基础信息
项目名称：konloch/bytecode-viewer
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1719523588461690880/1719523588625268736
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| com.beust:jcommander 存在从非可信控制范围包含功能例程漏洞 | 从非可信控制范围包含功能例程 | MPS-2022-12225 | 中危 | |
| Apache Commons Compress 资源管理错误漏洞 | 拒绝服务 | MPS-9azi-sfqp | CVE-2023-42503 | 中危 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| com.beust:jcommander | 1.64 | 1.75 | 间接依赖 | 可选修复 |
| org.apache.commons:commons-compress | 1.23.0 | 1.24.0 | 直接依赖 | 可选修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| BSD-3-Clause | 9 | 低 |
| Apache-2.0 | 35 | 低 |
| MIT | 25 | 低 |
| 自定义许可证 | 22 | 低 |
| CDDL-1.1 | 1 | 低 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| ssa_types | 间接依赖 | pip | |
| error | 间接依赖 | pip | |
| callop | 间接依赖 | pip | |
| objtypes | 间接依赖 | pip | |
| org.ow2.asm:asm | 9.5 | 直接依赖 | maven |
| fixAttributeNames | 间接依赖 | pip | |
| org.exbin.bined:bined-swing | 0.2.0 | 直接依赖 | maven |
| com.github.weisj:darklaf-iconset | 3.0.2 | 间接依赖 | maven |
| de.skuzzle:semantic-version | 2.1.1 | 直接依赖 | maven |
| com.github.weisj:darklaf-platform-base | 3.0.2 | 间接依赖 | maven |
| com.github.ThexXTURBOXx.dex2jar:dex-tools | v64 | 间接依赖 | maven |
| org.bitbucket.mstrobel:procyon-compilertools | 0.6.0 | 直接依赖 | maven |
| org.apktool:brut.j.util | 2.8.0 | 间接依赖 | maven |
| io.github.skylot:jadx-plugins-api | 1.4.7 | 间接依赖 | maven |
| io.github.skylot:jadx-java-convert | 1.4.7 | 直接依赖 | maven |
| com.github.weisj:swing-extensions-laf-support | 0.1.3 | 间接依赖 | maven |
| org.antlr:antlr4 | 4.9.3 | 直接依赖 | maven |
| org.apache.commons:commons-text | 1.10.0 | 直接依赖 | maven |
| com.google.guava:failureaccess | 1.0.1 | 间接依赖 | maven |
| org.exbin.bined:bined-core | 0.2.0 | 直接依赖 | maven |
| flattenDict | 间接依赖 | pip | |
| org.apktool:brut.j.dir | 2.8.0 | 间接依赖 | maven |
| org.apktool:apktool-cli | 2.8.0 | 直接依赖 | maven |
| org.antlr:antlr4-runtime | 4.9.3 | 间接依赖 | maven |
| io.github.skylot:jadx-smali-input | 1.4.7 | 直接依赖 | maven |
| BoolTT | 间接依赖 | pip | |
| com.github.ThexXTURBOXx.dex2jar:dex-reader-api | v64 | 间接依赖 | maven |
| org.ow2.asm:asm-commons | 9.5 | 直接依赖 | maven |
| com.konloch:safeyaml | 1.34.1 | 直接依赖 | maven |
| org.objenesis:objenesis | 3.3 | 直接依赖 | maven |
| com.konloch:HTTPRequest | 2.2.0 | 直接依赖 | maven |
| org.ow2.asm:asm-util | 9.5 | 直接依赖 | maven |
| ast2 | 间接依赖 | pip | |
| com.google.errorprone:error_prone_annotations | 2.18.0 | 间接依赖 | maven |
| com.android.tools.build:aapt2-proto | 7.3.1-8691043 | 间接依赖 | maven |
| io.github.skylot:jadx-core | 1.4.7 | 直接依赖 | maven |
| BExpr | 间接依赖 | pip | |
