMessage at store.my.games to Mail.ru - 7 upvotes, $200
  505. [my.mail.ru] CRLF Injection to Mail.ru - 7 upvotes, $160
  506. Возможность создать канал в группе, в которой пользователь не является админом [my.games] to Mail.ru - 7 upvotes, $150
  507. Пользователь может просматривать, удалять и изменять данные любой компании перебирая domain_id [biz.mail.ru] to Mail.ru - 7 upvotes, $150
  508. Брутфорс sms кода подтверждения для смены номера телефона в аккаунте LootDog. to Mail.ru - 7 upvotes, $150
  509. [files.ucs.ru] ProFTPd mod_copy Arbitrary Read/Write to Mail.ru - 7 upvotes, $150
  510. [titans.3clans.ru] phpBB 3.0.8 - Захват аккаунта администратора + удалённое выполнение кода. to Mail.ru - 7 upvotes, $150
  511. [rabota.mail.ru] Open Redirect to Mail.ru - 7 upvotes, $0
  512. [touch.lady.mail.ru] CRLF Injection to Mail.ru - 7 upvotes, $0
  513. [cooking.lady.mail.ru] Open Redirect to Mail.ru - 7 upvotes, $0
  514. [otus.p.mail.ru] Full Path Disclosure to Mail.ru - 7 upvotes, $0
  515. xss на нескольких форумах игр от mail.ru (Cross-Site Scripting) to Mail.ru - 7 upvotes, $0
  516. Stored XSS using SVG on subdomain infra.mail.ru to Mail.ru - 7 upvotes, $0
  517. The auth token does not expire on logging out and even after logging out all sessions to Mail.ru - 7 upvotes, $0
  518. XSS on e.mail.ru via postMessage to Mail.ru - 7 upvotes, $0
  519. XSS at https://icq.com/people to Mail.ru - 7 upvotes, $0
  520. XSS e.mail.ru fixSpecialSymbols to Mail.ru - 7 upvotes, $0
  521. XSS via Cookie in e.mail.ru to Mail.ru - 7 upvotes, $0
  522. Хранимая XSS в пожертованиях на dobro.mail.ru to Mail.ru - 7 upvotes, $0
  523. [info.tmgame.mail.ru] Apache Server Status to Mail.ru - 7 upvotes, $0
  524. Reflected XSS in delivery-club.ru to Mail.ru - 7 upvotes, $0
  525. CSRF на загрузку изображения Pandao to Mail.ru - 7 upvotes, $0
  526. CSRF on /subscription_manage.php endpoint at allods.mail.ru to Mail.ru - 7 upvotes, $0
  527. Reference to external uncontrolled resource in terrhq.ru to Mail.ru - 7 upvotes, $0
  528. XXE крит to Mail.ru - 7 upvotes, $0
  529. PHP-FPM Status Page to Mail.ru - 7 upvotes, $0
  530. astrumnival.com subdomain to Mail.ru - 7 upvotes, $0
  531. [lootdog.io] User phone number disclosure to Mail.ru - 7 upvotes, $0
  532. Загрузка png бомбы, которая начинает DDOS атаку на бота со Стикерами. to Mail.ru - 7 upvotes, $0
  533. [sso.33slona.ru] Application Messages Error stacktrace PHP. to Mail.ru - 7 upvotes, $0
  534. Brute-force any email account through allods.mail.ru to Mail.ru - 7 upvotes, $0
  535. Information Disclosure [ https://curious.ru/api/submissions ] to Mail.ru - 7 upvotes, $0
  536. [https://fleet.city-mobil.ru] Stored XSS into driver mailing to Mail.ru - 7 upvotes, $0
  537. REFLECTED XSS On http://jsgames.mail.ru/bad_browser.php via back_url paramter to Mail.ru - 7 upvotes, $0
  538. Improper Restriction of Excessive Authentication Attempts at o2-ac.my.com/token to Mail.ru - 7 upvotes, $0
  539. [https://youdrive.today/] Nginx directory traversal to Mail.ru - 7 upvotes, $0
  540. the same as #948259 - XSS at jsgames.mail.ru to Mail.ru - 7 upvotes, $0
  541. SSRF in www.ucs.ru to Mail.ru - 7 upvotes, $0
  542. capsula.mail.ru - reflected xss to Mail.ru - 7 upvotes, $0
  543. [xss] перенаправление со старых url в почте to Mail.ru - 7 upvotes, $0
  544. [xss] подмена content-type в загрузке лого к почте to Mail.ru - 7 upvotes, $0
  545. Information Disclosure of Garbage Collection Cycle 'Again' to Mail.ru - 7 upvotes, $0
  546. Improper Restriction of Excessive Authentication Attempts at https://mirror.w1.dwar.ru/login.php to Mail.ru - 7 upvotes, $0
  547. XSS on ub.icq.net to Mail.ru - 7 upvotes, $0
  548. bgplay.mail.ru to Mail.ru - 6 upvotes, $200
  549. By pass admin panel [seminars.mail.ru] to Mail.ru - 6 upvotes, $150
