BlockDev Sp. Z o.o

BlockDev Sp. Z o.o 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 其他弱点6
• 身份认证3
• 业务逻辑3
• 拒绝服务2
• 信息泄露2
• 服务端请求伪造1
• SQL 注入1
• 访问控制1

主要弱点

• Unlabeled3
• 业务逻辑错误3
• 输入校验不当2
• 认证尝试次数未限制2
• 信息泄露2
• 资源消耗失控2
• Insecure Temporary File1
• Authentication Bypass Using an Alternate Path or Channel1
• 权限提升1
• SSRF1

常见资产

• blog.makerdao.comURL · 9
• chat.makerdao.comURL · 4
• forum.makerdao.comURL · 1
• MCD_ENDOTHER · 1
• MCD_FLAPOTHER · 1
• MCD_FLIPOTHER · 1
• MCD_POTOTHER · 1
• Medians (OSM sources)OTHER · 1

高票报告

当前状态 19 份 · 全部 19

1. 466
   Steal ALL collateral during liquidation by exploiting lack of validation in `flip.kick`其他弱点 · 2019-10-02 · 严重
   $0输入校验不当
2. 152
   Steal collateral during `end` process, by earning DSR interest after `flow`.业务逻辑 · 2019-09-10 · 高危
   $0业务逻辑错误
3. 140
   [blog.makerdao.com] Multiple Vulnerabilities - Leads to leakage user admin sensitive exposure业务逻辑 · 2020-04-14 · 未评级
   $0业务逻辑错误
4. 63
   Earn free DAI interest (inflation) through instant CDP+DSR in one tx业务逻辑 · 2019-08-13 · 高危
   $0业务逻辑错误
5. 55
   Steal all MKR from `flap` during liquidation by exploiting lack of validation in `flap.kick`其他弱点 · 2019-09-26 · 高危
   $0输入校验不当
6. 20
   .git file accessible信息泄露 · 2019-09-13 · 低危
   $0信息泄露
7. 16
   xmlrpc.php file is enable it will used for (Denial of Service) and bruteforce attack拒绝服务 · 2020-04-07 · 未评级
   $0资源消耗失控
8. 14
   xmlrpc.php FILE IS enabled it will used for Bruteforce attack and Denial of Service(DoS)拒绝服务 · 2021-02-12 · 严重
   $500资源消耗失控
9. 8
   SQL Injection leads to retrieve the contents of an entire database.SQL 注入 · 2021-12-29 · 严重
   $0SQL 注入
10. 7
    Blind SSRF at https://chat.makerdao.com/account/profile服务端请求伪造 · 2020-04-14 · 严重
    $0SSRF
11. 6
    Two-factor authentication (2FA) Bypass身份认证 · 2020-01-15 · 严重
    $0Authentication Bypass Using an Alternate Path or Channel
12. 6
    App Takeover ( makerdao.herokuapp.com )访问控制 · 2020-01-15 · 高危
    $0权限提升
13. 5
    Email HTML injection其他弱点 · 2020-06-10 · 低危
    $0Unlabeled
14. 5
    Wordpress users disclosure on blog.makerdao.con信息泄露 · 2020-01-15 · 低危
    $0信息泄露
15. 3
    load scripts DOS vulnerability身份认证 · 2020-04-03 · 高危
    $0认证尝试次数未限制
16. 1
    A specially crafted value for the 'Cache-Digest' header causing crash in chat.makerdao.com身份认证 · 2020-11-03 · 严重
    $0认证尝试次数未限制
17. 1
    xmlrpc.php FILE IS enable it will used for Bruteforce attack其他弱点 · 2020-02-18 · 未评级
    $0Unlabeled
18. 1
    UNRESTRICTED FILE UPLOAD AT chat.makerdao.com其他弱点 · 2020-01-15 · 高危
    $0Insecure Temporary File
19. 0
    DoS of https://blog.makerdao.com/ via CVE-2018-6389其他弱点 · 2020-02-18 · 未评级
    $0Unlabeled