Skip to content

Latest commit

 

History

History
814 lines (810 loc) · 99.4 KB

TOPMAILRU.md

File metadata and controls

814 lines (810 loc) · 99.4 KB

Back

Top reports from Mail.ru program at HackerOne:

  1. Time-Based SQL injection at city-mobil.ru to Mail.ru - 609 upvotes, $15000
  2. touch.mail.ru / e.mail.ru memory content disclosure to Mail.ru - 406 upvotes, $10000
  3. Unrestricted file upload on [ambassador.mail.ru] to Mail.ru - 402 upvotes, $3000
  4. Account Takeover worki.ru to Mail.ru - 388 upvotes, $1700
  5. Cross-organization data access in city-mobil.ru to Mail.ru - 363 upvotes, $8000
  6. SQL injection at fleet.city-mobil.ru to Mail.ru - 360 upvotes, $10000
  7. Account TakeOver at my.33slona.ru to Mail.ru - 359 upvotes, $1700
  8. Account TakeOver at my.33slona.ru to Mail.ru - 359 upvotes, $1700
  9. RCE on shared.mail.ru due to "widget" plugin to Mail.ru - 358 upvotes, $10000
  10. SSRF & LFR via on city-mobil.ru to Mail.ru - 337 upvotes, $6000
  11. [ RCE ] Through stopping the redirect in /admin/* the attacker able to bypass Authentication And Upload Malicious File to Mail.ru - 336 upvotes, $4000
  12. [windows10.hi-tech.mail.ru] Blind SQL Injection to Mail.ru - 323 upvotes, $5000
  13. [fleet.city-mobil.ru] Driver balance increasing to Mail.ru - 317 upvotes, $8000
  14. SSRF on fleet.city-mobil.ru leads to local file read to Mail.ru - 272 upvotes, $6000
  15. XXE on pulse.mail.ru to Mail.ru - 262 upvotes, $6000
  16. HTTP request smuggling (?) canpol.deti.mail.ru to Mail.ru - 240 upvotes, $5000
  17. SSRF & LFR on city-mobil.ru to Mail.ru - 237 upvotes, $6000
  18. Boolean-based SQL Injection on relap.io to Mail.ru - 224 upvotes, $2000
  19. Blind SQL Injection in city-mobil.ru domain to Mail.ru - 221 upvotes, $2000
  20. [panel.city-mobil.ru/admin/] Blind XSS into username to Mail.ru - 219 upvotes, $750
  21. SQL LIKE clauses wildcard injection to Mail.ru - 208 upvotes, $8000
  22. Cross application scripting via account.mail.ru to Mail.ru - 204 upvotes, $5000
  23. file read on MCS servers via supplying a QCOW2 image with external backing file to Mail.ru - 189 upvotes, $15000
  24. JMX RMI command injection on 195.211.131.82(Mail.ru Gaming) to Mail.ru - 162 upvotes, $2000
  25. Information disclosure with sensitive data to Mail.ru - 154 upvotes, $1500
  26. Access to Tarantool to Mail.ru - 152 upvotes, $4000
  27. Path traversal, SSTI and RCE on a MailRu acquisition to Mail.ru - 152 upvotes, $2000
  28. SQL Injection [unauthenticated] with direct output at https://news.mail.ru/ to Mail.ru - 151 upvotes, $7500
  29. [c-api.city-mobil.ru] Client authentication bypass leads to information disclosure to Mail.ru - 143 upvotes, $8000
  30. Account Takeover at worki.ru to Mail.ru - 142 upvotes, $1500
  31. Account Takeover at vseapteki.ru to Mail.ru - 141 upvotes, $2000
  32. Account TakeOver through password recovery at am.ru to Mail.ru - 139 upvotes, $3000
  33. XSS via message subject - mobile application to Mail.ru - 138 upvotes, $1000
  34. PHP code injection at tz.mail.ru to Mail.ru - 136 upvotes, $3000
  35. worki.ru: SMS code bruteforce to Mail.ru - 133 upvotes, $1657
  36. SSRF in clients.city-mobil.ru to Mail.ru - 130 upvotes, $1500
  37. SSRF in filtering on relap.io to Mail.ru - 127 upvotes, $1700
  38. [api.pandao.ru] IDOR for order delivery address to Mail.ru - 119 upvotes, $3000
  39. web.icq.com XSS in chat message via contact info to Mail.ru - 115 upvotes, $1000
  40. "😂" + Unauthenticated Stored XSS in API at https://api.my.games/comments/v1/comments/update/ to Mail.ru - 113 upvotes, $0
  41. SMS Brute Force Possibility via https://youdrive.today/login/web/code can lead to Account Takeover to Mail.ru - 103 upvotes, $1500
  42. [agent.33slona.ru] Recovery code bruteforce to Mail.ru - 102 upvotes, $1500
  43. Open Selenoid instance at 188.93.63.186 leads to LFR/SSRF. to Mail.ru - 93 upvotes, $6000
  44. [city-mobil.ru] SSRF & limited LFR on /taxiserv/photoeditor/save endpoint via base64 POST parameter to Mail.ru - 93 upvotes, $6000
  45. Blind SSRF in horizon-heat to Mail.ru - 90 upvotes, $2500
  46. turboslim.lady.mail.ru - Blind sql-injection. to Mail.ru - 89 upvotes, $5000
  47. Stored XSS to Mail.ru - 89 upvotes, $500
  48. capsula.mail.ru - Admin blind stored XSS to Mail.ru - 86 upvotes, $1500
  49. Avatar upload allows arbitrary file overwriting to Mail.ru - 84 upvotes, $750
  50. Blind XSS in operator's interface for 33slona.ru to Mail.ru - 84 upvotes, $600
  51. Reflected XSS in https://light.mail.ru/login via page to Mail.ru - 83 upvotes, $500
  52. Access User Tickets via IDOR in [widget.support.my.games] to Mail.ru - 82 upvotes, $2000
  53. 3igames.mail.ru SQL Injection to Mail.ru - 81 upvotes, $1500
  54. Возможность зайти на любой аккаунт https://pandao.ru/ to Mail.ru - 76 upvotes, $2600
  55. Stored XSS in email to Mail.ru - 75 upvotes, $1000
  56. [https://city-mobil.ru/taxiserv] Blind XSS into username to Mail.ru - 74 upvotes, $750
  57. Дюп предметов lootdog и возможность их продавать. to Mail.ru - 73 upvotes, $5000
  58. [Mail.Ru Android] Typo in permission name allows to write contacts without user knowledge to Mail.ru - 72 upvotes, $150
  59. Stored XSS that allow an attacker to read victim mailboxes contacts in mail.ru and my.com application to Mail.ru - 71 upvotes, $1000
  60. blind XXE in autodiscover parser to Mail.ru - 70 upvotes, $5000
  61. XSS via Cookie in Mail.ru to Mail.ru - 70 upvotes, $1000
  62. [API] ICQ user's avatar can be manipulated remotely to Mail.ru - 70 upvotes, $1000
  63. [account.mail.ru] XSS-уязвимость в форме авторизации to Mail.ru - 70 upvotes, $1000
  64. XSS via POST request to https://account.mail.ru/signup/ to Mail.ru - 70 upvotes, $1000
  65. Cross-site Scripting (XSS) - DOM on https://account.mail.ru/user/garage?back_url=https://mail.ru to Mail.ru - 65 upvotes, $1000
  66. Account takeover through password reset in cups.mail.ru to Mail.ru - 64 upvotes, $1500
  67. Reflected XSS & Open Redirect at mcs main domain to Mail.ru - 64 upvotes, $1000
  68. web.icq.com XSS in chat message via contact info to Mail.ru - 64 upvotes, $500
  69. SQL Injection at https://lite.r-keeper.ru/site_api/clients/derision/?lang=ru to Mail.ru - 58 upvotes, $1500
  70. SQL injection delivery-club.ru (ClickHouse) to Mail.ru - 57 upvotes, $5000
  71. [pandao.ru] Возможность списания несуществующих бонусных баллов to Mail.ru - 56 upvotes, $1000
  72. HTML injection at face.city-mobil.ru to Mail.ru - 56 upvotes, $500
  73. Blind SSRF in magnum upgrade_params to Mail.ru - 54 upvotes, $2500
  74. XSS account.mail.ru to Mail.ru - 54 upvotes, $1000
  75. XXE на webdav.mail.ru - PROPFIND/PROPPATCH to Mail.ru - 53 upvotes, $10000
  76. Error in processing gif images to Mail.ru - 53 upvotes, $250
  77. Possibility to attach any mobile number to any email to Mail.ru - 51 upvotes, $3000
  78. Blind SQL Injection on news.mail.ru to Mail.ru - 51 upvotes, $3000
  79. molotok.m.mail.ru delegated to external entity to Mail.ru - 48 upvotes, $1500
  80. IDOR of users to Mail.ru - 48 upvotes, $500
  81. [my.games, lootdog.io] XSS via MCS Bucket to Mail.ru - 47 upvotes, $1333
  82. read new emails from any inbox IOS APP in notification center to Mail.ru - 44 upvotes, $10000
  83. BLIND SSRF ON http://jsgames.mail.ru via avaOp parameter to Mail.ru - 44 upvotes, $1200
  84. Stored XSS when you read eamils. <style> to Mail.ru - 44 upvotes, $1000
  85. SSRF to Mail.ru - 44 upvotes, $500
  86. [https://pandao.ru] - PUT method available to Mail.ru - 42 upvotes, $1000
  87. [e.mail.ru] XSS в поиске to Mail.ru - 42 upvotes, $750
  88. Leak Sensetive Data at face.city-mobil.ru to Mail.ru - 42 upvotes, $500
  89. [smena.samokat.ru] Predictable JWT secret to Mail.ru - 42 upvotes, $400
  90. [city-mobil.ru/taxiserv/] SQLi at /taxiserv/tariffs/dictionary at filter{"id_locality"} param to Mail.ru - 41 upvotes, $3500
  91. Access to information about any video and its owner via GraphQL endpoint [dictor.mail.ru] to Mail.ru - 41 upvotes, $2500
  92. Blind XSS Stored On Admin Panel Through Name Parameter In [ https://technoatom.mail.ru/] to Mail.ru - 41 upvotes, $250
  93. LRF on shared.mail.ru due to "markdown" plugin to Mail.ru - 40 upvotes, $6000
  94. [XSS] data-url в письмах to Mail.ru - 40 upvotes, $1000