  550. XSS в портальной навигации to Mail.ru - 6 upvotes, $150
  551. Unupdated ImageMagic leads to uninitialized server memory disclosure to Mail.ru - 6 upvotes, $150
  552. [c-api.city-mobil.ru] IDOR chat messages between driver and customer to Mail.ru - 6 upvotes, $150
  553. Ability to edit the address of any company by its id on [corporate.city-mobil.ru] to Mail.ru - 6 upvotes, $150
  554. Access admin interface via bad credentials to Mail.ru - 6 upvotes, $150
  555. Наблюдатель может оставновить базу данных [mcs.mail.ru] to Mail.ru - 6 upvotes, $150
  556. Раскрытие IP, почты и другой полезной информации lootdog.io to Mail.ru - 6 upvotes, $100
  557. [ml.money.mail.ru] Open Redirect to Mail.ru - 6 upvotes, $0
  558. [qpt.mail.ru] CRLF Injection / Open Redirect to Mail.ru - 6 upvotes, $0
  559. [w1.dwar.ru] Core Dump to Mail.ru - 6 upvotes, $0
  560. [gitmm.corp.mail.ru] Auth Bypass, Information Disclosure to Mail.ru - 6 upvotes, $0
  561. Open Redirection at https://it.mail.ru/ to Mail.ru - 6 upvotes, $0
  562. Reflected XSS on frag.mail.ru to Mail.ru - 6 upvotes, $0
  563. CRLF инъекция на https://tz.mail.ru to Mail.ru - 6 upvotes, $0
  564. api.icq.com / возможность написать кому угодно (даже icqsystem) to Mail.ru - 6 upvotes, $0
  565. XSS уязвимость to Mail.ru - 6 upvotes, $0
  566. XSS touch.mail.ru compose Body to Mail.ru - 6 upvotes, $0
  567. XSS ( Работа с письмами ) to Mail.ru - 6 upvotes, $0
  568. [hs.mail.ru] XSS play_now.php to Mail.ru - 6 upvotes, $0
  569. [hs.mail.ru] CRLF Injection / XSS to Mail.ru - 6 upvotes, $0
  570. [gamesventures.mail.ru] Publicly accessible GIT directory to Mail.ru - 6 upvotes, $0
  571. [new.wf.mail.ru] XSS Request-URI to Mail.ru - 6 upvotes, $0
  572. [evo2.my.com] Internet Explorer XSS to Mail.ru - 6 upvotes, $0
  573. CSRF при вводе промокода на Pandao to Mail.ru - 6 upvotes, $0
  574. benchmark metrics available at 5.61.239.154 to Mail.ru - 6 upvotes, $0
  575. PHP-FPM Status Page to Mail.ru - 6 upvotes, $0
  576. Доступ к аккаунту после смены пароля. to Mail.ru - 6 upvotes, $0
  577. XSS на сайте https://warofdragons.my.games/. to Mail.ru - 6 upvotes, $0
  578. Mail.Ru Top - Website Counter Bruteforcing to Mail.ru - 6 upvotes, $0
  579. [city-mobil.ru/taxiserv/] IDOR leads to driver account takeover to Mail.ru - 6 upvotes, $0
  580. Stored XSS on go.mail.ru to Mail.ru - 6 upvotes, $0
  581. Open Redirect at "city-mobil.ru" to Mail.ru - 6 upvotes, $0
  582. [self?] XSS в адресе пользователя [sbermarket.ru] to Mail.ru - 6 upvotes, $0
  583. Subdomain Takeover at analyticstest.geekbrains.ru to Mail.ru - 6 upvotes, $0
  584. [combo.mail.ru] SMS code bruteforce to Mail.ru - 6 upvotes, $0
  585. Логи на http://login.aa.mail.ru/logs/ to Mail.ru - 6 upvotes, $0
  586. [delivery.city-mobil.ru] Stored XSS into support request comment to Mail.ru - 6 upvotes, $0
  587. [aw.mail.ru] XSS on /quiztank page to Mail.ru - 6 upvotes, $0
  588. [MY.GAMES] XSS в мессенджере to Mail.ru - 6 upvotes, $0
  589. Subdomain takeover http://promo.instamart.ru/ to Mail.ru - 6 upvotes, $0
  590. Clickjacking Vulnerability via https://profile.my.games/gamecenter/profile/ can lead to sensitive cross site actions (Bypass X-Frame-Options) to Mail.ru - 6 upvotes, $0
  591. Open Redirect and CRLF Injection Leads to XSS on [app.doma.uchi.ru] to Mail.ru - 6 upvotes, $0
  592. Read-only user can edit user segments. to Mail.ru - 6 upvotes, $0
  593. RCE в .api/nr/report/{id}/download to Mail.ru - 6 upvotes, $0
  594. Private files exposed to other apps to Mail.ru - 5 upvotes, $1000
  595. Insecure storage of private files to Mail.ru - 5 upvotes, $1000
  596. [Mail.Ru for Android] Replacing "Add filter" screen by malicious screen to Mail.ru - 5 upvotes, $1000
  597. Same Origin Policy bypass to Mail.ru - 5 upvotes, $600
