Doppler

Doppler 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 访问控制5
• 业务逻辑2
• 错误配置2
• 信息泄露1
• 注入与走私1
• 跨站脚本1

主要弱点

• 访问控制缺陷（通用）4
• 业务逻辑错误2
• Externally Controlled Reference to a Resource in Another Sphere1
• 信息泄露1
• 权限提升1
• Unlabeled1
• 违反安全设计原则（按标题归类）1
• 存储型 XSS1

常见资产

• · 9
• dashboard.doppler.comURL · 1
• dopplerDOWNLOADABLE_EXECUTABLES · 1
• share.doppler.comURL · 1

高票报告

当前状态 12 份 · 全部 12

1. 71
   Availability Impact from Exploiting Project Name Vulnerabilities业务逻辑 · 2024-11-13 · 低危
   $250业务逻辑错误
2. 49
   Acquisition on broken link listed on the page "https://docs.doppler.com/docs/removal-deprecated-packages-scripts in [scheduling a call]注入与走私 · 2024-05-22 · 低危
   $0Externally Controlled Reference to a Resource in Another Sphere
3. 42
   Stored XSS in [https://dashboard.doppler.com/workplace/*/logs] pages跨站脚本 · — · 未评级
   $0存储型 XSS
4. 36
   WAF bypass and java script incomplete handling of Unicode characters might leads to dom-xss访问控制 · 2025-01-14 · 未评级
   $0访问控制缺陷（通用）
5. 32
   Github app(link) Takeover Listed on "https://docs.doppler.com/docs/github-actions" page错误配置 · 2024-03-15 · 低危
   $0Unlabeled
6. 8
   No rate limit into email change leads to email notification boombing to its victim.访问控制 · — · 未评级
   $0访问控制缺陷（通用）
7. 7
   email spoofing on doppler.team错误配置 · — · 未评级
   $0违反安全设计原则（按标题归类）
8. 6
   Owner can change themself for another Role Mode but application doesnot have this function.访问控制 · — · 未评级
   $0权限提升
9. 3
   Bypass Email Verification.访问控制 · — · 未评级
   $0访问控制缺陷（通用）
10. 3
    User Access Control in Community Plan访问控制 · — · 未评级
    $0访问控制缺陷（通用）
11. 2
    Access page must be reloaded to perform multiple requests业务逻辑 · — · 未评级
    $0业务逻辑错误
12. 0
    Limited access to billing dashboard by Admin and Collaborator in conflict with user role permissions.信息泄露 · — · 未评级
    $0信息泄露