更新: 421 个文件 - 2026-03-17 18:30:02
这个提交包含在：
hao
@@ -21,7 +21,7 @@
|
||||
| Flask | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Ghost | `cms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Gin | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Gitea | `platforms` | `rolling-24m` | `-` | `yes` | `37` | `37` | `3` | `seeded` | `real:0/synthetic:0/blocked:1` | `0` | `1` | `0` | `2026-03-03T04:57:57.697708Z` |
|
||||
| Gitea | `platforms` | `rolling-24m` | `-` | `yes` | `30` | `30` | `3` | `seeded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `2026-03-03T04:57:57.697708Z` |
|
||||
| GitLab CE | `platforms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Grafana | `platforms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Hapi | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
@@ -37,7 +37,7 @@
|
||||
| Medusa | `ecommerce` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Moodle | `cms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| NestJS | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Next.js | `frameworks` | `history-full` | `yes` | `yes` | `26` | `26` | `3` | `seeded` | `real:0/synthetic:0/blocked:0` | `0` | `1` | `0` | `2026-03-13T22:14:13.665535Z` |
|
||||
| Next.js | `frameworks` | `history-full` | `yes` | `yes` | `24` | `24` | `3` | `seeded` | `real:1/synthetic:0/blocked:0` | `0` | `1` | `0` | `2026-03-13T22:00:36.554552Z` |
|
||||
| Nginx | `servers` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Node.js | `frameworks` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Nuxt | `frameworks` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
|
||||
@@ -1,206 +1,4 @@
|
||||
{
|
||||
"gitea--CVE-2018-15192": {
|
||||
"canonical_id": "gitea--CVE-2018-15192",
|
||||
"title": "Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea",
|
||||
"summary": "Gogs and Gitea SSRF Vulnerability in code.gitea.io/gitea",
|
||||
"display_name": "Gitea",
|
||||
"system_id": "gitea",
|
||||
"category": "platforms",
|
||||
"severity": "unknown",
|
||||
"cvss_score": null,
|
||||
"exploit_status": "unknown",
|
||||
"published_at": "2024-08-20T20:32:20Z",
|
||||
"updated_at": "2026-03-03T04:54:04.686907Z",
|
||||
"official_source_url": "https://github.com/advisories/GHSA-fg3x-rwq9-74cw",
|
||||
"secondary_source_urls": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2018-15192",
|
||||
"https://github.com/go-gitea/gitea/commit/599ff1c054e436daa4dc3f049aa8661d9c2395f9",
|
||||
"https://github.com/go-gitea/gitea/issues/4624",
|
||||
"https://github.com/go-gitea/gitea/pull/17482",
|
||||
"https://github.com/gogs/gogs/commit/22717a1c064511cf37c46af5e650baf7184cf25b",
|
||||
"https://github.com/gogs/gogs/issues/5366",
|
||||
"https://github.com/gogs/gogs/pull/6002"
|
||||
],
|
||||
"aliases": [
|
||||
"CVE-2018-15192",
|
||||
"GHSA-fg3x-rwq9-74cw",
|
||||
"GO-2023-1971"
|
||||
],
|
||||
"secure_code_topics": [
|
||||
"authz-server-side-recheck",
|
||||
"token-cookie-storage",
|
||||
"proxy-trust-boundary",
|
||||
"ssrf-url-validation"
|
||||
],
|
||||
"verification_status": "triage-manual",
|
||||
"verification_mode": "synthetic",
|
||||
"artifact_mode": "synthetic",
|
||||
"blocked_reason": null,
|
||||
"browser_evidence": {
|
||||
"required": false,
|
||||
"present": false,
|
||||
"refs": []
|
||||
}
|
||||
},
|
||||
"gitea--CVE-2018-18926": {
|
||||
"canonical_id": "gitea--CVE-2018-18926",
|
||||
"title": "Gitea Remote Code Execution (RCE) in code.gitea.io/gitea",
|
||||
"summary": "Gitea Remote Code Execution (RCE) in code.gitea.io/gitea",
|
||||
"display_name": "Gitea",
|
||||
"system_id": "gitea",
|
||||
"category": "platforms",
|
||||
"severity": "unknown",
|
||||
"cvss_score": null,
|
||||
"exploit_status": "unknown",
|
||||
"published_at": "2024-08-21T15:29:04Z",