  598. Admin panel access restrictions bypass [poll.mail.ru/admin/] to Mail.ru - 5 upvotes, $500
  599. OOB XXE to Mail.ru - 5 upvotes, $500
  600. Public access to Sidekiq dashboard at shopper.sbermarket.ru to Mail.ru - 5 upvotes, $500
  601. В самокате можно просматривать и изменять данные любого заказа без авторизации to Mail.ru - 5 upvotes, $400
  602. HTML Injection на e.mail.ru to Mail.ru - 5 upvotes, $250
  603. [s.mail.ru] CRLF Injection to Mail.ru - 5 upvotes, $250
  604. Mail.ru for Android Content Provider Vulnerability to Mail.ru - 5 upvotes, $250
  605. tmgame.mail.ru - Blind sql injection to Mail.ru - 5 upvotes, $250
  606. [townwars.mail.ru] Time-Based SQL Injection to Mail.ru - 5 upvotes, $150
  607. invalid handling of redirect_uri at o2.mail.ru/jsapi/button to Mail.ru - 5 upvotes, $150
  608. [parapa.mail.ru] SQL Injection reapet to Mail.ru - 5 upvotes, $150
  609. В самокат имеется возможность просмотра суммы заказа и номера заказа по ID [smart.space] to Mail.ru - 5 upvotes, $150
  610. todo.mail.ru open .git to Mail.ru - 5 upvotes, $150
  611. XSS на странице "Платежи водителей" [city-mobil.ru/taxiserv] to Mail.ru - 5 upvotes, $150
  612. restaurant.delivery-club.ru - возможность получить информацию об чужих акциях. to Mail.ru - 5 upvotes, $150
  613. Reflected XSS connect.mail.ru (IE6-IE8) to Mail.ru - 5 upvotes, $0
  614. Full Path Disclosure to Mail.ru - 5 upvotes, $0
  615. [corp.mail.ru] CRLF Injection / Insecure nginx configuration to Mail.ru - 5 upvotes, $0
  616. [mrgs.mail.ru] Internet Explorer XSS via Request-URI to Mail.ru - 5 upvotes, $0
  617. Disclosure of information on static.dl.mail.ru to Mail.ru - 5 upvotes, $0
  618. [allods.my.com] Full Path Disclosure to Mail.ru - 5 upvotes, $0
  619. [otus.p.mail.ru] CRLF Injection to Mail.ru - 5 upvotes, $0
  620. Open Redirect to Mail.ru - 5 upvotes, $0
  621. [allods.mail.ru] Reflected XSS to Mail.ru - 5 upvotes, $0
  622. Open Redirect to Mail.ru - 5 upvotes, $0
  623. Reflected XSS на https://aw.mail.ru/news/ to Mail.ru - 5 upvotes, $0
  624. Monitor to Mail.ru - 5 upvotes, $0
  625. CSRF. Удаление адресной книги, добавление контактов to Mail.ru - 5 upvotes, $0
  626. Uninitilized server memory disclosure via ImageMagick to Mail.ru - 5 upvotes, $0
  627. Открытое перенапровление на OpenID to Mail.ru - 5 upvotes, $0
  628. [maps.me] Reflected XSS to Mail.ru - 5 upvotes, $0
  629. api.icq.com / отсутсвие лимита на отправку сообщений удаляя параметр защиты "&r" to Mail.ru - 5 upvotes, $0
  630. api.icq.com / возможность отредактировать текст любого пользователя или группы переслав его. to Mail.ru - 5 upvotes, $0
  631. Открытая информация phpinfo() на сайте https://agent.mail.ru to Mail.ru - 5 upvotes, $0
  632. Local paths disclosure through error message to Mail.ru - 5 upvotes, $0
  633. CSRF на biz.mail.ru to Mail.ru - 5 upvotes, $0
  634. [sj.my.com] Source Code Disclosure /.svn/wc.db to Mail.ru - 5 upvotes, $0
  635. [sputnik.mail.ru] Publicly accessible GIT directory to Mail.ru - 5 upvotes, $0
  636. [FG-VD-17-115] Mail.ru's Amigo Browser DLL Pre-Loading Vulnerability Notification to Mail.ru - 5 upvotes, $0
  637. sql to Mail.ru - 5 upvotes, $0
  638. [auto.mail.ru] IDOR на редактирование поста любого юзера. to Mail.ru - 5 upvotes, $0
  639. Public available Sensitive Information about drivers to Mail.ru - 5 upvotes, $0
  640. mailgun subdomain takeover on "email.mail.geekbrains.ru" to Mail.ru - 5 upvotes, $0
  641. [v7lk.relap.io] Sending arbitrary emails to any user to Mail.ru - 5 upvotes, $0
  642. relap.io CSRF bypass on adding domain to use relap widgets to Mail.ru - 5 upvotes, $0
  643. Reflected XSS in "keywords" parameter at "https://sbermarket.ru/metro/search" to Mail.ru - 5 upvotes, $0
  644. xss on [storehouse5.ucs.ru] to Mail.ru - 5 upvotes, $0
  645. XSS via "gp" cookie reflected in source code to Mail.ru - 5 upvotes, $0
