基础信息
项目名称：Fusion/pngsource
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1718010022013304832/1718010028493504512
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| 低危 | ||||
| Google Golang 资源管理错误漏洞 | MPS-2022-58307 | CVE-2022-41723 | 高危 | |
| Google Golang 资源管理错误漏洞 | 不加限制或调节的资源分配 | MPS-2022-58311 | CVE-2022-41727 | 中危 |
| Go-Yaml 安全漏洞 | 反序列化 | MPS-2022-8233 | CVE-2022-28948 | 高危 |
| Google Go 权限许可和访问控制问题漏洞 | 权限管理不当 | MPS-2022-9049 | CVE-2022-29526 | 中危 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| gopkg.in/yaml.v3 | v3.0.0-20200313102051-9f266ea9e77c | 3.0.0 | 间接依赖 | 建议修复 |
| golang.org/x/image | v0.0.0-20210628002857-a66eb6448b8d | 0.5.0 | 间接依赖 | 建议修复 |
| golang.org/x/net | v0.0.0-20210405180319-a5a99cb37ef4 | 0.17.0 | 间接依赖 | 建议修复 |
| golang.org/x/sys | v0.0.0-20211025201205-69cdffdb9359 | 0.1.0 | 间接依赖 | 可选修复 |
| golang.org/x/sys | v0.0.0-20210909193231-528a39cd75f3 | 0.1.0 | 间接依赖 | 可选修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| MIT | 19 | 低 |
| BSD-3-Clause | 6 | 低 |
| ISC | 1 | 低 |
| BSD-2-Clause | 3 | 低 |
| Apache-2.0 | 1 | 低 |
| Unlicense | 1 | 低 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| api-ms-win-core-errorhandling-l1-1-0.dll | 间接依赖 | ||
| github.com/wailsapp/wails | v1.16.9 | 直接依赖 | go |
| golang.org/x/text | v0.3.6 | 间接依赖 | go |
| api-ms-win-core-processthreads-l1-1-0.dll | 间接依赖 | ||
| github.com/nfnt/resize | v0.0.0-20180221191011-83c6a9932646 | 间接依赖 | go |
| github.com/gorilla/websocket | v1.4.1 | 间接依赖 | go |
| github.com/leaanthony/spinner | v0.5.3 | 间接依赖 | go |
| api-ms-win-core-string-l1-1-0.dll | 间接依赖 | ||
| github.com/abadojack/whatlanggo | v1.0.1 | 间接依赖 | go |
| api-ms-win-core-winrt-error-l1-1-1.dll | 间接依赖 | ||
| api-ms-win-core-winrt-string-l1-1-0.dll | 间接依赖 | ||
| github.com/pkg/errors | v0.8.1 | 间接依赖 | go |
| golang.org/x/sys | v0.0.0-20211025201205-69cdffdb9359 | 间接依赖 | go |
| api-ms-win-core-sysinfo-l1-1-0.dll | 间接依赖 | ||
| USER32.dll | 间接依赖 | ||
| KERNEL32.dll | 间接依赖 | ||
| WebView2Loader.dll | 间接依赖 | ||
| api-ms-win-core-winrt-error-l1-1-0.dll | 间接依赖 | ||
| github.com/dchest/jsmin | v0.0.0-20160823214000-faeced883947 | 间接依赖 | go |
| github.com/sirupsen/logrus | v1.8.1 | 间接依赖 | go |
| gopkg.in/yaml.v3 | v3.0.0-20200313102051-9f266ea9e77c | 间接依赖 | go |
| github.com/josephspurrier/goversioninfo | v1.3.0 | 间接依赖 | go |
| api-ms-win-core-localization-l1-2-0.dll | 间接依赖 | ||
| golang.org/x/image | v0.0.0-20210628002857-a66eb6448b8d | 间接依赖 | go |
| github.com/syossan27/tebata | v0.0.0-20180602121909-b283fe4bc5ba | 间接依赖 | go |
| github.com/ncruces/zenity | v0.7.12 | 直接依赖 | go |
| github.com/leaanthony/wincursor | v0.1.0 | 间接依赖 | go |
| api-ms-win-core-winrt-l1-1-0.dll | 间接依赖 | ||
| api-ms-win-core-util-l1-1-0.dll | 间接依赖 | ||
| github.com/fatih/color | v1.7.0 | 间接依赖 | go |
| github.com/randall77/makefat | v0.0.0-20210315173500-7ddd0e42c844 | 间接依赖 | go |
| github.com/rakyll/globalconf | v0.0.0-20180912185831-87f8127c421f | 直接依赖 | go |
| github.com/leaanthony/synx | v0.1.0 | 间接依赖 | go |
| github.com/mattn/go-isatty | v0.0.7 | 间接依赖 | go |
| SHLWAPI.dll | 间接依赖 | ||
| api-ms-win-core-synch-l1-1-0.dll | 间接依赖 | ||
| github.com/webview/webview | v0.0.0-20210330151455-f540d88dde4e | 直接依赖 | go |
| golang.org/x/sys | v0.0.0-20210909193231-528a39cd75f3 | 间接依赖 | go |
| api-ms-win-core-libraryloader-l1-2-0.dll | 间接依赖 | ||
| ole32.dll | 间接依赖 | ||
| github.com/pkg/browser | v0.0.0-20180916011732-0a3d74bf9ce4 | 间接依赖 | go |
| github.com/go-playground/colors | v1.2.0 | 间接依赖 | go |
| github.com/glacjay/goini | v0.0.0-20161120062552-fd3024d87ee2 | 间接依赖 | go |
| github.com/kennygrant/sanitize | v1.2.4 | 间接依赖 | go |
| github.com/Masterminds/semver | v1.4.2 | 间接依赖 | go |
| github.com/akavel/rsrc | v0.10.2 | 间接依赖 | go |
| github.com/jackmordaunt/icns | v1.0.0 | 间接依赖 | go |
| github.com/mattn/go-colorable | v0.1.1 | 间接依赖 | go |
| github.com/leaanthony/slicer | v1.4.0 | 间接依赖 | go |
| golang.org/x/net | v0.0.0-20210405180319-a5a99cb37ef4 | 间接依赖 | go |