It was possible to disclosure the part of server memory from uncontrolled location on the server belonging to “Moi Mir” (my.mail.ru) project via uploaded GIF image header manipulation.
my.mail.ru is not currently in the Bug Bounty scope, reward was paid as a bonus due to potential severity.