  95. [geekbrains.ru] CVE-2019-5418 Ruby on Rails File Content Disclosure to Mail.ru - 40 upvotes, $750
  96. Source code disclosure to Mail.ru - 40 upvotes, $500
  97. Stored xss on message reply to Mail.ru - 40 upvotes, $500
  98. API method at api.my.games allows to enumerate user emails to Mail.ru - 39 upvotes, $400
  99. Multiple SQL Injections and constrained LFI in esk-static.3igames.mail.ru to Mail.ru - 38 upvotes, $1500
  100. Forgot Password Page SMS Brute Force could lead to Account Takeover using Android/IOS app "About the house" via api.prodom.smart.space to Mail.ru - 37 upvotes, $1500
  101. [special.mail.ru] Information Disclosure to Mail.ru - 37 upvotes, $500
  102. CSRF on api.my.games due to improper validation of token allows an attacker to delete other users notifications to Mail.ru - 37 upvotes, $100
  103. Открытый Confluence и доступы к чату операторов в Skype to Mail.ru - 36 upvotes, $1500
  104. IDOR в списке пользователей по домену в relap.io to Mail.ru - 36 upvotes, $500
  105. IDOR в списке пользователей по домену в relap.io to Mail.ru - 36 upvotes, $500
  106. Blind SSRF на calendar.mail.ru при импорте календаря to Mail.ru - 35 upvotes, $5000
  107. Shell upload in http://widget.support.my.com/ to Mail.ru - 35 upvotes, $1000
  108. Database read through file attachment [content://] to Mail.ru - 35 upvotes, $1000
  109. unauthorized Access To Elastic DB to Mail.ru - 35 upvotes, $150
  110. [api-site.city-mobil.ru] Improper access control leads to information disclosure to Mail.ru - 34 upvotes, $5000
  111. Grafana SSRF in grafana.instamart.ru to Mail.ru - 34 upvotes, $1200
  112. CSRF Vulnerability at https://aw.my.com/ to Mail.ru - 34 upvotes, $0
  113. Disable 2FA via CSRF (Leads to 2FA Bypass) to Mail.ru - 34 upvotes, $0
  114. IDOR смена email пользователя через Ситимобил Бизнес to Mail.ru - 33 upvotes, $2500
  115. MCS Graphite SSRF: internal network access to Mail.ru - 33 upvotes, $2500
  116. api.icq.com / возможность смотреть аватарку и название приватного чата to Mail.ru - 33 upvotes, $1000
  117. [api.pandao.ru] IDOR позволяет изменять адрес любого пользователя to Mail.ru - 33 upvotes, $1000
  118. DOM XSS on https://biz.mail.ru/domains/goto/mail/ via parameter pollution to Mail.ru - 33 upvotes, $1000
  119. XSS in biz.mail.ru/error to Mail.ru - 33 upvotes, $500
  120. [XSS] postMessage в jsapi/button to Mail.ru - 33 upvotes, $500
  121. Blind SQL injection [https://honor.hi-tech.mail.ru] to Mail.ru - 33 upvotes, $300
  122. [api-site.city-mobil.ru] Improper access control leads to information disclosure (bypass of #977597 fix) to Mail.ru - 31 upvotes, $5000
  123. Possible access to the car's photo and registration by its ID on [fleet.city-mobil.ru] to Mail.ru - 31 upvotes, $5000
  124. XSS in message e.mail.ru to Mail.ru - 31 upvotes, $1000
  125. Code Injection in macOS Desktop Client to Mail.ru - 31 upvotes, $100
  126. [iot-hackathon.geekbrains.ru] Tilda Subdomain Takeover to Mail.ru - 31 upvotes, $0
  127. Bypass the reverse proxy. Request admin to Mail.ru - 31 upvotes, $0
  128. [o2.mail.ru] nginx alias traversal to Mail.ru - 30 upvotes, $150
  129. [https://seosan.io] Account owner disclosure to Mail.ru - 30 upvotes, $150
  130. [screenshot.mail.ru] CRLF Injection to Mail.ru - 30 upvotes, $0
  131. User session access due to Oauth whitelist host bypass and postMessage to Mail.ru - 30 upvotes, $0
  132. SDC bypass on calendar.mail.ru to Mail.ru - 29 upvotes, $1500
  133. SQL Injection at https://lite.r-keeper.ru/site_api/localize/translate/rklscommon/ru to Mail.ru - 29 upvotes, $1500
  134. Race condition на market.games.mail.ru to Mail.ru - 28 upvotes, $1000
  135. Full Account Takeover In ****.ru to Mail.ru - 28 upvotes, $500
  136. LFI in beta.mail.ru to Mail.ru - 28 upvotes, $150
  137. allods.mail.ru sql injection to Mail.ru - 27 upvotes, $2200
  138. [city-mobil.ru/taxiserv/] Disclosure information about drivers to Mail.ru - 27 upvotes, $1500
  139. o2.mail.ru XSS to Mail.ru - 27 upvotes, $1000
  140. [web.icq.com] Stored XSS in "О Контакте" to Mail.ru - 27 upvotes, $500
  141. Reflected XSS at city-mobil.ru to Mail.ru - 27 upvotes, $300
  142. IP address can be leaked on Image preview in ICQ for Android chat to Mail.ru - 27 upvotes, $150
  143. Blindy Replace User's Session with Attacker's Session to Mail.ru - 26 upvotes, $150
  144. Subdomain takeover on tilda.geekbrains.ru and fl-change.geekbrains.ru to Mail.ru - 26 upvotes, $0
  145. Account Takeover possibility via https://awards.donationalerts.com using login with twitch.tv to Mail.ru - 25 upvotes, $1000
  146. cross site scripting bypass session to Mail.ru - 25 upvotes, $1000
  147. Shell upload in partner service to Mail.ru - 25 upvotes, $500
  148. Un Authencitated Quartz Pannel with Scheduling tasks to Mail.ru - 25 upvotes, $500
  149. Stored XSS in history on [corporate.city-mobil.ru] to Mail.ru - 25 upvotes, $300
  150. CSRF on draft message creation in tel.mail.ru to Mail.ru - 25 upvotes, $250
  151. Blind SSRF [ Sentry Misconfiguraton ] to Mail.ru - 25 upvotes, $250
  152. [e.mail.ru] Stored xss in Mpop cookie to Mail.ru - 24 upvotes, $600
  153. Stored xss в пересланном сообщении. to Mail.ru - 24 upvotes, $500
  154. XSS in touch.mail.ru to Mail.ru - 24 upvotes, $500
  155. [XSS] iframe в payments/phones to Mail.ru - 24 upvotes, $500
  156. XSS via the lang parameter in a POST request on light.mail.ru to Mail.ru - 24 upvotes, $500
  157. Stored XSS in api.icq.net to Mail.ru - 24 upvotes, $150
  158. JSONP hijacking to Mail.ru - 24 upvotes, $0
  159. Stored XSS in Review Section https://games.mail.ru/ to Mail.ru - 24 upvotes, $0
  160. [int.ucs.ru] Доступ ко внутренней сети UCS через забытый прокси Fiddler на 217.25.235.214:7459 to Mail.ru - 23 upvotes, $2500
  161. Account takeover in cups.mail.ru using punycode characters to Mail.ru - 23 upvotes, $1500
  162. ICQ Android APP remote DoS to Mail.ru - 23 upvotes, $1000
  163. Blind XXE on my.mail.ru to Mail.ru - 23 upvotes, $800
  164. Sensitive information exposure via git commit to Mail.ru - 23 upvotes, $150
  165. Apache server-info enabled to Mail.ru - 23 upvotes, $0
  166. Account Takeover on https://www.delivery-club.ru через партнерский аккаунт. to Mail.ru - 22 upvotes, $1000
  167. uninitilized server memory disclosure via ImageMagick in my.mail.ru and cloud.mail.ru to Mail.ru - 22 upvotes, $750
  168. Mail.Ru Email for Android: Injecting custom screen inside adding new account flow to Mail.ru - 22 upvotes, $750
  169. СКР инжект to Mail.ru - 22 upvotes, $500
  170. Web cache information leakage at sbermarket.ru to Mail.ru - 22 upvotes, $400
  171. Mirror of https://city-mobil.ru admin interface to Mail.ru - 22 upvotes, $150
  172. IDOR widget.support.my.com to Mail.ru - 21 upvotes, $1000
  173. [Web ICQ Client] XSS уязвимость в имени пользователя to Mail.ru - 21 upvotes, $1000
  174. Stored XSS in e.mail.ru (payload affect multiple users) to Mail.ru - 21 upvotes, $750
  175. Xss Reflected On spgw.terrhq.ru [ url ] to Mail.ru - 21 upvotes, $750
  176. ICQ 10.0.12371 icq: Uri Handler '-testability' URL File Insecure Library Loading Code Execution Vulnerability to Mail.ru - 21 upvotes, $500
  177. XSS web.icq.com double linkify to Mail.ru - 21 upvotes, $250
  178. [icq.im] Reflected XSS via chat invite link to Mail.ru - 21 upvotes, $250
  179. ssrf xspa [https://prt.mail.ru/] 2 to Mail.ru - 21 upvotes, $150
  180. XSS in messages on geekbrains.ru to Mail.ru - 21 upvotes, $0
  181. Reflected XSS on https://go.mail.ru/search?fr=mn&q=<payload> to Mail.ru - 21 upvotes, $0
  182. Cross-site Scripting (XSS) - Reflected vseapteki.ru to Mail.ru - 21 upvotes, $0
  183. Django Debug=True Leaks admin email addresss and serval system information to Mail.ru - 21 upvotes, $0
  184. При передаче в ID сообщения нулевого байта, происходит вывод какого-то буфера. to Mail.ru - 20 upvotes, $3500
  185. Возможность изменить поле "E-Mail для доступа в личный кабинет" у другого пользователя [corporate.city-mobil.ru] to Mail.ru - 20 upvotes, $2500
  186. source code leak to Mail.ru - 20 upvotes, $150
  187. Stored XSS In mlbootcamp.ru to Mail.ru - 20 upvotes, $0
  188. [int.ucs.ru] Атаки на внутреннюю сеть UCS через СУБД Clickhouse to Mail.ru - 19 upvotes, $3000
  189. SDC bypass cloud.mail.ru for every /api/v3/* endpoint. to Mail.ru - 19 upvotes, $1500