  646. This Github Repository Seems Leaking "nino.samokat.ru" Source Code to Mail.ru - 5 upvotes, $0
  647. Clickjacking Vulnerability via https://www.donationalerts.com/help/support leads to bypass for widget.support.my.games X-Frame Options to Mail.ru - 5 upvotes, $0
  648. CSRF in updating username https://pw.mail.ru/ to Mail.ru - 5 upvotes, $0
  649. subdomain Takeover to Mail.ru - 5 upvotes, $0
  650. Theft of Arbitrary file to Mail.ru - 5 upvotes, $0
  651. Customer domain information disclosure at https://biz.mail.ru/api/domains/* to Mail.ru - 5 upvotes, $0
  652. Получение локального пути до файла [geekbrains.ru] to Mail.ru - 5 upvotes, $0
  653. Acessed internal api documentation and information to Mail.ru - 5 upvotes, $0
  654. Stored XSS on https://community.my.games/ (Add Post) to Mail.ru - 5 upvotes, $0
  655. Ошибка фильтрации to Mail.ru - 4 upvotes, $500
  656. mrgs.my.games account takeover to Mail.ru - 4 upvotes, $500
  657. connect.mail.ru: SSRF to Mail.ru - 4 upvotes, $300
  658. OpenSSL HeartBleed (CVE-2014-0160) to Mail.ru - 4 upvotes, $200
  659. [my.mail.ru] HTML injection в письмах от [email protected] to Mail.ru - 4 upvotes, $100
  660. [online.games.mail.ru] - Sensitive information disclosure to Mail.ru - 4 upvotes, $100
  661. ssl cookkie without secure flag set to Mail.ru - 4 upvotes, $100
  662. Admin panel of http://tp-test1.corp.mail.ru/ is acccessible publicly to Mail.ru - 4 upvotes, $0
  663. XSS in https://e.mail.ru/cgi-bin/lstatic (Limited use) to Mail.ru - 4 upvotes, $0
  664. XXE and SSRF on webmaster.mail.ru to Mail.ru - 4 upvotes, $0
  665. https://voip.agent.mail.ru/phpinfo.php to Mail.ru - 4 upvotes, $0
  666. Авторизуюсь от имени любого пользователя parapa.mail.ru to Mail.ru - 4 upvotes, $0
  667. [tz.mail.ru] XSS в функционале авторизации to Mail.ru - 4 upvotes, $0
  668. Back Refresh Attack after registration and successful logout to Mail.ru - 4 upvotes, $0
  669. [opensource.mail.ru] system accounts enumeration to Mail.ru - 4 upvotes, $0
  670. [support.my.com] Internet Explorer XSS to Mail.ru - 4 upvotes, $0
  671. [3k.mail.ru] Content Spoofing to Mail.ru - 4 upvotes, $0
  672. [opensource.mail.ru] Debug Mode to Mail.ru - 4 upvotes, $0
  673. [allods.my.com] Full SQL Disclosure to Mail.ru - 4 upvotes, $0
  674. [it.mail.ru] Open Redirect to Mail.ru - 4 upvotes, $0
  675. [allods.mail.ru] Cross-Site Request Forgery (Add-Item) to Mail.ru - 4 upvotes, $0
  676. Reflected XSS on hi-tech.mail.ru to Mail.ru - 4 upvotes, $0
  677. Reflected XSS. to Mail.ru - 4 upvotes, $0
  678. Clickjacking Full account takeover and editing the personal information at [account.my.com] to Mail.ru - 4 upvotes, $0
  679. Self-xss via drag&drop in email form to Mail.ru - 4 upvotes, $0
  680. [afisha.mail.ru] HTML-инъекция через XSS на портале виджета to Mail.ru - 4 upvotes, $0
  681. [target.my.com] CRLF Injection -> XSS to Mail.ru - 4 upvotes, $0
  682. [beta.tracker.my.com] XSS Request-URI to Mail.ru - 4 upvotes, $0
  683. CSRF на удаление товара из корзины to Mail.ru - 4 upvotes, $0
  684. XSS to Mail.ru - 4 upvotes, $0
  685. xss to Mail.ru - 4 upvotes, $0
  686. Phpinfo to Mail.ru - 4 upvotes, $0
  687. Rails application running in development mode to Mail.ru - 4 upvotes, $0
  688. self XSS на странице https://aw.mail.ru/pin/ to Mail.ru - 4 upvotes, $0
  689. Раскрытие информации о совершенных операциях to Mail.ru - 4 upvotes, $0
  690. Открытые сорцы to Mail.ru - 4 upvotes, $0
  691. Information Disclosure on {http://pro.tracker.my.com} to Mail.ru - 4 upvotes, $0
  692. [capsula.mail.ru] overriding order info to Mail.ru - 4 upvotes, $0
  693. Content injection on shared event (calendar.mail.ru) to Mail.ru - 4 upvotes, $0
  694. information disclosure via IDOR on "https://target.my.com/api/v2/coverage/segment.json?id={id}" endpoint to Mail.ru - 4 upvotes, $0