|
||||
"updated_at": "2026-03-03T04:52:20.787387Z",
|
||||
"official_source_url": "https://github.com/advisories/GHSA-hf6f-jq25-8gq9",
|
||||
"secondary_source_urls": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2018-18926",
|
||||
"https://github.com/go-gitea/gitea/commit/aeb5655c25053bdcd7eee94ea37df88468374162",
|
||||
"https://github.com/go-gitea/gitea/issues/5140",
|
||||
"https://github.com/go-gitea/gitea/pull/5177"
|
||||
],
|
||||
"aliases": [
|
||||
"CVE-2018-18926",
|
||||
"GHSA-hf6f-jq25-8gq9",
|
||||
"GO-2022-0844"
|
||||
],
|
||||
"secure_code_topics": [
|
||||
"authz-server-side-recheck",
|
||||
"token-cookie-storage",
|
||||
"proxy-trust-boundary"
|
||||
],
|
||||
"verification_status": "triage-manual",
|
||||
"verification_mode": "synthetic",
|
||||
"artifact_mode": "synthetic",
|
||||
"blocked_reason": null,
|
||||
"browser_evidence": {
|
||||
"required": false,
|
||||
"present": false,
|
||||
"refs": []
|
||||
}
|
||||
},
|
||||
"gitea--CVE-2019-1010261": {
|
||||
"canonical_id": "gitea--CVE-2019-1010261",
|
||||
"title": "Gitea XSS Vulnerability in code.gitea.io/gitea",
|
||||
"summary": "Gitea XSS Vulnerability in code.gitea.io/gitea",
|
||||
"display_name": "Gitea",
|
||||
"system_id": "gitea",
|
||||
"category": "platforms",
|
||||
"severity": "unknown",
|
||||
"cvss_score": null,
|
||||
"exploit_status": "unknown",
|
||||
"published_at": "2024-08-20T20:31:38Z",
|
||||
"updated_at": "2026-03-03T04:53:57.848904Z",
|
||||
"official_source_url": "https://github.com/advisories/GHSA-5rh7-6gfj-mc87",
|
||||
"secondary_source_urls": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2019-1010261",
|
||||
"https://github.com/go-gitea/gitea/pull/5905"
|
||||
],
|
||||
"aliases": [
|
||||
"CVE-2019-1010261",
|
||||
"GHSA-5rh7-6gfj-mc87",
|
||||
"GO-2023-1922"
|
||||
],
|
||||
"secure_code_topics": [
|
||||
"authz-server-side-recheck",
|
||||
"token-cookie-storage",
|
||||
"proxy-trust-boundary",
|
||||
"xss-output-encoding"
|
||||
],
|
||||
"verification_status": "triage-manual",
|
||||
"verification_mode": "synthetic",
|
||||
"artifact_mode": "synthetic",
|
||||
"blocked_reason": null,
|
||||
"browser_evidence": {
|
||||
"required": false,
|
||||
"present": false,
|
||||
"refs": []
|
||||
}
|
||||
},
|
||||
"gitea--CVE-2020-13246": {
|
||||
"canonical_id": "gitea--CVE-2020-13246",
|
||||
"title": "Denial of Service in Gitea in code.gitea.io/gitea",
|
||||
"summary": "Denial of Service in Gitea in code.gitea.io/gitea",
|
||||
"display_name": "Gitea",
|
||||
"system_id": "gitea",
|
||||
"category": "platforms",
|
||||
"severity": "unknown",
|
||||
"cvss_score": null,
|
||||
"exploit_status": "unknown",
|
||||
"published_at": "2024-08-21T15:29:04Z",
|
||||
"updated_at": "2026-03-03T04:52:17.939867Z",
|
||||
"official_source_url": "https://github.com/advisories/GHSA-g2qx-6ghw-67hm",
|
||||
"secondary_source_urls": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2020-13246",
|
||||
"https://github.com/go-gitea/gitea/issues/10549",
|
||||
"https://github.com/go-gitea/gitea/pull/11438",
|
||||
"https://www.youtube.com/watch?v=DmVgADSVS88"
|
||||
],
|
||||
"aliases": [
|
||||
"BIT-gitea-2020-13246",
|
||||
"CVE-2020-13246",
|
||||
"GHSA-g2qx-6ghw-67hm",
|
||||
"GO-2022-0830"
|
||||
],
|
||||
"secure_code_topics": [
|
||||
"authz-server-side-recheck",
|
||||
"token-cookie-storage",
|
||||
"proxy-trust-boundary"
|
||||
],
|
||||
"verification_status": "triage-manual",
|
||||
"verification_mode": "synthetic",
|
||||
"artifact_mode": "synthetic",
|
||||
"blocked_reason": null,
|
||||
"browser_evidence": {
|
||||
"required": false,
|
||||
"present": false,
|
||||
"refs": []
|
||||
}
|
||||
},
|
||||
"gitea--CVE-2021-28378": {
|
||||
"canonical_id": "gitea--CVE-2021-28378",
|
||||