  190. Stored XSS in calendar via UID parameter to Mail.ru - 19 upvotes, $1000
  191. слепая XSS в админ панели torg.mail.ru через отзыв to Mail.ru - 19 upvotes, $500
  192. XSS in e.mail.ru to Mail.ru - 19 upvotes, $500
  193. *..my.com open proxy to Mail.ru - 19 upvotes, $300
  194. Data URI Stored XSS on Donations Page to Mail.ru - 19 upvotes, $200
  195. IDOR in tracking driver logs at city-mobil.ru to Mail.ru - 19 upvotes, $150
  196. Disclosure of personal support email addresses on 'support-fleet.city-mobil.ru' to Mail.ru - 19 upvotes, $150
  197. [webvpn.city-srv.ru] Path traversal via CVE-2020-3452 to Mail.ru - 19 upvotes, $150
  198. URL redirection to Mail.ru - 19 upvotes, $0
  199. XSS at go.mail.ru to Mail.ru - 19 upvotes, $0
  200. [pandao.ru] possibility to attach arbitrary phone number to account registered via social network to Mail.ru - 18 upvotes, $750
  201. Redmin API Key Exposed In GIthub to Mail.ru - 18 upvotes, $400
  202. ОДМИН ТЭСТ to Mail.ru - 18 upvotes, $150
  203. ICQ for macOS: lack of com.apple.quarantine meta-attribute on downloaded files leads to GateKeeper/Quarantine bypass for downloaded executables to Mail.ru - 18 upvotes, $150
  204. Path traversal on bank.mail.ru ( CVE-2013-3827 ) to Mail.ru - 18 upvotes, $150
  205. [Web ICQ Client] XSS-inj in polls to Mail.ru - 17 upvotes, $1000
  206. SSRF On [ allods.mail.ru ] to Mail.ru - 17 upvotes, $750
  207. XSS on https://account.mail.ru/login via postMessage to Mail.ru - 17 upvotes, $500
  208. Account takeover via CORS misconfigutation on https://beta.delivery-club.ru to Mail.ru - 17 upvotes, $250
  209. CSRF in attach phone API endpoint on delivery-club.ru to Mail.ru - 17 upvotes, $250
  210. An implementation flaw in Mail.ru can be exploited for DKIM signature spoofing and email spoofing to Mail.ru - 17 upvotes, $150
  211. Account TakeOver at kvartira.city-mobil.ru to Mail.ru - 17 upvotes, $150
  212. [mobs.mail.ru] nginx path traversal via misconfigured alias to Mail.ru - 17 upvotes, $0
  213. Web Cache Poisoning to Mail.ru - 17 upvotes, $0
  214. XSS в теле письма. to Mail.ru - 16 upvotes, $1000
  215. Mail.ru for Android - Theft of sensitive data to Mail.ru - 16 upvotes, $1000
  216. relap.io IDOR to Mail.ru - 16 upvotes, $750
  217. XSS in e.mail.ru to Mail.ru - 16 upvotes, $500
  218. Blind SSRF on sentry.dev-my.com due to Sentry misconfiguration to Mail.ru - 16 upvotes, $500
  219. CVE-2016-6415 on api-staging.plazius.ru [46.148.201.218] to Mail.ru - 16 upvotes, $400
  220. Bypass security fixes by downgrading version of application to Mail.ru - 16 upvotes, $250
  221. IDOR of contracts on dictor.mail.ru to Mail.ru - 16 upvotes, $150
  222. Пользователь может изменить номер телефона в профиле без СМС подтверждения to Mail.ru - 16 upvotes, $150
  223. XSS on https://www.delivery-club.ru to Mail.ru - 16 upvotes, $100
  224. Open Redirect to Mail.ru - 16 upvotes, $0
  225. Account takeover at geekbrains.ru to Mail.ru - 15 upvotes, $1500
  226. Gain access to random information via group chat "about" property to Mail.ru - 15 upvotes, $1000
  227. Stored XSS on {https://calendar.mail.ru/} to Mail.ru - 15 upvotes, $1000
  228. Same origin policy bypass on e.mail.ru via Cross-Site Flashing to Mail.ru - 15 upvotes, $750
  229. Blind Stored XSS to Mail.ru - 15 upvotes, $550
  230. XSS на странице account.mail.ru/recovery to Mail.ru - 15 upvotes, $500
  231. [pulse.mail.ru] Доступ к статистике чужих площадок to Mail.ru - 15 upvotes, $400
  232. Вывод значений переменных Nginx в теле страницы to Mail.ru - 15 upvotes, $300
  233. Cross-site Scripting (XSS) - Stored in ru.mail.mailapp to Mail.ru - 15 upvotes, $150
  234. idor leads to leak order information to Mail.ru - 15 upvotes, $150
  235. [cfire.mail.ru] CSRF Bypassed - Changing anyone's 'User Info' to Mail.ru - 15 upvotes, $0
  236. Stored XSS to Mail.ru - 15 upvotes, $0
  237. Reflected XSS on http://info.ucs.ru/settings/check/ to Mail.ru - 15 upvotes, $0
  238. Partner Account Takeover on https://www.delivery-club.ru через пользовательский аккаунт. to Mail.ru - 14 upvotes, $500
  239. Potential SSRF in sales.mail.ru to Mail.ru - 14 upvotes, $300
  240. XSS в нике при запросе в контакты. to Mail.ru - 14 upvotes, $250
  241. Make user buy items via clickjacking possibility to Mail.ru - 14 upvotes, $200
  242. IDOR on mcs.mail.ru to Mail.ru - 14 upvotes, $150
  243. BruteForce Any [My.com] Account Credentials. to Mail.ru - 14 upvotes, $100
  244. Reflected XSS on https://www.delivery-club.ru/ to Mail.ru - 14 upvotes, $100
  245. [element.mail.ru] /.svn/entries to Mail.ru - 14 upvotes, $0
  246. Cross site scripting vulnerability in JW Player SWF to Mail.ru - 14 upvotes, $0
  247. Bash History file log to Mail.ru - 14 upvotes, $0
  248. Race condition при покупке подарков на games.mail.ru to Mail.ru - 14 upvotes, $0
  249. Reflected XSS on am.ru and subdomains to Mail.ru - 14 upvotes, $0
  250. Subdomain Takeover to Mail.ru - 14 upvotes, $0
  251. Reflected XSS on https://deti.mail.ru to Mail.ru - 14 upvotes, $0
  252. XSS в теле письма, в новой версии почты. to Mail.ru - 13 upvotes, $1000
  253. SSRF на https://target.my.com/ to Mail.ru - 13 upvotes, $800
  254. Attacker can send requests from mail.ru server to Mail.ru - 13 upvotes, $800
  255. [supportlocal.delivery-club.ru] Subdomain Takeover to Mail.ru - 13 upvotes, $500
  256. CSRF на calendar.mail.ru to Mail.ru - 13 upvotes, $250
  257. XSS при добавлении в чат пользователя to Mail.ru - 13 upvotes, $250
  258. Modifying application settings via clickjacking on o2.mail.ru to Mail.ru - 13 upvotes, $150
  259. Path Traversal When Sharing with Cloud Mail.Ru App via a file with Crated Name to Mail.ru - 13 upvotes, $150
  260. [health.mail.ru] Раскрытие SSI сценариев to Mail.ru - 13 upvotes, $150
  261. MySQL username and password leaked on [2017.russianaicup.ru] to Mail.ru - 13 upvotes, $150
  262. lootdog.io XSS to Mail.ru - 13 upvotes, $100
  263. CSRF on lootdog.io to Mail.ru - 13 upvotes, $100
  264. Open Redirect on [My.com] to Mail.ru - 13 upvotes, $0
  265. 3rd party shop admin panel blind XSS to Mail.ru - 13 upvotes, $0
  266. [3k.mail.ru] - Content spoofing to Mail.ru - 13 upvotes, $0
  267. CSRF на лайк к отзыву (Pandao) to Mail.ru - 13 upvotes, $0
  268. Unrestricted File Upload To Xss Stored [ https://ideas.browser.mail.ru/ ] to Mail.ru - 13 upvotes, $0
  269. HTTP-Response-Splitting leads to information disclosure (email, firstname, lastname) at https://tz.mail.ru to Mail.ru - 13 upvotes, $0
  270. [geekbrains.ru] Reflected XSS via Angular Template Injection to Mail.ru - 13 upvotes, $0
  271. HTML/iframe/XSS injection on https://www.ucs.ru/online/shelter/settings/check/ to Mail.ru - 13 upvotes, $0
  272. Partner's manager can aсccess statistics of all drivers [city-mobil.ru/taxiserv] to Mail.ru - 12 upvotes, $1500
  273. Дубликат: https://hackerone.com/reports/219171 (доступ к аккаунту, через сброс пароля) to Mail.ru - 12 upvotes, $1000
  274. XSS в письме, в поле отправителя. to Mail.ru - 12 upvotes, $1000
  275. reflected XSS on healt.mail.ru to Mail.ru - 12 upvotes, $500
  276. Возможность залить шелл на https://widget.operator.mail.ru to Mail.ru - 12 upvotes, $500
  277. Launch Any Activity in MyMail App to Mail.ru - 12 upvotes, $500
  278. OOB XXE to Mail.ru - 12 upvotes, $500
  279. Android MailRu Email: Thirdparty can access private data files with small user interaction to Mail.ru - 12 upvotes, $300
  280. Publicly Accessible Harshi Corp Consul to Mail.ru - 12 upvotes, $300
  281. reflected xss on learn.city-mobil.ru via redirect_url parameter to Mail.ru - 12 upvotes, $300
  282. XSS в названии лайвчата to Mail.ru - 12 upvotes, $250
  283. Раскрытие серии/номера паспорта и снилс пользователя lootdog.io to Mail.ru - 12 upvotes, $250
  284. stored xss путём загрузки вредоносного файла + обход загрузки файлов. to Mail.ru - 12 upvotes, $200
  285. Code source discloure & ability to get database information "SQL injection" in [townwars.mail.ru] to Mail.ru - 12 upvotes, $150
  286. XSS at af.attachmail.ru to Mail.ru - 12 upvotes, $150
  287. filin.mail.ru user's e-mail address disclosure to Mail.ru - 12 upvotes, $150
  288. warofdragons.my.games: configuration files with database account are accessible to Mail.ru - 12 upvotes, $150
  289. api.icq.com / возможность присоединиться к любому чату (даже закрытому). to Mail.ru - 12 upvotes, $100