  695. Clickjacking Vulnerability via https://webagent.mail.ru leading to protection bypass for https://web.icq.com/ end point to Mail.ru - 4 upvotes, $0
  696. Пользователь может изменить способ оплаты указав чужой corporation ID to Mail.ru - 4 upvotes, $0
  697. OTP bypass on user account deletion to Mail.ru - 4 upvotes, $0
  698. This Github Repository Seems Leaking Samokat Django Project to Mail.ru - 4 upvotes, $0
  699. XSS Stored on https://seedr.ru to Mail.ru - 4 upvotes, $0
  700. [e.mail.ru] XSS на странице отправки денежного перевода to Mail.ru - 3 upvotes, $500
  701. Access to git & and configuration files on backtoschool.geekbrains.ru via gitfile to Mail.ru - 3 upvotes, $400
  702. RCE через JDWP to Mail.ru - 3 upvotes, $300
  703. SQL injection update.mail.ru to Mail.ru - 3 upvotes, $250
  704. Home page reflected XSS to Mail.ru - 3 upvotes, $250
  705. SQL inj to Mail.ru - 3 upvotes, $150
  706. SQL to Mail.ru - 3 upvotes, $150
  707. By pass admin panel [conference.mail.ru] to Mail.ru - 3 upvotes, $150
  708. SSRF/XSPA [parapa.mail.ru] to Mail.ru - 3 upvotes, $150
  709. Possible tokens leak on ws-app.city-mobil.ru to Mail.ru - 3 upvotes, $150
  710. Возможность просмотра коментариев к чужим обращениям [corporate.city-mobil.ru] to Mail.ru - 3 upvotes, $150
  711. kds.ucs.ru - раскрытие информации. to Mail.ru - 3 upvotes, $150
  712. No bruteforce protection leads to enumeration of emails in http://e.mail.ru/ to Mail.ru - 3 upvotes, $100
  713. Login without SSL-Protection to Mail.ru - 3 upvotes, $0
  714. Clickjacking to Mail.ru - 3 upvotes, $0
  715. Flash XSS in http://go.mail.ru to Mail.ru - 3 upvotes, $0
  716. SQL Injection on 11x11.mail.ru to Mail.ru - 3 upvotes, $0
  717. Flash XSS in http://lingvo.mail.ru to Mail.ru - 3 upvotes, $0
  718. Раскрытие полного серверного пути to Mail.ru - 3 upvotes, $0
  719. tp-demo1.corp.mail.ru: SVN наружу торчит to Mail.ru - 3 upvotes, $0
  720. [start.icq.com] Reflected XSS via Cookies to Mail.ru - 3 upvotes, $0
  721. Vulnerability :- "XSS vulnerability" to Mail.ru - 3 upvotes, $0
  722. [ling.go.mail.ru] Server-Status opened for all users to Mail.ru - 3 upvotes, $0
  723. [torg.mail.ru] CRLF Injection to Mail.ru - 3 upvotes, $0
  724. Stored XSS на street-combats.mail.ru to Mail.ru - 3 upvotes, $0
  725. [api.login.icq.net] Open Redirect to Mail.ru - 3 upvotes, $0
  726. [api.login.icq.net] Reflected XSS to Mail.ru - 3 upvotes, $0
  727. Reflected XSS. to Mail.ru - 3 upvotes, $0
  728. Apache Server-Status Detected to Mail.ru - 3 upvotes, $0
  729. Logical Vulnerability : REDIRECTING on pw.mail.ru by Parameter Spoofing to Mail.ru - 3 upvotes, $0
  730. [tanks.mail.ru] Open Redirect to Mail.ru - 3 upvotes, $0
  731. [aw.my.com] Reflected XSS to Mail.ru - 3 upvotes, $0
  732. Stored XSS на странице pubg.mail.ru/community to Mail.ru - 3 upvotes, $0
  733. Множественные уязвимости приложения Mail.Ru Почта (Android) to Mail.ru - 3 upvotes, $0
  734. Открытая панель to Mail.ru - 3 upvotes, $0
  735. ICQ Windows Application is Vulnerable to DLL Search Order Hijacking to Mail.ru - 3 upvotes, $0
  736. Settings page in https://support.my.com is vulnerable to clickjacking to Mail.ru - 3 upvotes, $0
  737. Ability to find out the name of the database table and its columns to Mail.ru - 3 upvotes, $0
  738. Cross-Site Request Forgery (CSRF) in my.games API to Mail.ru - 3 upvotes, $0
  739. XSS on https://deti.mail.ru/ to Mail.ru - 3 upvotes, $0
  740. Collected Telegraf Matrics Accessible to Mail.ru - 3 upvotes, $0
  741. Cross-Site Request Forgery (CSRF) in comment update - api.my.games to Mail.ru - 3 upvotes, $0
  742. [icq.com/people/uin/edit] Отсутствует фильтр и проверка на дубли в поле "Никнейм" to Mail.ru - 3 upvotes, $0
  743. SMTP Header Injection at http://abonement.ucs.ru to Mail.ru - 3 upvotes, $0
