Shopify-scripts
Most disclosed vulnerability type (80 disclosures) — Denial of Service
ston3 has disclosed the most with 27 reports!
Shopify-scripts's top public payouts
- Shopify-scripts rewarded Use after free vulnerability in mruby Array#to_h causing DOS possible RCE with a
$20,000bounty! - Shopify-scripts rewarded DoS: type confusion in mrb_no_method_error with a
$20,000bounty! - Shopify-scripts rewarded TOCTTOU bug in mrb_str_setbyte leading the memory corruption with a
$20,000bounty! - Shopify-scripts rewarded Type confusion in mrb_exc_set leading to memory corruption with a
$20,000bounty! - Shopify-scripts rewarded Struct type confusion RCE with a
$18,000bounty!
Most recently disclosed
heap-use-after-free in OP_RESCUE
@ Submitted by ahihi
Bug Type: Use After Free
Disclosed on 2018-01-17
heap-buffer-overflow in OP_R_BREAK
@ Submitted by ahihi
Bug Type: Heap Overflow
Disclosed on 2018-01-17
SEGV on ary_concat
@ Submitted by ahihi
Bug Type: Memory Corruption - Generic
Disclosed on 2018-01-17
Invalid read leading to a segfault
@ Submitted by dgaletic
Bug Type: Out-of-bounds Read
Disclosed on 2017-12-28
Clearing , Shifting and Pop Value from Frozen Array
@ Submitted by an0n-j
Bug Type: Violation of Secure Design Principles
Disclosed on 2017-08-30
Use after free in mruby-mpdecimal
@ Submitted by haquaman
Bug Type: Use After Free
Disclosed on 2017-07-06
Null pointer dereference with send/method_missing
@ Submitted by titanous
Bug Type: NULL Pointer Dereference
Disclosed on 2017-06-23
Invalid Pointer reference in L_RESCUE
@ Submitted by locator
Bug Type: Denial of Service
Disclosed on 2017-06-02
OP_SCALL in LHS of a OP_ASGN resulting in arbitrary memory write
@ Submitted by avisaven
Bug Type: Write-what-where Condition
Disclosed on 2017-05-30
Heap Overflow in fiber_switch triggered from Fiber.transfer
@ Submitted by avisaven
Bug Type: Heap Overflow
Disclosed on 2017-05-30
heap-use-after-free in mrb_vm_exec - vm.c:1247
@ Submitted by ilsani
Bug Type: Memory Corruption - Generic
Disclosed on 2017-05-21
SIGSEGV in mrb_class
@ Submitted by ston3
Bug Type: NULL Pointer Dereference
Disclosed on 2017-05-13
SIGSEGV in mrb_vm_exec
@ Submitted by ston3
Bug Type: NULL Pointer Dereference
Disclosed on 2017-05-13