  290. Найден build.sh в webagent.mail.ru to Mail.ru - 12 upvotes, $100
  291. CRLF injection mcs.mail.ru (leads to XSS) to Mail.ru - 12 upvotes, $0
  292. [rm.mail.ru] Request-Path XSS to Mail.ru - 12 upvotes, $0
  293. XSS to Mail.ru - 12 upvotes, $0
  294. Full Path Disclosure to Mail.ru - 12 upvotes, $0
  295. RCE Jira(CVE-2019–11581) [my-com.atlassian.net] to Mail.ru - 12 upvotes, $0
  296. XSS in [community.my.games] to Mail.ru - 12 upvotes, $0
  297. Reflected XSS to Mail.ru - 12 upvotes, $0
  298. XSS в теле письма, в блочных стилях. to Mail.ru - 11 upvotes, $1000
  299. blind XXE when uploading avatar in mymail phone app to Mail.ru - 11 upvotes, $1000
  300. Reflected XSS on https://e.mail.ru/compose/ via Body parameter to Mail.ru - 11 upvotes, $1000
  301. mail.ru/touch xss(r) debug parameter to Mail.ru - 11 upvotes, $1000
  302. Xss в https://e.mail.ru/ to Mail.ru - 11 upvotes, $500
  303. [account.mail.ru] XSS на странице восстановления пароля to Mail.ru - 11 upvotes, $500
  304. Блокированный ящик ( Обход ) to Mail.ru - 11 upvotes, $500
  305. Stored Blind XSS to Mail.ru - 11 upvotes, $500
  306. [dobro.city-mobil.ru] Недостаточная аутентификация (доступ к панели администратора) to Mail.ru - 11 upvotes, $500
  307. Insufficient limitation of web page title leads to DoS against ICQ for Android to Mail.ru - 11 upvotes, $300
  308. [web.icq.com] Stored XSS in link when sending message to Mail.ru - 11 upvotes, $250
  309. Unsafe downloaded file execution to Mail.ru - 11 upvotes, $250
  310. Race condition на покупке призов за баллы to Mail.ru - 11 upvotes, $150
  311. NPM_API_KEY Leak to Mail.ru - 11 upvotes, $150
  312. [ICQ] nwwwstg-d01.ops.icq.com check mk agent exposed to public to Mail.ru - 11 upvotes, $150
  313. XSS on https://www.delivery-club.ru/sd/test_330933/info/ to Mail.ru - 11 upvotes, $100
  314. CSRF на покупку товара https://lootdog.io/ to Mail.ru - 11 upvotes, $100
  315. Stored self-XSS pubg.mail.ru в нескольких местах to Mail.ru - 11 upvotes, $0
  316. XSS через подгрузку ссылки. to Mail.ru - 11 upvotes, $0
  317. Disclosure of user email address and Deanonymization [mail.ru] + Blind | Stored XSS pets.mail.ru to Mail.ru - 11 upvotes, $0
  318. [moba.my.com] phpinfo, logs to Mail.ru - 11 upvotes, $0
  319. Open Redirect In passport.maps.me/logout/?next=//fb.com/ to Mail.ru - 11 upvotes, $0
  320. Stored self XSS at auto.mail.ru using add_review functionality to Mail.ru - 11 upvotes, $0
  321. xss while uploading a file to Mail.ru - 11 upvotes, $0
  322. HTML Injection at "city-mobil.ru" to Mail.ru - 11 upvotes, $0
  323. [city-mobil.ru/taxiserv/] SQLi at /taxiserv/requests path at driver_company param to Mail.ru - 10 upvotes, $3500
  324. XSS в письме, в теле письма. to Mail.ru - 10 upvotes, $2000
  325. Database read through provider misconfiguration to Mail.ru - 10 upvotes, $1000
  326. [panel.city-mobil.ru/admin/] Blind XSS via partner name (similar to #746505) to Mail.ru - 10 upvotes, $1000
  327. Xss в https://e.mail.ru/ to Mail.ru - 10 upvotes, $500
  328. Reflected XSS in https://e.mail.ru/ to Mail.ru - 10 upvotes, $500
  329. Отраженная XSS на cloud.mail.ru в URL в функционале создания и редактировании презентации. to Mail.ru - 10 upvotes, $500
  330. XSS bypass Script execute,Read any file,execute any javascript code--UXSS to Mail.ru - 10 upvotes, $500
  331. Хранимая XSS ( API ) to Mail.ru - 10 upvotes, $500
  332. SSRF на api.icq.net to Mail.ru - 10 upvotes, $500
  333. Users information leak at sbermarket.ru to Mail.ru - 10 upvotes, $400
  334. Server side request forgery to Mail.ru - 10 upvotes, $300
  335. Stored XSS in address on [corporate.city-mobil.ru] to Mail.ru - 10 upvotes, $300
  336. [authdl.mail.ru] Spoofing IP address to Mail.ru - 10 upvotes, $250
  337. Eval-based XSS in Game JS API (mailru.core.js) via cross-origin postMessage() to Mail.ru - 10 upvotes, $200
  338. Activities are not Protected and able to crash app using other app (Can Malware or third parry app). to Mail.ru - 10 upvotes, $150
  339. [et.mail.ru] ssrf 2 to Mail.ru - 10 upvotes, $150
  340. SSRF/XSPA [parapa.mail.ru] 2 to Mail.ru - 10 upvotes, $150
  341. Improper Restriction of Excessive Authentication Attempts at http://terrafoot.ru/login.php (Rate Limit bypass via IP Rotation) to Mail.ru - 10 upvotes, $150
  342. Disclosure of the account email by phone number on [corporate.city-mobil.ru] to Mail.ru - 10 upvotes, $150
  343. Exposed Git Repo at https://mini-app.delivery-club.ru to Mail.ru - 10 upvotes, $150
  344. IDOR in tender.mail.ru leading to Information Disclosure to Mail.ru - 10 upvotes, $0
  345. reflected xss on cycloferon.health.mail.ru to Mail.ru - 10 upvotes, $0
  346. CSRF на отправку вопроса на [games.mail.ru] to Mail.ru - 10 upvotes, $0
  347. unauthorized access to add admin endpoint to Mail.ru - 10 upvotes, $0
  348. vk.com profile page takeover on https://cabinet.am.ru/ to Mail.ru - 10 upvotes, $0
  349. Reflected XSS https://tracker.my.com to Mail.ru - 10 upvotes, $0
  350. [https://city-mobil.ru/taxiserv] IDOR leads to information disclosure to Mail.ru - 9 upvotes, $1500
  351. Source code and internal credentials disclosure to Mail.ru - 9 upvotes, $1000
  352. [xss] setTheme в ajax_attach_action to Mail.ru - 9 upvotes, $1000
  353. XSS on https://o2.mail.ru/jsapi/button via PostMessage to Mail.ru - 9 upvotes, $1000
  354. XSS в отправителе, БЕТА-версия почты to Mail.ru - 9 upvotes, $500
  355. XSS account.mail.ru in state JSON script to Mail.ru - 9 upvotes, $500
  356. Stealing Arbitrary Private Files of MyMail App to Mail.ru - 9 upvotes, $500
  357. Full Account Takeover Student Account In https://uchi.ru/signin/main/student/email to Mail.ru - 9 upvotes, $500
  358. Логи/sql запросы на http://mx36.ucs.ru/ и reflected XSS. to Mail.ru - 9 upvotes, $400
  359. Time-based sql-injection на https://puzzle.mail.ru to Mail.ru - 9 upvotes, $300
  360. Reflected XSS in city-mobil.ru/ to Mail.ru - 9 upvotes, $300
  361. XSS с помощью специально сформированного файла. to Mail.ru - 9 upvotes, $250
  362. XSS на e.mail.ru в мобильном приложении! to Mail.ru - 9 upvotes, $250
  363. XSS https://health.mail.ru/my/ через внешнее имя аккаунта to Mail.ru - 9 upvotes, $150
  364. Sidekiq Dashboard Publicly accessible at http://shopper.staging.instamart.ru/sidekiq/ to Mail.ru - 9 upvotes, $150
  365. Log files Leaked In mcsblog.ru to Mail.ru - 9 upvotes, $150
  366. IDOR zakazaka (состояние заказа и перезаказ) to Mail.ru - 9 upvotes, $150
  367. Account Takeover via Forgot Password Page at https://3k.mail.ru/send_password.php? to Mail.ru - 9 upvotes, $150
  368. CSRF на добавление товара на продажу to Mail.ru - 9 upvotes, $100
  369. Cross Site Request Forgery (CSRF) to Mail.ru - 9 upvotes, $0
  370. [realty.mail.ru] XSS, SSI Injection to Mail.ru - 9 upvotes, $0
  371. [pokerist.mail.ru] XSS Request-URI to Mail.ru - 9 upvotes, $0
  372. CSRF Send a message at street-combats.mail.ru to Mail.ru - 9 upvotes, $0
  373. Blind XSS pets.mail.ru/admin/ to Mail.ru - 9 upvotes, $0
  374. CSRF уязвимость позволяет взять беспроцентный кредит пользователю cfire.mail.ru to Mail.ru - 9 upvotes, $0
  375. Content spoofing в http://my.mail.ru/cgi-bin/app/paymentm to Mail.ru - 9 upvotes, $0
  376. Delete images of users with clickjacking in https://pw.mail.ru to Mail.ru - 9 upvotes, $0
  377. Reflected XSS with WAF Bypass https://pw.mail.ru to Mail.ru - 9 upvotes, $0
  378. Stored xss on https://go.mail.ru/ to Mail.ru - 9 upvotes, $0
  379. [my.games] Stored XSS via untrusted bucket to Mail.ru - 9 upvotes, $0
  380. [xss] passrestore на m/touch/tel to Mail.ru - 8 upvotes, $1000
  381. [myMail Android] Access to protected app components via RegistrationPhoneActivity to Mail.ru - 8 upvotes, $1000
  382. A manager of a determinate group of users still might have access to any user account from any group that he doesn't administrate anymore. to Mail.ru - 8 upvotes, $500
  383. XSS on account.mail.ru/login to Mail.ru - 8 upvotes, $500
  384. [account.mail.ru] XSS на странице удаления аккаунта через backUrl to Mail.ru - 8 upvotes, $500
  385. Stored self-xss and its escalation to a victim account in e.mail.ru to Mail.ru - 8 upvotes, $500
  386. Information Disclosure - Получаем доступ к работам и к приватным презентациям к курсам to Mail.ru - 8 upvotes, $300