  744. tracker.my.com information disclosure via csrf bypass to Mail.ru - 3 upvotes, $0
  745. Vertical Privilege Escalation on {target.my.com} to Mail.ru - 3 upvotes, $0
  746. looch.tv CORS crossite user information and stream_key access to Mail.ru - 3 upvotes, $0
  747. Improper Restriction of Excessive Authentication Attempts at https://api.warrobots.com/auth (Pixonic Games) to Mail.ru - 3 upvotes, $0
  748. e.mail.ru: File upload "Chapito" circus to Mail.ru - 2 upvotes, $1000
  749. touch.mail.ru XSS via message id to Mail.ru - 2 upvotes, $500
  750. e.mail.ru: SMS spam with custom content to Mail.ru - 2 upvotes, $400
  751. store-agent.mail.ru: stacked blind injection to Mail.ru - 2 upvotes, $400
  752. [orsotenslimselfie.lady.mail.ru] SQL Injection to Mail.ru - 2 upvotes, $300
  753. tt-mac.i.mail.ru: Quagga 0.99.23.1 (Router) : Default password and default enable password to Mail.ru - 2 upvotes, $200
  754. SQL inj to Mail.ru - 2 upvotes, $150
  755. scfbp.tng.mail.ru: Heartbleed to Mail.ru - 2 upvotes, $150
  756. [tidaltrek.mail.ru] SQL Injection to Mail.ru - 2 upvotes, $150
  757. ssrf xspa [https://prt.mail.ru/] to Mail.ru - 2 upvotes, $150
  758. Раскрытие номера мобильного телефона при двухфакторной аутентификации to Mail.ru - 2 upvotes, $100
  759. Unproper usage of Mobile Number that will lead to Information Disclosure to Mail.ru - 2 upvotes, $0
  760. Persistent XSS in afisha.mail.ru to Mail.ru - 2 upvotes, $0
  761. Flash XSS - http://hi-tech.mail.ru/ to Mail.ru - 2 upvotes, $0
  762. XSS in "About Video" to Mail.ru - 2 upvotes, $0
  763. Reflected XSS to Mail.ru - 2 upvotes, $0
  764. rs.mail.ru - Flash Based XSS to Mail.ru - 2 upvotes, $0
  765. Version Disclosure (NginX) to Mail.ru - 2 upvotes, $0
  766. localStorage не чистится после выхода to Mail.ru - 2 upvotes, $0
  767. Stored XSS on http://cards.mail.ru to Mail.ru - 2 upvotes, $0
  768. Content Spoofing vulnerability in Mail.ru mobile to Mail.ru - 2 upvotes, $0
  769. Stored XSS on http://top.mail.ru to Mail.ru - 2 upvotes, $0
  770. Перечисление каталогов за счёт уязвимости в IIS to Mail.ru - 2 upvotes, $0
  771. files.mail.ru: XSS to Mail.ru - 2 upvotes, $0
  772. Не уверен, что этому место на периметре: 94.100.180.95, 94.100.180.96, 94.100.180.97, 94.100.180.98 to Mail.ru - 2 upvotes, $0
  773. /surveys/2auth: DOM-based XSS to Mail.ru - 2 upvotes, $0
  774. help2.m.smailru.net: XSS to Mail.ru - 2 upvotes, $0
  775. XSS: https://light.mail.ru/compose, https://m.mail.ru/compose/[id]/reply при ответе на специальным образом сформированное письмо to Mail.ru - 2 upvotes, $0
  776. Reflective Xss on news.mail.ru and admin.news.mail.ru to Mail.ru - 2 upvotes, $0
  777. Выполнение кода PHP через FastCGI to Mail.ru - 2 upvotes, $0
  778. Flash XSS на old.corp.mail.ru to Mail.ru - 2 upvotes, $0
  779. XSS at forum : to Mail.ru - 2 upvotes, $0
  780. Reflected XSS на games.mail.ru to Mail.ru - 2 upvotes, $0
  781. [sales.mail.ru] CRLF Injection to Mail.ru - 2 upvotes, $0
  782. AXFR на plexus.m.smailru.net работает to Mail.ru - 2 upvotes, $0
  783. BRUTE FORCE ATTACK to Mail.ru - 2 upvotes, $0
  784. Обход basic авторизации [qpt.mail.ru] to Mail.ru - 2 upvotes, $0
  785. Излишние права при авторизации через интерфейс mail.ru to Mail.ru - 2 upvotes, $0
  786. [warofdragons.com] Content Spoofing to Mail.ru - 2 upvotes, $0
  787. [s2.jugger.ru] Content Spoofing to Mail.ru - 2 upvotes, $0
  788. [tanks.mail.ru] Content Spoofing to Mail.ru - 2 upvotes, $0
  789. [babel.mail.ru] Admin Page Found to Mail.ru - 2 upvotes, $0
