Maker Ecosystem Growth Holdings, Inc Program Statistics

View program

19 total issues disclosed

$85,500 total paid publicly

Most disclosed (3 disclosures) — Business Logic Errors

Disclosed Reports

Report Title Vulnerability Type Disclosed By Severity Disclosed on
SQL Injection leads to retrieve the contents of an entire database. SQL Injection u-itachi Critical 2021-12-29
xmlrpc.php FILE IS enabled it will used for Bruteforce attack and Denial of Service(DoS) Uncontrolled Resource Consumption harsithsivanandham Critical 2021-02-12
A specially crafted value for the 'Cache-Digest' header causing crash in chat.makerdao.com Improper Restriction of Authentication Attempts lalit2020 Critical 2020-11-02
Email HTML injection None supplied m4ngofloat Low 2020-06-10
[blog.makerdao.com] Multiple Vulnerabilities - Leads to leakage user admin sensitive exposure Business Logic Errors duckoverflow No rating 2020-04-14
Blind SSRF at https://chat.makerdao.com/account/profile Server-Side Request Forgery (SSRF) losthacker Critical 2020-04-14
xmlrpc.php file is enable it will used for (Denial of Service) and bruteforce attack Uncontrolled Resource Consumption sourceflow No rating 2020-04-07
load scripts DOS vulnerability Brute Force th3cyb3rc0p High 2020-04-02
DoS of https://blog.makerdao.com/ via CVE-2018-6389 None supplied khoabda1 No rating 2020-02-18
xmlrpc.php FILE IS enable it will used for Bruteforce attack None supplied khoabda1 No rating 2020-02-18
Wordpress users disclosure on blog.makerdao.con Information Disclosure ardi4x Low 2020-01-15
UNRESTRICTED FILE UPLOAD AT chat.makerdao.com Insecure Temporary File 0xbugger High 2020-01-15
Two-factor authentication (2FA) Bypass Authentication Bypass Using an Alternate Path or Channel offensive-security Critical 2020-01-15
App Takeover ( makerdao.herokuapp.com ) Privilege Escalation m7mdharoun High 2020-01-15
Steal ALL collateral during liquidation by exploiting lack of validation in `flip.kick` Improper Input Validation lucash-dev Critical 2019-10-01
Steal all MKR from `flap` during liquidation by exploiting lack of validation in `flap.kick` Improper Input Validation lucash-dev High 2019-09-26
.git file accessible Information Disclosure nitrozeus0x01 Low 2019-09-13
Steal collateral during `end` process, by earning DSR interest after `flow`. Business Logic Errors lucash-dev High 2019-09-09
Earn free DAI interest (inflation) through instant CDP+DSR in one tx Business Logic Errors lucash-dev High 2019-08-12