  387. XSS when replying / forwarding to a malicious email on iOS to Mail.ru - 8 upvotes, $250
  388. easyXDM allows cross domain postmessaging with any origin, leaking sensitive info to Mail.ru - 8 upvotes, $250
  389. Blind SSRF on http://info.ucs.ru/settings/check/ to Mail.ru - 8 upvotes, $250
  390. Чтение системных данных приложения: данные для авторизации, логи, БД, личная переписка to Mail.ru - 8 upvotes, $150
  391. Possible to Upload Local Arbitrary Private File to the Cloud against User's Will to Mail.ru - 8 upvotes, $150
  392. Insecure Storage and Overly Permissive Google Maps API Key in Android App to Mail.ru - 8 upvotes, $150
  393. Http Response Splitting on thumb.cloud.mail.ru to Mail.ru - 8 upvotes, $150
  394. [api.my.games/social/chat/multi/add] Privilege escalation on adding new members to group chat to Mail.ru - 8 upvotes, $150
  395. HTML injection in an email [delivery.city-mobil.ru] to Mail.ru - 8 upvotes, $150
  396. CSRF Delete chat invitation link. to Mail.ru - 8 upvotes, $100
  397. [tanks.mail.ru] Internet Explorer XSS via Request-URI to Mail.ru - 8 upvotes, $0
  398. XSS in delivery club to Mail.ru - 8 upvotes, $0
  399. ДОБАВЛЕНИЕ СВОИХ ДАТ В КАЛЕНДАРЬ ПОЛЬЗОВАТЕЛЮ ! to Mail.ru - 8 upvotes, $0
  400. Double authentication bypass to Mail.ru - 8 upvotes, $0
  401. Full account takeover am.ru to Mail.ru - 8 upvotes, $0
  402. [lk-cdn.3igames.mail.ru] apc.php to Mail.ru - 8 upvotes, $0
  403. Reflected cross site scripting at https://auto.mail.ru/reviews/add_review/ via problems_text parameter. to Mail.ru - 8 upvotes, $0
  404. Seven DOM-Based XSS Vulnerabilities | Execution in Login Sequence to Mail.ru - 8 upvotes, $0
  405. XSS при загрузке изображения на [games.mail.ru] to Mail.ru - 8 upvotes, $0
  406. XSS via HTTP request version in account.my.games to Mail.ru - 8 upvotes, $0
  407. CSRF on https://market.my.games to Mail.ru - 8 upvotes, $0
  408. xss in ub.icq.net to Mail.ru - 8 upvotes, $0
  409. Subdomain Takeover at blog.instamart.ru to Mail.ru - 8 upvotes, $0
  410. [xss] перенаправление со старых url в почте to Mail.ru - 7 upvotes, $1000
  411. [xss] подмена content-type в загрузке лого к почте to Mail.ru - 7 upvotes, $1000
  412. Чтение файлов на сервере и раскрытие директорий mediator.media to Mail.ru - 7 upvotes, $800
  413. touch.mail.ru/messages - Stored XSS to Mail.ru - 7 upvotes, $750
  414. Possibility to view subdepartments for arbitrary domain to Mail.ru - 7 upvotes, $500
  415. XSS on e.mail.ru via postMessage to Mail.ru - 7 upvotes, $500
  416. XSS e.mail.ru fixSpecialSymbols to Mail.ru - 7 upvotes, $500
  417. [https://fleet.city-mobil.ru] Stored XSS into driver mailing to Mail.ru - 7 upvotes, $500
  418. Открытая админка Tarantool to Mail.ru - 7 upvotes, $500
  419. Получение гарантированного дохода и бонусов без фактического исполнения заказов, при этом используя аккаунты не существующих людей. to Mail.ru - 7 upvotes, $500
  420. [sso.33slona.ru] Application Messages Error stacktrace PHP. to Mail.ru - 7 upvotes, $400
  421. XSS via Cookie in e.mail.ru to Mail.ru - 7 upvotes, $350
  422. XXE крит to Mail.ru - 7 upvotes, $300
  423. Stored XSS and html injection in biz.mail.ru to Mail.ru - 7 upvotes, $250
  424. Information Disclosure [ https://curious.ru/api/submissions ] to Mail.ru - 7 upvotes, $250
  425. SSRF in www.ucs.ru to Mail.ru - 7 upvotes, $250
  426. Download attachments with traversal path into any sdcard directory (incomplete fix 106097) to Mail.ru - 7 upvotes, $200
  427. [lootdog.io] User phone number disclosure to Mail.ru - 7 upvotes, $200
  428. [cfire.mail.ru] Time Based SQL Injection 2 to Mail.ru - 7 upvotes, $200
  429. Stored Xss to Mail.ru - 7 upvotes, $200
  430. DOM based XSS via postMessage at store.my.games to Mail.ru - 7 upvotes, $200
  431. [upload-X.my.mail.ru] /uploadphoto Insecure Direct Object References to Mail.ru - 7 upvotes, $160
  432. Cross site scripting to Mail.ru - 7 upvotes, $150
  433. XSS at https://icq.com/people to Mail.ru - 7 upvotes, $150
  434. Возможность создать канал в группе, в которой пользователь не является админом [my.games] to Mail.ru - 7 upvotes, $150
  435. Пользователь может просматривать, удалять и изменять данные любой компании перебирая domain_id [biz.mail.ru] to Mail.ru - 7 upvotes, $150
  436. Брутфорс sms кода подтверждения для смены номера телефона в аккаунте LootDog. to Mail.ru - 7 upvotes, $150
  437. [files.ucs.ru] ProFTPd mod_copy Arbitrary Read/Write to Mail.ru - 7 upvotes, $150
  438. Открытая админка 1C эмулятора to Mail.ru - 7 upvotes, $150
  439. Загрузка png бомбы, которая начинает DDOS атаку на бота со Стикерами. to Mail.ru - 7 upvotes, $100
  440. [odnoklassniki.ru] XSS via Host to Mail.ru - 7 upvotes, $0
  441. [touch.lady.mail.ru] CRLF Injection to Mail.ru - 7 upvotes, $0
  442. [cooking.lady.mail.ru] Open Redirect to Mail.ru - 7 upvotes, $0
  443. Stored XSS using SVG on subdomain infra.mail.ru to Mail.ru - 7 upvotes, $0
  444. [info.tmgame.mail.ru] Apache Server Status to Mail.ru - 7 upvotes, $0
  445. Reflected XSS in delivery-club.ru to Mail.ru - 7 upvotes, $0
  446. CSRF on /subscription_manage.php endpoint at allods.mail.ru to Mail.ru - 7 upvotes, $0
  447. Reference to external uncontrolled resource in terrhq.ru to Mail.ru - 7 upvotes, $0
  448. PHP-FPM Status Page to Mail.ru - 7 upvotes, $0
  449. astrumnival.com subdomain to Mail.ru - 7 upvotes, $0
  450. Brute-force any email account through allods.mail.ru to Mail.ru - 7 upvotes, $0
  451. Broken twitter link hijacking at https://games.mail.ru/pc/search/ to Mail.ru - 7 upvotes, $0
  452. capsula.mail.ru - reflected xss to Mail.ru - 7 upvotes, $0
  453. Information Disclosure of Garbage Collection Cycle 'Again' to Mail.ru - 7 upvotes, $0
  454. [city-mobil.ru/taxiserv/] IDOR leads to driver account takeover to Mail.ru - 6 upvotes, $8000
  455. [combo.mail.ru] SMS code bruteforce to Mail.ru - 6 upvotes, $6000
  456. VERY DANGEROUS XSS STORED inside emails to Mail.ru - 6 upvotes, $600
  457. XSS уязвимость to Mail.ru - 6 upvotes, $500
  458. XSS touch.mail.ru compose Body to Mail.ru - 6 upvotes, $500
  459. [delivery.city-mobil.ru] Stored XSS into support request comment to Mail.ru - 6 upvotes, $300
  460. [connect.mail.ru] Memory Disclosure / IE XSS to Mail.ru - 6 upvotes, $250
  461. XSS ( Работа с письмами ) to Mail.ru - 6 upvotes, $250
  462. bgplay.mail.ru to Mail.ru - 6 upvotes, $200
  463. XSS в портальной навигации to Mail.ru - 6 upvotes, $150
  464. Unupdated ImageMagic leads to uninitialized server memory disclosure to Mail.ru - 6 upvotes, $150
  465. Mail.Ru Top - Website Counter Bruteforcing to Mail.ru - 6 upvotes, $150
  466. [c-api.city-mobil.ru] IDOR chat messages between driver and customer to Mail.ru - 6 upvotes, $150
  467. Ability to edit the address of any company by its id on [corporate.city-mobil.ru] to Mail.ru - 6 upvotes, $150
  468. SECRET_KEY Of Django Leaked In maps.me to Mail.ru - 6 upvotes, $150
  469. Логи на http://login.aa.mail.ru/logs/ to Mail.ru - 6 upvotes, $150
  470. Access admin interface via bad credentials to Mail.ru - 6 upvotes, $150
  471. Improper Restriction of Excessive Authentication Attempts via https://certification.mail.ru/auth-form/?form=auth_certy (Rate limit Bypass) to Mail.ru - 6 upvotes, $150
  472. Наблюдатель может оставновить базу данных [mcs.mail.ru] to Mail.ru - 6 upvotes, $150
  473. Local SQL Injection in Content Provider (ru.mail.data.contact.ContactsProvider) of Mail.ru for Android, version 12.2.0.29734 to Mail.ru - 6 upvotes, $150
  474. The auth token does not expire on logging out and even after logging out all sessions to Mail.ru - 6 upvotes, $100
  475. Раскрытие IP, почты и другой полезной информации lootdog.io to Mail.ru - 6 upvotes, $100
  476. Доступ к аккаунту после смены пароля. to Mail.ru - 6 upvotes, $100
  477. [rabota.mail.ru] Open Redirect to Mail.ru - 6 upvotes, $0
  478. [ml.money.mail.ru] Open Redirect to Mail.ru - 6 upvotes, $0
  479. [qpt.mail.ru] CRLF Injection / Open Redirect to Mail.ru - 6 upvotes, $0
  480. [otus.p.mail.ru] Full Path Disclosure to Mail.ru - 6 upvotes, $0
  481. Open Redirection at https://it.mail.ru/ to Mail.ru - 6 upvotes, $0
  482. Reflected XSS on frag.mail.ru to Mail.ru - 6 upvotes, $0
  483. xss на нескольких форумах игр от mail.ru (Cross-Site Scripting) to Mail.ru - 6 upvotes, $0
