monetha / bug-bounty Goto Github PK
View Code? Open in Web Editor NEWThe Monetha Bug Bounty Program provides bounties for vulnerability bugs.
The Monetha Bug Bounty Program provides bounties for vulnerability bugs.
click.mlsend.com supports https. Update links in the newsletter to HTTPS.
The Return url after purchase (optional) parameter does not check for the url scheme. By using a scheme such as javascript, an attacker is able to register an attack payload that executes arbitrary javascript.
https://github.com/monetha/TrustReputationSmartContracts/blob/master/contracts/Restricted.sol
Issue:
Restricted.sol does not provide a method to make a monethaAddress
mapping false. It is unclear whether multiple monethaAddresses
should be valid at once, though from the choice to use a map it seems so. However, there is no way to remove an address from the mapping. If there is ever a compromise of a monethaAddress
, deployed contracts will remain vulnerable indefinitely.
Fix:
If the intent is for there to be a single valid monethaAddress
, use an address instead of a mapping.
If the intent is for there to be multiple monethaAddress
es, provide a method for setting addresses in the mapping to false.
Classification:
Impact: Medium - High.
Likelihood: Low
Attack scenario:
Attacker can collect client secrets and other data witch is visible in buynowbutton.
Components: woocommerce, magento, buynowbutton all components within payment.monetha.io
Steps to reproduce:
Not possible to create order when local storage exceeded the limit ~10 MB
Steps to reproduce:
call to
/webforms/submit/w2r9o0?callback=jQuery183012313865293637094_1516265451247&fields[email]=<some_email>
to subscribe someone.
low issue because we are able to control subscription list in mailerlite system.
Attack scenario:
Attacker can change price before payment.
Components: woocommerce, magento, buynowbutton all components within payment.monetha.io
Steps to reproduce:
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.