| org.exbin.bined:bined-highlight-swing | 0.2.0 | 直接依赖 | maven |
| com.github.weisj:swing-extensions-visual-padding | 0.1.3 | 间接依赖 | maven |
| com.github.weisj:darklaf-utils | 3.0.2 | 间接依赖 | maven |
| com.github.weisj:darklaf-theme-spec | 3.0.2 | 间接依赖 | maven |
| blockmaker | 间接依赖 | pip | |
| com.github.ThexXTURBOXx.dex2jar:dex-writer | v64 | 间接依赖 | maven |
| com.google.code.findbugs:jsr305 | 3.0.2 | 间接依赖 | maven |
| org.ow2.asm:asm-analysis | 9.5 | 直接依赖 | maven |
| org.antlr:antlr | 3.5.2 | 间接依赖 | maven |
| org.exbin.bined:bined-swing-extended | 0.2.0 | 间接依赖 | maven |
| org.glassfish:javax.json | 1.0.4 | 间接依赖 | maven |
| com.android.tools.smali:smali-dexlib2 | 3.0.3 | 间接依赖 | maven |
| org.imgscalr:imgscalr-lib | 4.2 | 直接依赖 | maven |
| offset | 间接依赖 | pip | |
| org.bitbucket.mstrobel:procyon-expressions | 0.6.0 | 直接依赖 | maven |
| com.github.weisj:darklaf-compatibility | 3.0.2 | 间接依赖 | maven |
| org.apache.commons:commons-collections4 | 4.1 | 间接依赖 | maven |
| commons-codec:commons-codec | 1.16.0 | 直接依赖 | maven |
| com.google.protobuf:protobuf-java | 3.21.12 | 间接依赖 | maven |
| com.github.ThexXTURBOXx.dex2jar:d2j-external | v64 | 间接依赖 | maven |
| commons-cli:commons-cli | 1.5.0 | 直接依赖 | maven |
| com.github.weisj:darklaf-native-utils | 3.0.2 | 间接依赖 | maven |
| org.exbin.bined:bined-extended | 0.2.0 | 间接依赖 | maven |
| xpp3:xpp3 | 1.1.4c | 直接依赖 | maven |
| org.jboss.windup.utils:windup-utils | 6.2.5.Final | 间接依赖 | maven |
| com.google.guava:guava | 32.1.1-jre | 直接依赖 | maven |
| org.antlr:antlr-runtime | 3.5.2 | 间接依赖 | maven |
| javax.xml.bind:jaxb-api | 2.3.1 | 间接依赖 | maven |
| BaseOp | 间接依赖 | pip | |
| com.github.ThexXTURBOXx.dex2jar:dex-ir | v64 | 间接依赖 | maven |
| org.apache.commons:commons-lang3 | 3.12.0 | 直接依赖 | maven |
| com.android.tools.smali:smali | 3.0.3 | 直接依赖 | maven |
| eu.bibl.banalysis:byteanalysis | 1.0bcv | 直接依赖 | maven |
| org.benf:cfr | 0.152 | 直接依赖 | maven |
| com.github.ThexXTURBOXx:dex2jar | v64 | 直接依赖 | maven |
| com.github.weisj:darklaf-windows | 3.0.2 | 间接依赖 | maven |
| org.checkerframework:checker-qual | 3.33.0 | 间接依赖 | maven |
| com.github.weisj:darklaf-macos | 3.0.2 | 间接依赖 | maven |
| constraints | 间接依赖 | pip | |
| org.ow2.asm:asm-tree | 9.5 | 直接依赖 | maven |
| org.jboss.windup.decompiler:decompiler-api | 6.2.5.Final | 间接依赖 | maven |
| excepttypes | 间接依赖 | pip | |
| com.google.j2objc:j2objc-annotations | 2.8 | 间接依赖 | maven |
| ssa_ops | 间接依赖 | pip | |
| org.apktool:brut.j.common | 2.8.0 | 间接依赖 | maven |
| com.github.weisj:darklaf-platform-preferences | 3.0.2 | 间接依赖 | maven |