  484. CRLF инъекция на https://tz.mail.ru to Mail.ru - 6 upvotes, $0
  485. api.icq.com / возможность написать кому угодно (даже icqsystem) to Mail.ru - 6 upvotes, $0
  486. Хранимая XSS в пожертованиях на dobro.mail.ru to Mail.ru - 6 upvotes, $0
  487. [hs.mail.ru] XSS play_now.php to Mail.ru - 6 upvotes, $0
  488. [hs.mail.ru] CRLF Injection / XSS to Mail.ru - 6 upvotes, $0
  489. [gamesventures.mail.ru] Publicly accessible GIT directory to Mail.ru - 6 upvotes, $0
  490. [new.wf.mail.ru] XSS Request-URI to Mail.ru - 6 upvotes, $0
  491. [evo2.my.com] Internet Explorer XSS to Mail.ru - 6 upvotes, $0
  492. CSRF на загрузку изображения Pandao to Mail.ru - 6 upvotes, $0
  493. CSRF при вводе промокода на Pandao to Mail.ru - 6 upvotes, $0
  494. benchmark metrics available at 5.61.239.154 to Mail.ru - 6 upvotes, $0
  495. PHP-FPM Status Page to Mail.ru - 6 upvotes, $0
  496. XSS на сайте https://warofdragons.my.games/. to Mail.ru - 6 upvotes, $0
  497. Stored XSS on go.mail.ru to Mail.ru - 6 upvotes, $0
  498. Open Redirect at "city-mobil.ru" to Mail.ru - 6 upvotes, $0
  499. Subdomain Takeover at analyticstest.geekbrains.ru to Mail.ru - 6 upvotes, $0
  500. [aw.mail.ru] XSS on /quiztank page to Mail.ru - 6 upvotes, $0
  501. [MY.GAMES] XSS в мессенджере to Mail.ru - 6 upvotes, $0
  502. Subdomain takeover http://promo.instamart.ru/ to Mail.ru - 6 upvotes, $0
  503. Private files exposed to other apps to Mail.ru - 5 upvotes, $1000
  504. Insecure storage of private files to Mail.ru - 5 upvotes, $1000
  505. [Mail.Ru for Android] Replacing "Add filter" screen by malicious screen to Mail.ru - 5 upvotes, $1000
  506. OOB XXE to Mail.ru - 5 upvotes, $500
  507. Public access to Sidekiq dashboard at shopper.sbermarket.ru to Mail.ru - 5 upvotes, $500
  508. В самокате можно просматривать и изменять данные любого заказа без авторизации to Mail.ru - 5 upvotes, $400
  509. Improper Restriction of Excessive Authentication Attempts at https://ucs.ru/login to Mail.ru - 5 upvotes, $400
  510. Customer domain information disclosure at https://biz.mail.ru/api/domains/* to Mail.ru - 5 upvotes, $350
  511. Uninitilized server memory disclosure via ImageMagick to Mail.ru - 5 upvotes, $300
  512. sql to Mail.ru - 5 upvotes, $300
  513. Mail.ru for Android Content Provider Vulnerability to Mail.ru - 5 upvotes, $250
  514. CSRF. Удаление адресной книги, добавление контактов to Mail.ru - 5 upvotes, $250
  515. [my.mail.ru] CRLF Injection to Mail.ru - 5 upvotes, $160
  516. [townwars.mail.ru] Time-Based SQL Injection to Mail.ru - 5 upvotes, $150
  517. By pass admin panel [seminars.mail.ru] to Mail.ru - 5 upvotes, $150
  518. invalid handling of redirect_uri at o2.mail.ru/jsapi/button to Mail.ru - 5 upvotes, $150
  519. [parapa.mail.ru] SQL Injection reapet to Mail.ru - 5 upvotes, $150
  520. В самокат имеется возможность просмотра суммы заказа и номера заказа по ID [smart.space] to Mail.ru - 5 upvotes, $150
  521. This Github Repository Seems Leaking "nino.samokat.ru" Source Code to Mail.ru - 5 upvotes, $150
  522. todo.mail.ru open .git to Mail.ru - 5 upvotes, $150
  523. XSS на странице "Платежи водителей" [city-mobil.ru/taxiserv] to Mail.ru - 5 upvotes, $150
  524. Disclosure of information on static.dl.mail.ru to Mail.ru - 5 upvotes, $0
  525. [w1.dwar.ru] Core Dump to Mail.ru - 5 upvotes, $0
  526. [gitmm.corp.mail.ru] Auth Bypass, Information Disclosure to Mail.ru - 5 upvotes, $0
  527. Open Redirect to Mail.ru - 5 upvotes, $0
  528. Monitor to Mail.ru - 5 upvotes, $0
  529. Открытое перенапровление на OpenID to Mail.ru - 5 upvotes, $0
  530. api.icq.com / возможность отредактировать текст любого пользователя или группы переслав его. to Mail.ru - 5 upvotes, $0
  531. Открытая информация phpinfo() на сайте https://agent.mail.ru to Mail.ru - 5 upvotes, $0
  532. Local paths disclosure through error message to Mail.ru - 5 upvotes, $0
  533. CSRF на biz.mail.ru to Mail.ru - 5 upvotes, $0
  534. [sj.my.com] Source Code Disclosure /.svn/wc.db to Mail.ru - 5 upvotes, $0
  535. [sputnik.mail.ru] Publicly accessible GIT directory to Mail.ru - 5 upvotes, $0
  536. [FG-VD-17-115] Mail.ru's Amigo Browser DLL Pre-Loading Vulnerability Notification to Mail.ru - 5 upvotes, $0
  537. [auto.mail.ru] IDOR на редактирование поста любого юзера. to Mail.ru - 5 upvotes, $0
  538. Public available Sensitive Information about drivers to Mail.ru - 5 upvotes, $0
  539. [v7lk.relap.io] Sending arbitrary emails to any user to Mail.ru - 5 upvotes, $0
  540. Reflected XSS in "keywords" parameter at "https://sbermarket.ru/metro/search" to Mail.ru - 5 upvotes, $0
  541. [self?] XSS в адресе пользователя [sbermarket.ru] to Mail.ru - 5 upvotes, $0
  542. REFLECTED XSS On http://jsgames.mail.ru/bad_browser.php via back_url paramter to Mail.ru - 5 upvotes, $0
  543. the same as #948259 - XSS at jsgames.mail.ru to Mail.ru - 5 upvotes, $0
  544. CSRF in updating username https://pw.mail.ru/ to Mail.ru - 5 upvotes, $0
  545. subdomain Takeover to Mail.ru - 5 upvotes, $0
  546. XSS via "gp" cookie reflected in source code to Mail.ru - 4 upvotes, $1000
  547. Пользователь может изменить способ оплаты указав чужой corporation ID to Mail.ru - 4 upvotes, $1000
  548. Same Origin Policy bypass to Mail.ru - 4 upvotes, $600
  549. mrgs.my.games account takeover to Mail.ru - 4 upvotes, $500
  550. [https://youdrive.today/] Nginx directory traversal to Mail.ru - 4 upvotes, $400
  551. Self-xss via drag&drop in email form to Mail.ru - 4 upvotes, $300
  552. HTML Injection на e.mail.ru to Mail.ru - 4 upvotes, $250
  553. Раскрытие информации о совершенных операциях to Mail.ru - 4 upvotes, $250
  554. Improper Restriction of Excessive Authentication Attempts at o2-ac.my.com/token to Mail.ru - 4 upvotes, $150
  555. OTP bypass on user account deletion to Mail.ru - 4 upvotes, $150
  556. This Github Repository Seems Leaking Samokat Django Project to Mail.ru - 4 upvotes, $150
  557. [my.mail.ru] HTML injection в письмах от myadmin@corp.mail.ru to Mail.ru - 4 upvotes, $100
  558. [online.games.mail.ru] - Sensitive information disclosure to Mail.ru - 4 upvotes, $100
  559. ssl cookkie without secure flag set to Mail.ru - 4 upvotes, $100
  560. Reflected XSS connect.mail.ru (IE6-IE8) to Mail.ru - 4 upvotes, $0
  561. Back Refresh Attack after registration and successful logout to Mail.ru - 4 upvotes, $0
  562. [opensource.mail.ru] system accounts enumeration to Mail.ru - 4 upvotes, $0
  563. Full Path Disclosure to Mail.ru - 4 upvotes, $0
  564. [mrgs.mail.ru] Internet Explorer XSS via Request-URI to Mail.ru - 4 upvotes, $0
  565. [3k.mail.ru] Content Spoofing to Mail.ru - 4 upvotes, $0
  566. [allods.my.com] Full Path Disclosure to Mail.ru - 4 upvotes, $0
  567. [otus.p.mail.ru] CRLF Injection to Mail.ru - 4 upvotes, $0
  568. [allods.mail.ru] Cross-Site Request Forgery (Add-Item) to Mail.ru - 4 upvotes, $0
  569. Open Redirect to Mail.ru - 4 upvotes, $0
  570. [allods.mail.ru] Reflected XSS to Mail.ru - 4 upvotes, $0
  571. Reflected XSS на https://aw.mail.ru/news/ to Mail.ru - 4 upvotes, $0
  572. Clickjacking Full account takeover and editing the personal information at [account.my.com] to Mail.ru - 4 upvotes, $0
  573. [afisha.mail.ru] HTML-инъекция через XSS на портале виджета to Mail.ru - 4 upvotes, $0
  574. [maps.me] Reflected XSS to Mail.ru - 4 upvotes, $0
  575. api.icq.com / отсутсвие лимита на отправку сообщений удаляя параметр защиты "&r" to Mail.ru - 4 upvotes, $0
  576. [target.my.com] CRLF Injection -> XSS to Mail.ru - 4 upvotes, $0
  577. [beta.tracker.my.com] XSS Request-URI to Mail.ru - 4 upvotes, $0
  578. CSRF на удаление товара из корзины to Mail.ru - 4 upvotes, $0
  579. XSS to Mail.ru - 4 upvotes, $0
  580. xss to Mail.ru - 4 upvotes, $0
  581. Rails application running in development mode to Mail.ru - 4 upvotes, $0
  582. self XSS на странице https://aw.mail.ru/pin/ to Mail.ru - 4 upvotes, $0
  583. Открытые сорцы to Mail.ru - 4 upvotes, $0
  584. mailgun subdomain takeover on "email.mail.geekbrains.ru" to Mail.ru - 4 upvotes, $0
  585. Information Disclosure on {http://pro.tracker.my.com} to Mail.ru - 4 upvotes, $0
  586. [capsula.mail.ru] overriding order info to Mail.ru - 4 upvotes, $0
  587. relap.io CSRF bypass on adding domain to use relap widgets to Mail.ru - 4 upvotes, $0
  588. xss on [storehouse5.ucs.ru] to Mail.ru - 4 upvotes, $0