  790. [legal.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  791. [allods.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  792. [id.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  793. [furry.aw.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  794. [evo2.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  795. [evo.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  796. [mg.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  797. [support.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  798. [wos.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  799. [account.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  800. [lucky-fields.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  801. [sf.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  802. [games.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  803. [dl.beepcar.ru] CRLF Injection to Mail.ru - 2 upvotes, $0
  804. Clickjacking Vulnerability on https://support.my.com/games/ticket/xxxx/ to Mail.ru - 2 upvotes, $0
  805. DNS Misconfiguration to Mail.ru - 2 upvotes, $0
  806. XSS on New contact to Mail.ru - 2 upvotes, $0
  807. ssl cookie without secure flag set to Mail.ru - 2 upvotes, $0
  808. phpinfo to Mail.ru - 2 upvotes, $0
  809. FLV FILE FORMAT (AUDIOSES.DLL) Out of Bounds to Mail.ru - 2 upvotes, $0
  810. Открытый .htaccess на cookery.zakazaka.ru to Mail.ru - 2 upvotes, $0
  811. xss to Mail.ru - 2 upvotes, $0
  812. Stored XSS at branded site in .mail.ru domain to Mail.ru - 2 upvotes, $0
  813. donationalerts.com limitations bypass to Mail.ru - 2 upvotes, $0
  814. [staging.tarantool.org] Github Pages Subdomain-take-over to Mail.ru - 2 upvotes, $0
  815. CRLF Injection in 301 Redirect allow to Set-Cookies for mail.ru to Mail.ru - 2 upvotes, $0
  816. Improper access control leading to deletion of Greeting videos on {https://smtp.8mar.mail.ru/} to Mail.ru - 2 upvotes, $0
  817. Subdomain takeover at msproject.geekbrains.ru to Mail.ru - 2 upvotes, $0
  818. Bypass OTP on contact back request at https://driver.city-mobil.ru/ to Mail.ru - 2 upvotes, $0
  819. IDOR позволяет изменить информацию о пользователе. to Mail.ru - 2 upvotes, $0
  820. [garnier-olia.lady.mail.ru] Reflected XSS /exp/ bypass "/" to Mail.ru - 2 upvotes, $0
  821. [api.33slona.ru] Доступ к API из за неправильной конфигурации сервера 302 редирет. to Mail.ru - 2 upvotes, $0
  822. Information Disclosure on qa-delivery-srv.plazius.ru to Mail.ru - 2 upvotes, $0
  823. Information Disclosure on www7.promo.plazius.ru to Mail.ru - 2 upvotes, $0
  824. Google API Key is not restricted for specific application package name and signature [Mail.ru Cloud for Android] to Mail.ru - 2 upvotes, $0
  825. https://217.69.135.63/rb/: money.mail.ru sources disclosure to Mail.ru - 1 upvotes, $1000
  826. XSS in a file or folder name to Mail.ru - 1 upvotes, $500
  827. e.mail.ru stored XSS in agent via sticker (smile) to Mail.ru - 1 upvotes, $500
  828. auth.mail.ru: XSS in login form to Mail.ru - 1 upvotes, $500
  829. http://fitter1.i.mail.ru/browser/ торчит Graphite в мир to Mail.ru - 1 upvotes, $400
  830. SQL injection [дырка в движке форума] to Mail.ru - 1 upvotes, $200
  831. Time based sql injection to Mail.ru - 1 upvotes, $200
  832. Possible xWork classLoader RCE: shared.mail.ru to Mail.ru - 1 upvotes, $200
  833. money.mail.ru: Странное поведение SMS to Mail.ru - 1 upvotes, $150
  834. cloud.mail.ru: File upload XSS using Content-Type header to Mail.ru - 1 upvotes, $150
  835. Heartbleed: my.com (185.30.178.33) port 1433 to Mail.ru - 1 upvotes, $150
  836. HDFS NameNode Public disclosure: http://185.5.139.33:50070/dfshealth.jsp to Mail.ru - 1 upvotes, $150
  837. Hadoop Node available to public to Mail.ru - 1 upvotes, $150
  838. http://tp-dev1.tp.smailru.net/ to Mail.ru - 1 upvotes, $150
  839. [parapa.mail.ru] SQL Injection to Mail.ru - 1 upvotes, $150
  840. [allods.my.com] SSRF / XSPA to Mail.ru - 1 upvotes, $150
  841. [3k.mail.ru] SQL Injection to Mail.ru - 1 upvotes, $150
  842. SQL Injection to Mail.ru - 1 upvotes, $150
