基础信息
项目名称：JabbR/JabbR
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1718933142651060224/1718933143544446976
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| Joyent Node.js marked 不完整黑名单漏洞 | 注入 | MPS-2015-0640 | CVE-2015-1370 | 中危 |
| marked 模块拒绝服务漏洞 | 拒绝服务 | MPS-2018-7187 | CVE-2017-16114 | 高危 |
| marked 存在OWASP 2004 年 A9 类前十名 – 拒绝服务漏洞 | OWASP 2004 年 A9 类前十名 – 拒绝服务 | MPS-2022-13224 | 高危 | |
| marked 存在跨站脚本漏洞 | XSS | MPS-2022-13225 | 高危 | |
| marked 存在跨站脚本漏洞 | XSS | MPS-2022-15372 | 高危 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| marked | 0.3.2 | 间接依赖 | 建议修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| non-standard | 3 | 低 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| Microsoft.Bcl | 1.1.3 | 间接依赖 | nuget |
| EcmaScript.Net | 1.0.1.0 | 间接依赖 | nuget |
| Microsoft.Owin.Diagnostics | 2.1.0-rc1-21123-712-dev | 间接依赖 | nuget |
| Iesi.Collections | 4.0.1.4000 | 间接依赖 | nuget |
| QUnit-MVC | 1.6.2.0 | 间接依赖 | nuget |
| Microsoft.AspNet.SignalR | 2.2.0-pre-140709-b104 | 间接依赖 | nuget |
| AntiXSS | 4.2.1 | 间接依赖 | nuget |
| System.Web.Razor.Unofficial | 2.0.2 | 间接依赖 | nuget |
| SimpleAuthentication.Core | 0.3.14 | 间接依赖 | nuget |
| PagedList | 1.17.0.0 | 间接依赖 | nuget |
| SquishIt | 0.9.3 | 间接依赖 | nuget |
| Microsoft.AspNet.SignalR.SqlServer | 2.2.0-pre-140709-b104 | 间接依赖 | nuget |
| Microsoft.Net.Http | 2.2.15 | 间接依赖 | nuget |
| Microsoft.AspNet.WebApi.Client | 5.1.0-rc1-131128 | 间接依赖 | nuget |
| YUICompressor.NET | 2.2.1.0 | 间接依赖 | nuget |
| Microsoft.AspNet.WebApi.Owin | 5.1.0-rc1-131128 | 间接依赖 | nuget |
| Microsoft.Owin.FileSystems | 2.1.0-rc1-21123-712-dev | 间接依赖 | nuget |
| WindowsAzure.Storage | 2.1.0.3 | 间接依赖 | nuget |
| Microsoft.Owin.Host.SystemWeb | 2.1.0-rc1-21123-712-dev | 间接依赖 | nuget |
| Nancy.SimpleAuthentication | 0.3.14 | 间接依赖 | nuget |
| Microsoft.Data.Edm | 5.6.0 | 间接依赖 | nuget |
| RestSharp | 104.3.0-beta | 间接依赖 | nuget |
| Microsoft.AspNet.SignalR.SystemWeb | 2.2.0-pre-140709-b104 | 间接依赖 | nuget |
| Microsoft.Owin.Security | 2.1.0-rc1-21123-712-dev | 间接依赖 | nuget |
| EntityFramework | 6.0.1 | 间接依赖 | nuget |
| jquery.keytips | 1.0.6 | 间接依赖 | nuget |
| Nancy.Viewengines.Razor | 0.20.0 | 间接依赖 | nuget |
| Moq | 4.1.1309.1617 | 间接依赖 | nuget |
| Owin | 1.0 | 间接依赖 | nuget |
| jQuery.Cookie | 1.3.1 | 间接依赖 | nuget |
| marked | 0.3.2 | 间接依赖 | nuget |
| System.Spatial | 5.6.0 | 间接依赖 | nuget |
| WindowsAzure.ServiceBus | 2.1.3.0 | 间接依赖 | nuget |
| HtmlAgilityPack | 1.4.6 | 间接依赖 | nuget |
| jQuery | 2.0.3 | 间接依赖 | nuget |
| Microsoft.AspNet.WebApi.Core | 5.1.0-rc1-131128 | 间接依赖 | nuget |
| json2 | 1.0.2 | 间接依赖 | nuget |
| Highlight.js | 1.0.4 | 间接依赖 | nuget |
| MSBuildTasks | 1.4.0.61 | 间接依赖 | nuget |
| Newtonsoft.Json | 5.0.7 | 间接依赖 | nuget |
| Ninject | 3.0.2-unstable-9037 | 间接依赖 | nuget |
| xunit | 1.9.2 | 间接依赖 | nuget |
| Microsoft.AspNet.SignalR.Client | 2.1.0-pre-140513-b35 | 间接依赖 | nuget |
| Nancy | 0.20.0 | 间接依赖 | nuget |
| Microsoft.Owin | 2.1.0-rc1-21123-712-dev | 间接依赖 | nuget |
| Microsoft.Bcl.Build | 1.0.10 | 间接依赖 | nuget |
| Nancy.Bootstrappers.Ninject | 0.20.0 | 间接依赖 | nuget |
| Twitter.Bootstrap | 2.3.2 | 间接依赖 | nuget |
| Ninject.Extensions.ChildKernel | 3.0.2-unstable-9006 | 间接依赖 | nuget |
| Microsoft.WindowsAzure.ConfigurationManager | 2.0.1.0 | 间接依赖 | nuget |
| Microsoft.AspNet.SignalR.ServiceBus | 2.2.0-pre-140709-b104 | 间接依赖 | nuget |
| Microsoft.AspNet.SignalR.Core | 2.2.0-pre-140709-b104 | 间接依赖 | nuget |
| AjaxMin | 4.97.4951.28483 | 间接依赖 | nuget |
| Microsoft.Owin.StaticFiles | 2.1.0-rc1-21123-712-dev | 间接依赖 | nuget |
| Microsoft.Owin.Security.Cookies | 2.1.0-rc1-21123-712-dev | 间接依赖 | nuget |
| jQuery.Templates | 0.1 | 间接依赖 | nuget |
| jquery.captureDocumentWrite | 1.0 | 间接依赖 | nuget |
| Nancy.Owin | 0.20.0 | 间接依赖 | nuget |
| Microsoft.Data.OData | 5.6.0 | 间接依赖 | nuget |
| Microsoft.AspNet.SignalR.JS | 2.2.0-pre-140709-b104 | 间接依赖 | nuget |
| mscoree.dll | 间接依赖 |