  589. XXE and SSRF on webmaster.mail.ru to Mail.ru - 3 upvotes, $700
  590. Ошибка фильтрации to Mail.ru - 3 upvotes, $500
  591. Admin panel access restrictions bypass [poll.mail.ru/admin/] to Mail.ru - 3 upvotes, $500
  592. [e.mail.ru] XSS на странице отправки денежного перевода to Mail.ru - 3 upvotes, $500
  593. XSS in https://e.mail.ru/cgi-bin/lstatic (Limited use) to Mail.ru - 3 upvotes, $400
  594. [s.mail.ru] CRLF Injection to Mail.ru - 3 upvotes, $250
  595. OpenSSL HeartBleed (CVE-2014-0160) to Mail.ru - 3 upvotes, $200
  596. SSRF/XSPA [parapa.mail.ru] to Mail.ru - 3 upvotes, $150
  597. Possible tokens leak on ws-app.city-mobil.ru to Mail.ru - 3 upvotes, $150
  598. [icq.com/people/uin/edit] Отсутствует фильтр и проверка на дубли в поле "Никнейм" to Mail.ru - 3 upvotes, $150
  599. Content injection on shared event (calendar.mail.ru) to Mail.ru - 3 upvotes, $150
  600. Возможность просмотра коментариев к чужим обращениям [corporate.city-mobil.ru] to Mail.ru - 3 upvotes, $150
  601. Clickjacking Vulnerability via https://webagent.mail.ru leading to protection bypass for https://web.icq.com/ end point to Mail.ru - 3 upvotes, $150
  602. Theft of Arbitrary file to Mail.ru - 3 upvotes, $150
  603. ICQ Windows Application is Vulnerable to DLL Search Order Hijacking to Mail.ru - 3 upvotes, $100
  604. Admin panel of http://tp-test1.corp.mail.ru/ is acccessible publicly to Mail.ru - 3 upvotes, $0
  605. Авторизуюсь от имени любого пользователя parapa.mail.ru to Mail.ru - 3 upvotes, $0
  606. [tz.mail.ru] XSS в функционале авторизации to Mail.ru - 3 upvotes, $0
  607. [corp.mail.ru] CRLF Injection / Insecure nginx configuration to Mail.ru - 3 upvotes, $0
  608. [support.my.com] Internet Explorer XSS to Mail.ru - 3 upvotes, $0
  609. [torg.mail.ru] CRLF Injection to Mail.ru - 3 upvotes, $0
  610. Stored XSS на street-combats.mail.ru to Mail.ru - 3 upvotes, $0
  611. [api.login.icq.net] Open Redirect to Mail.ru - 3 upvotes, $0
  612. [api.login.icq.net] Reflected XSS to Mail.ru - 3 upvotes, $0
  613. [opensource.mail.ru] Debug Mode to Mail.ru - 3 upvotes, $0
  614. [allods.my.com] Full SQL Disclosure to Mail.ru - 3 upvotes, $0
  615. [it.mail.ru] Open Redirect to Mail.ru - 3 upvotes, $0
  616. Reflected XSS on hi-tech.mail.ru to Mail.ru - 3 upvotes, $0
  617. Reflected XSS. to Mail.ru - 3 upvotes, $0
  618. Apache Server-Status Detected to Mail.ru - 3 upvotes, $0
  619. Logical Vulnerability : REDIRECTING on pw.mail.ru by Parameter Spoofing to Mail.ru - 3 upvotes, $0
  620. [tanks.mail.ru] Open Redirect to Mail.ru - 3 upvotes, $0
  621. Stored XSS на странице pubg.mail.ru/community to Mail.ru - 3 upvotes, $0
  622. Множественные уязвимости приложения Mail.Ru Почта (Android) to Mail.ru - 3 upvotes, $0
  623. Phpinfo to Mail.ru - 3 upvotes, $0
  624. Открытая панель to Mail.ru - 3 upvotes, $0
  625. Settings page in https://support.my.com is vulnerable to clickjacking to Mail.ru - 3 upvotes, $0
  626. Ability to find out the name of the database table and its columns to Mail.ru - 3 upvotes, $0
  627. Cross-Site Request Forgery (CSRF) in my.games API to Mail.ru - 3 upvotes, $0
  628. XSS on https://deti.mail.ru/ to Mail.ru - 3 upvotes, $0
  629. Collected Telegraf Matrics Accessible to Mail.ru - 3 upvotes, $0
  630. Cross-Site Request Forgery (CSRF) in comment update - api.my.games to Mail.ru - 3 upvotes, $0
  631. information disclosure via IDOR on "https://target.my.com/api/v2/coverage/segment.json?id={id}" endpoint to Mail.ru - 3 upvotes, $0
  632. Vertical Privilege Escalation on {target.my.com} to Mail.ru - 3 upvotes, $0
  633. looch.tv CORS crossite user information and stream_key access to Mail.ru - 3 upvotes, $0
  634. FLV FILE FORMAT (AUDIOSES.DLL) Out of Bounds to Mail.ru - 2 upvotes, $500
  635. [babel.mail.ru] Admin Page Found to Mail.ru - 2 upvotes, $400
  636. Access to git & and configuration files on backtoschool.geekbrains.ru via gitfile to Mail.ru - 2 upvotes, $400
  637. connect.mail.ru: SSRF to Mail.ru - 2 upvotes, $300
  638. [orsotenslimselfie.lady.mail.ru] SQL Injection to Mail.ru - 2 upvotes, $300
  639. SQL injection update.mail.ru to Mail.ru - 2 upvotes, $250
  640. SQL inj to Mail.ru - 2 upvotes, $150
  641. [tidaltrek.mail.ru] SQL Injection to Mail.ru - 2 upvotes, $150
  642. By pass admin panel [conference.mail.ru] to Mail.ru - 2 upvotes, $150
  643. ssrf xspa [https://prt.mail.ru/] to Mail.ru - 2 upvotes, $150
  644. Improper Restriction of Excessive Authentication Attempts at https://api.warrobots.com/auth (Pixonic Games) to Mail.ru - 2 upvotes, $150
  645. Clickjacking Vulnerability via https://www.donationalerts.com/help/support leads to bypass for widget.support.my.games X-Frame Options to Mail.ru - 2 upvotes, $150
  646. Google API Key is not restricted for specific application package name and signature [Mail.ru Cloud for Android] to Mail.ru - 2 upvotes, $150
  647. No bruteforce protection leads to enumeration of emails in http://e.mail.ru/ to Mail.ru - 2 upvotes, $100
  648. Login without SSL-Protection to Mail.ru - 2 upvotes, $0
  649. Flash XSS in http://go.mail.ru to Mail.ru - 2 upvotes, $0
  650. Flash XSS in http://lingvo.mail.ru to Mail.ru - 2 upvotes, $0
  651. Раскрытие полного серверного пути to Mail.ru - 2 upvotes, $0
  652. tp-demo1.corp.mail.ru: SVN наружу торчит to Mail.ru - 2 upvotes, $0
  653. https://voip.agent.mail.ru/phpinfo.php to Mail.ru - 2 upvotes, $0
  654. [start.icq.com] Reflected XSS via Cookies to Mail.ru - 2 upvotes, $0
  655. Vulnerability :- "XSS vulnerability" to Mail.ru - 2 upvotes, $0
  656. [ling.go.mail.ru] Server-Status opened for all users to Mail.ru - 2 upvotes, $0
  657. Reflected XSS на games.mail.ru to Mail.ru - 2 upvotes, $0
  658. [sales.mail.ru] CRLF Injection to Mail.ru - 2 upvotes, $0
  659. AXFR на plexus.m.smailru.net работает to Mail.ru - 2 upvotes, $0
  660. BRUTE FORCE ATTACK to Mail.ru - 2 upvotes, $0
  661. Reflected XSS. to Mail.ru - 2 upvotes, $0
  662. Излишние права при авторизации через интерфейс mail.ru to Mail.ru - 2 upvotes, $0
  663. [warofdragons.com] Content Spoofing to Mail.ru - 2 upvotes, $0
  664. [s2.jugger.ru] Content Spoofing to Mail.ru - 2 upvotes, $0
  665. [tanks.mail.ru] Content Spoofing to Mail.ru - 2 upvotes, $0
  666. [aw.my.com] Reflected XSS to Mail.ru - 2 upvotes, $0
  667. Clickjacking Vulnerability on https://support.my.com/games/ticket/xxxx/ to Mail.ru - 2 upvotes, $0
  668. DNS Misconfiguration to Mail.ru - 2 upvotes, $0
  669. XSS on New contact to Mail.ru - 2 upvotes, $0
  670. ssl cookie without secure flag set to Mail.ru - 2 upvotes, $0
  671. Открытый .htaccess на cookery.zakazaka.ru to Mail.ru - 2 upvotes, $0
  672. xss to Mail.ru - 2 upvotes, $0
  673. Stored XSS at branded site in .mail.ru domain to Mail.ru - 2 upvotes, $0
  674. donationalerts.com limitations bypass to Mail.ru - 2 upvotes, $0
  675. [staging.tarantool.org] Github Pages Subdomain-take-over to Mail.ru - 2 upvotes, $0
  676. CRLF Injection in 301 Redirect allow to Set-Cookies for mail.ru to Mail.ru - 2 upvotes, $0
  677. Improper access control leading to deletion of Greeting videos on {https://smtp.8mar.mail.ru/} to Mail.ru - 2 upvotes, $0
  678. SMTP Header Injection at http://abonement.ucs.ru to Mail.ru - 2 upvotes, $0
  679. tracker.my.com information disclosure via csrf bypass to Mail.ru - 2 upvotes, $0
  680. Subdomain takeover at msproject.geekbrains.ru to Mail.ru - 2 upvotes, $0
  681. Bypass OTP on contact back request at https://driver.city-mobil.ru/ to Mail.ru - 2 upvotes, $0
  682. IDOR позволяет изменить информацию о пользователе. to Mail.ru - 2 upvotes, $0
  683. [garnier-olia.lady.mail.ru] Reflected XSS /exp/ bypass "/" to Mail.ru - 2 upvotes, $0
  684. [api.33slona.ru] Доступ к API из за неправильной конфигурации сервера 302 редирет. to Mail.ru - 2 upvotes, $0
  685. Information Disclosure on qa-delivery-srv.plazius.ru to Mail.ru - 2 upvotes, $0
  686. Information Disclosure on www7.promo.plazius.ru to Mail.ru - 2 upvotes, $0
  687. e.mail.ru: File upload "Chapito" circus to Mail.ru - 1 upvotes, $1000
  688. touch.mail.ru XSS via message id to Mail.ru - 1 upvotes, $500
  689. XSS: https://light.mail.ru/compose, https://m.mail.ru/compose/[id]/reply при ответе на специальным образом сформированное письмо to Mail.ru - 1 upvotes, $500
