Sifchain

Sifchain 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 错误配置23
• 信息泄露21
• 其他弱点8
• 业务逻辑5
• 身份认证4
• 跨站脚本3
• 代码执行2
• 拒绝服务1
• 跨站请求伪造1
• 密码学缺陷1
• 路径遍历1
• 访问控制1

主要弱点

• 错误配置8
• Unlabeled8
• 信息泄露7
• 点击劫持6
• 违反安全设计原则（按标题归类）4
• Unlabeled4
• 认证缺陷（通用）4
• 敏感信息明文存储4
• Unlabeled4
• 业务逻辑错误3

常见资产

• https://github.com/sifchain/sifnodeSOURCE_CODE · 44
• · 27

高票报告

当前状态 71 份 · 全部 71

1. 37
   Subdomain Takeover At the Main Domain Of Your Site访问控制 · 2021-05-08 · 低危
   $0访问控制缺陷（通用）
2. 21
   xmlrpc.php And /wp-json/wp/v2/users FILE IS enable it will used for bruteforce attack and denial of service拒绝服务 · 2021-05-06 · 低危
   $50资源消耗失控
3. 12
   Subdomain Takeover on proxies.sifchain.finance pointing to vercel错误配置 · 2022-04-01 · 高危
   $0错误配置
4. 11
   CORS Misconfiguration错误配置 · 2021-05-13 · 低危
   $0错误配置
5. 11
   Clickjacking Vulnerability in sifchain.finance错误配置 · 2021-05-11 · 未评级
   $0点击劫持
6. 11
   Private KEY of crypto wallet信息泄露 · 2021-05-08 · 低危
   $0Use of Hard-coded Password
7. 10
   Information Disclosure on https://rpc.sifchain.finance/信息泄露 · 2021-05-15 · 低危
   $0信息泄露
8. 8
   Wrong implementation of Telegram link on the main page for PC users错误配置 · 2021-06-13 · 低危
   $0错误配置
9. 8
   CORS Misconfiguration Leads to Sensitive Exposure on Sifchain main domain错误配置 · 2021-06-10 · 低危
   $0Unlabeled
10. 8
    CORS misconfiguration业务逻辑 · 2021-06-30 · 低危
    $0业务逻辑错误
11. 7
    Path Transversal inside saveContracts.js路径遍历 · 2021-05-14 · 低危
    $0Relative Path Traversal
12. 7
    Private RSA key for Vagrant exposed in GitHub repository信息泄露 · 2021-05-08 · 低危
    $0敏感信息不安全存储
13. 7
    Clickjacking misconfiguration bug错误配置 · 2021-06-18 · 未评级
    $0Unlabeled
14. 6
    Cross-site Scripting (XSS) possible at https://sifchain.finance// via CVE-2019-8331 exploitation跨站脚本 · 2021-06-22 · 中危
    $0Unlabeled
15. 6
    Email Spoofing on sifchain.finance其他弱点 · 2021-05-11 · 低危
    $0Unlabeled
16. 6
    Cross Origin Resource Sharing Misconfiguration | Lead to sensitive information.错误配置 · 2021-05-13 · 低危
    $0Unlabeled
17. 6
    Vulnerable for clickjacking attack错误配置 · 2021-05-08 · 低危
    $0点击劫持
18. 6
    Wrong Url in Main Page错误配置 · 2021-05-12 · 低危
    $200错误配置
19. 5
    No Rate Limit protection in user subscription form业务逻辑 · 2021-05-15 · 低危
    $0Unlabeled
20. 5
    CORS (Cross-Origin Resource Sharing) origin validation failure -Any website can issue requests made with user credentials and read the responses to th跨站脚本 · 2021-06-10 · 低危
    $0存储型 XSS
21. 5
    A password in plain text in conf file信息泄露 · 2021-05-08 · 未评级
    $0Password in Configuration File
22. 5
    wrong url in hackerone > goes to wix.com > unconnected错误配置 · 2021-05-08 · 低危
    $0错误配置
23. 4
    Email spoofing身份认证 · 2021-05-13 · 低危
    $0认证缺陷（通用）
24. 4
    Flaws In Social media Icon on error page which can lead to financial loss to a company.业务逻辑 · 2021-06-13 · 低危
    $0业务逻辑错误
25. 4
    RSA PRIVATE KEY discloser信息泄露 · 2021-05-08 · 低危
    $0信息泄露