| org.apache.commons:commons-compress | 1.23.0 | 直接依赖 | maven |
| antlr:antlr | 2.7.7 | 间接依赖 | maven |
| com.fifesoft:rsyntaxtextarea | 3.3.3 | 直接依赖 | maven |
| com.android.tools.smali:smali-baksmali | 3.0.3 | 直接依赖 | maven |
| com.android.tools.smali:smali-util | 3.0.3 | 间接依赖 | maven |
| org.abego.treelayout:org.abego.treelayout.core | 1.0.3 | 直接依赖 | maven |
| com.github.ThexXTURBOXx.dex2jar:dex-reader | v64 | 间接依赖 | maven |
| org.jd:jd-gui | 1.6.6bcv | 直接依赖 | maven |
| org.tinyjee.jgraphx:jgraphx | 3.4.1.3 | 直接依赖 | maven |
| javax.activation:javax.activation-api | 1.2.0 | 间接依赖 | maven |
| ssa_jumps | 间接依赖 | pip | |
| com.github.ThexXTURBOXx.dex2jar:d2j-base-cmd | v64 | 间接依赖 | maven |
| makeGraph | 间接依赖 | pip | |
| com.github.gotson:webp-imageio | 0.2.2 | 直接依赖 | maven |
| the | 间接依赖 | pip | |
| uk.com.robust-it:cloning | 1.9.12 | 直接依赖 | maven |
| com.github.ThexXTURBOXx.dex2jar:d2j-jasmin | v64 | 间接依赖 | maven |
| com.github.weisj:jsvg | 0.0.9 | 间接依赖 | maven |
| org.bitbucket.mstrobel:procyon-reflection | 0.6.0 | 直接依赖 | maven |
| com.github.weisj:darklaf-theme | 3.0.2 | 间接依赖 | maven |
| org.slf4j:slf4j-api | 2.0.7 | 直接依赖 | maven |
| com.github.weisj:darklaf-core | 3.0.2 | 直接依赖 | maven |
| commons-io:commons-io | 2.13.0 | 直接依赖 | maven |
| com.github.ThexXTURBOXx:fernflower | e0d44f4 | 直接依赖 | maven |
| com.github.weisj:darklaf-property-loader | 3.0.2 | 间接依赖 | maven |
| org.exbin.auxiliary:paged_data | 0.2.0 | 直接依赖 | maven |
| org.jboss.windup.decompiler:decompiler-fernflower | 6.2.5.Final | 直接依赖 | maven |
| org.jetbrains:annotations | 24.0.1 | 直接依赖 | maven |
| com.android.tools:r8 | 4.0.63 | 间接依赖 | maven |
| org.codehaus.janino:commons-compiler | 3.1.10 | 直接依赖 | maven |
| com.google.code.gson:gson | 2.10.1 | 直接依赖 | maven |
| com.github.weisj:darklaf-platform-decorations | 3.0.2 | 间接依赖 | maven |
| org.antlr:ST4 | 4.3.1 | 间接依赖 | maven |
| bytecode | 间接依赖 | pip | |
| com.github.ThexXTURBOXx.dex2jar:dex-translator | v64 | 间接依赖 | maven |
| get_attributes_raw | 间接依赖 | pip | |
| org.antlr:stringtemplate | 3.2.1 | 间接依赖 | maven |
| org.apktool:apktool-lib | 2.8.0 | 直接依赖 | maven |
| com.google.guava:listenablefuture | 9999.0-empty-to-avoid-conflict-with-guava | 间接依赖 | maven |
| com.beust:jcommander | 1.64 | 间接依赖 | maven |
| com.github.weisj:darklaf-extensions-rsyntaxarea | 0.4.1 | 直接依赖 | maven |
| org.kamranzafar:jtar | 2.3 | 间接依赖 | maven |
| io.github.skylot:jadx-dex-input | 1.4.7 | 直接依赖 | maven |
| org.codehaus.janino:janino | 3.1.10 | 直接依赖 | maven |
| com.github.ThexXTURBOXx.dex2jar:d2j-smali | v64 | 间接依赖 | maven |
| org.bitbucket.mstrobel:procyon-core | 0.6.0 | 直接依赖 | maven |