  843. [tidaltrek.mail.ru] SQL Injection to Mail.ru - 1 upvotes, $150
  844. m.agent.mail.ru: Подделываем j2me app-descriptor to Mail.ru - 1 upvotes, $100
  845. No CSRF token used in Phone Verification POST to Mail.ru - 1 upvotes, $0
  846. Xss On http://my.mail.ru/ to Mail.ru - 1 upvotes, $0
  847. Clicjacking on Login panel to Mail.ru - 1 upvotes, $0
  848. Reflected XSS to Mail.ru - 1 upvotes, $0
  849. Reflected XSS in User-Agent to Mail.ru - 1 upvotes, $0
  850. (m.mail.ru) Password type input with auto-complete enabled to Mail.ru - 1 upvotes, $0
  851. Раскрытие путей сервера за счёт неопределённого индекса в сценарии /home/berserk-online.com/public_html/forum/Themes/berserker/Profile.template.php to Mail.ru - 1 upvotes, $0
  852. Нежелательная информация to Mail.ru - 1 upvotes, $0
  853. XSS Vulnerability in cfire.mail.ru/screen/1/ to Mail.ru - 1 upvotes, $0
  854. XSS in realty.mail.ru to Mail.ru - 1 upvotes, $0
  855. XSS in ad.mail.ru to Mail.ru - 1 upvotes, $0
  856. XSS in touch.sports.mail.ru to Mail.ru - 1 upvotes, $0
  857. api.video.mail.ru: XSS to Mail.ru - 1 upvotes, $0
  858. touch.afisha.mail.ru: XSS to Mail.ru - 1 upvotes, $0
  859. my.mail.ru: HTTP Header Injection to Mail.ru - 1 upvotes, $0
  860. target.mail.ru: XSS через Referer to Mail.ru - 1 upvotes, $0
  861. target.mail.ru: XSS to Mail.ru - 1 upvotes, $0
  862. files.mail.ru: HTTP Header Injection to Mail.ru - 1 upvotes, $0
  863. 3k.mail.ru: XSS to Mail.ru - 1 upvotes, $0
  864. http://217.69.136.200/?p=2&c=Fetcher%20cluster&h=fetcher1.mail.ru to Mail.ru - 1 upvotes, $0
  865. GET /surveys/2auth: XSS to Mail.ru - 1 upvotes, $0
  866. [riot.mail.ru] Reflected XSS in debug-mode to Mail.ru - 1 upvotes, $0
  867. Flash XSS on img.mail.ru to Mail.ru - 1 upvotes, $0
  868. [api.allodsteam.com] Authentication Data to Mail.ru - 1 upvotes, $0
  869. Multiple vulnerabilities in mail.ru subdomains to Mail.ru - 1 upvotes, $0
  870. reflected in xss to Mail.ru - 1 upvotes, $0
  871. SSRF на element.mail.ru to Mail.ru - 1 upvotes, $0
  872. Cross Site Scripting to Mail.ru - 1 upvotes, $0
  873. Time-Based Blind SQL Injection Attacks to Mail.ru - 1 upvotes, $0
  874. Insecure cookies without httpOnly flag set to Mail.ru - 1 upvotes, $0
  875. Утечка информации через JSONP (XXSI) to Mail.ru - 1 upvotes, $0
  876. Reflected XSS @ games.mail.ru to Mail.ru - 1 upvotes, $0
  877. Cross-Site Request Forgery to Mail.ru - 1 upvotes, $0
  878. сервант статус to Mail.ru - 1 upvotes, $0
  879. XSS to Mail.ru - 1 upvotes, $0
  880. [performancemarketing.geekbrains.ru] Tilda Subdomain Takeover to Mail.ru - 1 upvotes, $0
  881. This Github Repository Seems Leaking Incoming Samokat Project to Mail.ru - 1 upvotes, $0
  882. "blog.skillfactory.ru" Vulnerable to Directory Traversal to Mail.ru - 1 upvotes, $0
  883. Exposed Credentials May Leads to Tarantool Infrastructure Leak to Mail.ru - 1 upvotes, $0
  884. Social Oauth Disconnect CSRF at znakcup.ru to Mail.ru - 1 upvotes, $0
  885. XSS via .eml file to Mail.ru - 0 upvotes, $1337
  886. lenta_proxy information disclosure to Mail.ru - 0 upvotes, $400
  887. [afisha.mail.ru] SQL Injection to Mail.ru - 0 upvotes, $300
  888. Stored XSS through fileupload to Mail.ru - 0 upvotes, $200
  889. [cfire.mail.ru] Time Based SQL Injection to Mail.ru - 0 upvotes, $150
  890. Получаем все домены и поддомены icq с помощью amazonaws.com [config,txt] to Mail.ru - 0 upvotes, $0
  891. пхпинфо to Mail.ru - 0 upvotes, $0
  892. SVN repository to Mail.ru - 0 upvotes, $0
  893. Self XSS via help.mail.ru interface to Mail.ru - 0 upvotes, $0
  894. Information Disclosure to Mail.ru - 0 upvotes, $0
  895. Information Disclosure to Mail.ru - 0 upvotes, $0
  896. Пользователь с правами Менеджер может получить Список сотрудников всех кост центров и Удалять пользователей всех кост центров to Mail.ru - 0 upvotes, $0