Node.js third-party modules
Node.js third-party modules 的公开漏洞报告、类别分布与常见资产。
307公开报告
$250披露赏金
16漏洞类别
10主要弱点
攻击面
弱点类别分布
主要弱点
- 路径遍历63
- 资源消耗失控38
- 命令注入（通用）33
- 代码注入28
- 存储型 XSS28
- Unlabeled16
- Modification of Assumed-Immutable Data (MAID)14
- XSS（通用）13
- 越界读10
- SQL 注入9
常见资产
- Other moduleSOURCE_CODE · 87
- · 14
- serveSOURCE_CODE · 8
- lodashSOURCE_CODE · 7
- fastifySOURCE_CODE · 5
- express-cartSOURCE_CODE · 5
- buttleSOURCE_CODE · 4
- http-live-simulatorSOURCE_CODE · 4
- publicSOURCE_CODE · 4
- statics-serverSOURCE_CODE · 3
高票报告
当前状态 307 份 · 全部 307
- 14[nested-property] Prototype Pollution业务逻辑 · 2020-10-27 · 中危$0Modification of Assumed-Immutable Data (MAID)
- 14OS Command Injection on Jison [all-parser-ports]代码执行 · 2020-05-28 · 中危$0操作系统命令注入
- 14[untitled-model] sql injectionSQL 注入 · 2019-06-18 · 高危$0SQL 注入
- 14[ascii-art] Command injection代码执行 · 2018-09-08 · 高危$0命令注入（通用）
- 14Unrestricted file upload (RCE)路径遍历 · 2018-06-02 · 严重$0路径遍历
- 14[query-mysql] SQL Injection due to lack of user input sanitization allows to run arbitrary SQL queries when fetching data from databaseSQL 注入 · 2018-05-19 · 严重$0SQL 注入
- 13[serve] Access unlisted internal files/folders revealing sensitive information信息泄露 · 2019-02-08 · 严重$0目录列表泄露
- 13flatmap-stream malicious package (distributed via the popular events-stream)代码执行 · 2018-11-27 · 严重$0Embedded Malicious Code
- 13Code Injection Vulnerability in morgan Package代码执行 · 2018-10-28 · 中危$0代码注入
- 13[html-pages] Path Traversal in html-pages module allows to read any file from the server with curl路径遍历 · 2018-05-19 · 严重$0路径遍历
- 12[m-server] XSS reflected because path does not escapeHtml跨站脚本 · 2020-09-28 · 未评级$0反射型 XSS
- 12[htmr] DOM-based XSS跨站脚本 · 2020-03-15 · 中危$0DOM 型 XSS
- 12[express-laravel-passport] Improper Authentication身份认证 · 2020-01-05 · 高危$0认证缺陷（通用）
- 12[flintcms] Account takeover due to blind MongoDB injection in password reset访问控制 · 2018-08-15 · 严重$0权限提升
- 12[buttle] Path traversal in mid-buttle module allows to read any file in the server.路径遍历 · 2018-06-27 · 严重$0路径遍历
- 12[hekto] Path Traversal vulnerability allows to read content of arbitrary files路径遍历 · 2018-02-27 · 高危$0路径遍历
- 11[i18next] Prototype pollution attack业务逻辑 · 2021-04-27 · 高危$0Modification of Assumed-Immutable Data (MAID)
- 11[devcert] Command Injection via insecure command formatting代码执行 · 2020-06-16 · 严重$0命令注入（通用）
- 11Prototype pollution in multipart parsing拒绝服务 · 2020-02-28 · 严重$0资源消耗失控
- 11Denial Of Service in Strapi Framework using argument injection拒绝服务 · 2020-01-29 · 低危$0资源消耗失控
- 11Application level denial of service due to shutting down the server拒绝服务 · 2019-09-27 · 低危$0资源消耗失控
- 11[fileview] Inadequate Output Encoding and Escaping跨站脚本 · 2019-12-29 · 高危$0存储型 XSS
- 11[simplehttpserver] List any file in the folder by using path traversal.路径遍历 · 2018-08-30 · 高危$0路径遍历
- 11Privilege escalation allows any user to add an administrator访问控制 · 2018-07-12 · 严重$0权限提升
- 11`memjs` allocates and stores buffers on typed input, resulting in DoS and uninitialized memory usage拒绝服务 · 2018-06-27 · 严重$0资源消耗失控