  690. reflected in xss to Mail.ru - 1 upvotes, $500
  691. e.mail.ru: SMS spam with custom content to Mail.ru - 1 upvotes, $400
  692. store-agent.mail.ru: stacked blind injection to Mail.ru - 1 upvotes, $400
  693. Stored XSS on http://top.mail.ru to Mail.ru - 1 upvotes, $300
  694. RCE через JDWP to Mail.ru - 1 upvotes, $300
  695. Home page reflected XSS to Mail.ru - 1 upvotes, $250
  696. SSRF на element.mail.ru to Mail.ru - 1 upvotes, $250
  697. "blog.skillfactory.ru" Vulnerable to Directory Traversal to Mail.ru - 1 upvotes, $250
  698. tt-mac.i.mail.ru: Quagga 0.99.23.1 (Router) : Default password and default enable password to Mail.ru - 1 upvotes, $200
  699. Clickjacking to Mail.ru - 1 upvotes, $150
  700. SQL to Mail.ru - 1 upvotes, $150
  701. SQL inj to Mail.ru - 1 upvotes, $150
  702. SQL Injection on 11x11.mail.ru to Mail.ru - 1 upvotes, $150
  703. localStorage не чистится после выхода to Mail.ru - 1 upvotes, $150
  704. Stored XSS on http://cards.mail.ru to Mail.ru - 1 upvotes, $150
  705. scfbp.tng.mail.ru: Heartbleed to Mail.ru - 1 upvotes, $150
  706. [parapa.mail.ru] SQL Injection to Mail.ru - 1 upvotes, $150
  707. [3k.mail.ru] SQL Injection to Mail.ru - 1 upvotes, $150
  708. SQL Injection to Mail.ru - 1 upvotes, $150
  709. [tidaltrek.mail.ru] SQL Injection to Mail.ru - 1 upvotes, $150
  710. This Github Repository Seems Leaking Incoming Samokat Project to Mail.ru - 1 upvotes, $150
  711. Exposed Credentials May Leads to Tarantool Infrastructure Leak to Mail.ru - 1 upvotes, $150
  712. Раскрытие номера мобильного телефона при двухфакторной аутентификации to Mail.ru - 1 upvotes, $100
  713. Unproper usage of Mobile Number that will lead to Information Disclosure to Mail.ru - 1 upvotes, $0
  714. Persistent XSS in afisha.mail.ru to Mail.ru - 1 upvotes, $0
  715. Flash XSS - http://hi-tech.mail.ru/ to Mail.ru - 1 upvotes, $0
  716. XSS in "About Video" to Mail.ru - 1 upvotes, $0
  717. Reflected XSS to Mail.ru - 1 upvotes, $0
  718. rs.mail.ru - Flash Based XSS to Mail.ru - 1 upvotes, $0
  719. Version Disclosure (NginX) to Mail.ru - 1 upvotes, $0
  720. Content Spoofing vulnerability in Mail.ru mobile to Mail.ru - 1 upvotes, $0
  721. Перечисление каталогов за счёт уязвимости в IIS to Mail.ru - 1 upvotes, $0
  722. files.mail.ru: XSS to Mail.ru - 1 upvotes, $0
  723. Не уверен, что этому место на периметре: 94.100.180.95, 94.100.180.96, 94.100.180.97, 94.100.180.98 to Mail.ru - 1 upvotes, $0
  724. /surveys/2auth: DOM-based XSS to Mail.ru - 1 upvotes, $0
  725. help2.m.smailru.net: XSS to Mail.ru - 1 upvotes, $0
  726. Reflective Xss on news.mail.ru and admin.news.mail.ru to Mail.ru - 1 upvotes, $0
  727. Выполнение кода PHP через FastCGI to Mail.ru - 1 upvotes, $0
  728. Flash XSS на old.corp.mail.ru to Mail.ru - 1 upvotes, $0
  729. Multiple vulnerabilities in mail.ru subdomains to Mail.ru - 1 upvotes, $0
  730. Insecure cookies without httpOnly flag set to Mail.ru - 1 upvotes, $0
  731. Утечка информации через JSONP (XXSI) to Mail.ru - 1 upvotes, $0
  732. Reflected XSS @ games.mail.ru to Mail.ru - 1 upvotes, $0
  733. Обход basic авторизации [qpt.mail.ru] to Mail.ru - 1 upvotes, $0
  734. [legal.my.com] Reflected XSS to Mail.ru - 1 upvotes, $0
  735. [allods.my.com] Reflected XSS to Mail.ru - 1 upvotes, $0
  736. [id.my.com] Reflected XSS to Mail.ru - 1 upvotes, $0
  737. [furry.aw.my.com] Reflected XSS to Mail.ru - 1 upvotes, $0
  738. [evo2.my.com] Reflected XSS to Mail.ru - 1 upvotes, $0
  739. [evo.my.com] Reflected XSS to Mail.ru - 1 upvotes, $0
  740. [mg.my.com] Reflected XSS to Mail.ru - 1 upvotes, $0
  741. [support.my.com] Reflected XSS to Mail.ru - 1 upvotes, $0
  742. [wos.my.com] Reflected XSS to Mail.ru - 1 upvotes, $0
  743. [account.my.com] Reflected XSS to Mail.ru - 1 upvotes, $0
  744. [lucky-fields.my.com] Reflected XSS to Mail.ru - 1 upvotes, $0
  745. [sf.my.com] Reflected XSS to Mail.ru - 1 upvotes, $0
  746. [games.my.com] Reflected XSS to Mail.ru - 1 upvotes, $0
  747. [dl.beepcar.ru] CRLF Injection to Mail.ru - 1 upvotes, $0
  748. Cross-Site Request Forgery to Mail.ru - 1 upvotes, $0
  749. сервант статус to Mail.ru - 1 upvotes, $0
  750. phpinfo to Mail.ru - 1 upvotes, $0
  751. XSS to Mail.ru - 1 upvotes, $0
  752. [performancemarketing.geekbrains.ru] Tilda Subdomain Takeover to Mail.ru - 1 upvotes, $0
  753. XSS via .eml file to Mail.ru - 0 upvotes, $1337
  754. https://217.69.135.63/rb/: money.mail.ru sources disclosure to Mail.ru - 0 upvotes, $1000
  755. XSS in a file or folder name to Mail.ru - 0 upvotes, $500
  756. e.mail.ru stored XSS in agent via sticker (smile) to Mail.ru - 0 upvotes, $500
  757. auth.mail.ru: XSS in login form to Mail.ru - 0 upvotes, $500
  758. http://fitter1.i.mail.ru/browser/ торчит Graphite в мир to Mail.ru - 0 upvotes, $400
  759. lenta_proxy information disclosure to Mail.ru - 0 upvotes, $400
  760. [api.allodsteam.com] Authentication Data to Mail.ru - 0 upvotes, $300
  761. [afisha.mail.ru] SQL Injection to Mail.ru - 0 upvotes, $300
  762. SQL injection [дырка в движке форума] to Mail.ru - 0 upvotes, $200
  763. Time based sql injection to Mail.ru - 0 upvotes, $200
  764. Possible xWork classLoader RCE: shared.mail.ru to Mail.ru - 0 upvotes, $200
  765. Stored XSS through fileupload to Mail.ru - 0 upvotes, $200
  766. money.mail.ru: Странное поведение SMS to Mail.ru - 0 upvotes, $150
  767. cloud.mail.ru: File upload XSS using Content-Type header to Mail.ru - 0 upvotes, $150
  768. Heartbleed: my.com (185.30.178.33) port 1433 to Mail.ru - 0 upvotes, $150
  769. HDFS NameNode Public disclosure: http://185.5.139.33:50070/dfshealth.jsp to Mail.ru - 0 upvotes, $150
  770. Hadoop Node available to public to Mail.ru - 0 upvotes, $150
  771. http://tp-dev1.tp.smailru.net/ to Mail.ru - 0 upvotes, $150
  772. [cfire.mail.ru] Time Based SQL Injection to Mail.ru - 0 upvotes, $150
  773. [allods.my.com] SSRF / XSPA to Mail.ru - 0 upvotes, $150
  774. Time-Based Blind SQL Injection Attacks to Mail.ru - 0 upvotes, $150
  775. Пользователь с правами Менеджер может получить Список сотрудников всех кост центров и Удалять пользователей всех кост центров to Mail.ru - 0 upvotes, $150
  776. m.agent.mail.ru: Подделываем j2me app-descriptor to Mail.ru - 0 upvotes, $100
  777. No CSRF token used in Phone Verification POST to Mail.ru - 0 upvotes, $0
  778. Xss On http://my.mail.ru/ to Mail.ru - 0 upvotes, $0
  779. Clicjacking on Login panel to Mail.ru - 0 upvotes, $0
  780. Reflected XSS to Mail.ru - 0 upvotes, $0
  781. Reflected XSS in User-Agent to Mail.ru - 0 upvotes, $0
  782. (m.mail.ru) Password type input with auto-complete enabled to Mail.ru - 0 upvotes, $0
  783. Раскрытие путей сервера за счёт неопределённого индекса в сценарии /home/berserk-online.com/public_html/forum/Themes/berserker/Profile.template.php to Mail.ru - 0 upvotes, $0
  784. Нежелательная информация to Mail.ru - 0 upvotes, $0
  785. XSS Vulnerability in cfire.mail.ru/screen/1/ to Mail.ru - 0 upvotes, $0
  786. XSS in realty.mail.ru to Mail.ru - 0 upvotes, $0
  787. XSS in ad.mail.ru to Mail.ru - 0 upvotes, $0
  788. XSS in touch.sports.mail.ru to Mail.ru - 0 upvotes, $0
  789. api.video.mail.ru: XSS to Mail.ru - 0 upvotes, $0
  790. touch.afisha.mail.ru: XSS to Mail.ru - 0 upvotes, $0
  791. my.mail.ru: HTTP Header Injection to Mail.ru - 0 upvotes, $0
  792. target.mail.ru: XSS через Referer to Mail.ru - 0 upvotes, $0
  793. target.mail.ru: XSS to Mail.ru - 0 upvotes, $0
  794. files.mail.ru: HTTP Header Injection to Mail.ru - 0 upvotes, $0
  795. 3k.mail.ru: XSS to Mail.ru - 0 upvotes, $0
  796. http://217.69.136.200/?p=2&c=Fetcher%20cluster&h=fetcher1.mail.ru to Mail.ru - 0 upvotes, $0
  797. GET /surveys/2auth: XSS to Mail.ru - 0 upvotes, $0
  798. [riot.mail.ru] Reflected XSS in debug-mode to Mail.ru - 0 upvotes, $0
  799. Flash XSS on img.mail.ru to Mail.ru - 0 upvotes, $0
  800. XSS at forum : to Mail.ru - 0 upvotes, $0
  801. Cross Site Scripting to Mail.ru - 0 upvotes, $0
  802. Получаем все домены и поддомены icq с помощью amazonaws.com [config,txt] to Mail.ru - 0 upvotes, $0
  803. пхпинфо to Mail.ru - 0 upvotes, $0
  804. SVN repository to Mail.ru - 0 upvotes, $0
  805. Self XSS via help.mail.ru interface to Mail.ru - 0 upvotes, $0
  806. Information Disclosure to Mail.ru - 0 upvotes, $0
  807. Information Disclosure to Mail.ru - 0 upvotes, $0

Back