monetha / bug-bounty Goto Github PK

click.mlsend.com supports https. Update links in the newsletter to HTTPS.

The Return url after purchase (optional) parameter does not check for the url scheme. By using a scheme such as javascript, an attacker is able to register an attack payload that executes arbitrary javascript.

https://github.com/monetha/TrustReputationSmartContracts/blob/master/contracts/Restricted.sol

Issue:
Restricted.sol does not provide a method to make a monethaAddress mapping false. It is unclear whether multiple monethaAddresses should be valid at once, though from the choice to use a map it seems so. However, there is no way to remove an address from the mapping. If there is ever a compromise of a monethaAddress, deployed contracts will remain vulnerable indefinitely.

Fix:
If the intent is for there to be a single valid monethaAddress, use an address instead of a mapping.
If the intent is for there to be multiple monethaAddresses, provide a method for setting addresses in the mapping to false.

Classification:
Impact: Medium - High.
Likelihood: Low

Attack scenario:
Attacker can collect client secrets and other data witch is visible in buynowbutton.

Components: woocommerce, magento, buynowbutton all components within payment.monetha.io

Steps to reproduce:

1. Generate Buy now button
2. Check script btn.href = 'http://payment.monetha.test/orders/add?pid=some-unique-id&secret=some-unique-id...

Not possible to create order when local storage exceeded the limit ~10 MB

FF Issue in Magento2 payment integration (cannot finish order)

Receiving error that event is not defined.

Steps to reproduce:

call to
/webforms/submit/w2r9o0?callback=jQuery183012313865293637094_1516265451247&fields[email]=<some_email> to subscribe someone.

low issue because we are able to control subscription list in mailerlite system.

Attack scenario:
Attacker can change price before payment.

Components: woocommerce, magento, buynowbutton all components within payment.monetha.io

Steps to reproduce:

1. Inspect element on buy now button
2. Change parameter amount value for example amount=0.01
3. Press Buy button and make a payment.