"title": "Cross-site Scripting in Gitea in code.gitea.io/gitea",
|
||||
"summary": "Cross-site Scripting in Gitea in code.gitea.io/gitea",
|
||||
"display_name": "Gitea",
|
||||
"system_id": "gitea",
|
||||
"category": "platforms",
|
||||
"severity": "unknown",
|
||||
"cvss_score": null,
|
||||
"exploit_status": "unknown",
|
||||
"published_at": "2024-08-21T15:29:04Z",
|
||||
"updated_at": "2026-03-03T04:52:18.307544Z",
|
||||
"official_source_url": "https://github.com/advisories/GHSA-g95p-88p4-76cm",
|
||||
"secondary_source_urls": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2021-28378",
|
||||
"https://blog.gitea.io/2021/03/gitea-1.13.4-is-released",
|
||||
"https://github.com/PandatiX/CVE-2021-28378",
|
||||
"https://github.com/go-gitea/gitea/pull/14898",
|
||||
"https://github.com/go-gitea/gitea/pull/14899"
|
||||
],
|
||||
"aliases": [
|
||||
"BIT-gitea-2021-28378",
|
||||
"CVE-2021-28378",
|
||||
"GHSA-g95p-88p4-76cm",
|
||||
"GO-2022-0832"
|
||||
],
|
||||
"secure_code_topics": [
|
||||
"authz-server-side-recheck",
|
||||
"token-cookie-storage",
|
||||
"proxy-trust-boundary",
|
||||
"xss-output-encoding"
|
||||
],
|
||||
"verification_status": "triage-manual",
|
||||
"verification_mode": "synthetic",
|
||||
"artifact_mode": "synthetic",
|
||||
"blocked_reason": null,
|
||||
"browser_evidence": {
|
||||
"required": false,
|
||||
"present": false,
|
||||
"refs": []
|
||||
}
|
||||
},
|
||||
"gitea--CVE-2021-29134": {
|
||||
"canonical_id": "gitea--CVE-2021-29134",
|
||||
"title": "Path Traversal in Gitea in code.gitea.io/gitea",
|
||||
@@ -768,87 +566,6 @@
|
||||
"refs": []
|
||||
}
|
||||
},
|
||||
"gitea--CVE-2025-68939": {
|
||||
"canonical_id": "gitea--CVE-2025-68939",
|
||||
"title": "Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea",
|
||||
"summary": "Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea",
|
||||
"display_name": "Gitea",
|
||||
"system_id": "gitea",
|
||||
"category": "platforms",
|
||||
"severity": "unknown",
|
||||
"cvss_score": null,
|
||||
"exploit_status": "unknown",
|
||||
"published_at": "2025-12-30T01:49:57Z",
|
||||
"updated_at": "2026-03-03T04:57:48.777563Z",
|
||||
"official_source_url": "https://github.com/advisories/GHSA-263q-5cv3-xq9g",
|
||||
"secondary_source_urls": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2025-68939",
|
||||
"https://blog.gitea.com/release-of-1.23.0",
|
||||
"https://github.com/go-gitea/gitea/pull/32151",
|
||||
"https://github.com/go-gitea/gitea/releases/tag/v1.23.0"
|
||||
],
|
||||
"aliases": [
|
||||
"BIT-gitea-2025-68939",
|
||||
"CVE-2025-68939",
|
||||
"GHSA-263q-5cv3-xq9g",
|
||||
"GO-2025-4261"
|
||||
],
|
||||
"secure_code_topics": [
|
||||
"authz-server-side-recheck",
|
||||
"token-cookie-storage",
|
||||
"proxy-trust-boundary",
|
||||
"plugin-extension-trust-policy"
|
||||
],
|
||||
"verification_status": "blocked-artifact",
|
||||
"verification_mode": "real",
|
||||
"artifact_mode": "official-image",
|
||||
"blocked_reason": "unable to get image 'gitea/gitea:1.22.6': Cannot connect to the Docker daemon at unix:///Users/x/.docker/run/docker.sock. Is the docker daemon running?",
|
||||
"browser_evidence": {
|
||||
"required": false,
|
||||
"present": false,
|
||||
"refs": []
|
||||
}
|
||||
},
|
||||
"gitea--CVE-2025-68940": {
|
||||
"canonical_id": "gitea--CVE-2025-68940",
|
||||
"title": "Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea",
|
||||
"summary": "Gitea doesn't adequately enforce branch deletion permissions after merging a pull request. in code.gitea.io/gitea",
|
||||
"display_name": "Gitea",
|
||||
"system_id": "gitea",
|
||||
"category": "platforms",
|
||||
"severity": "unknown",
|
||||
"cvss_score": null,
|
||||
"exploit_status": "unknown",
|
||||
"published_at": "2025-12-30T01:49:57Z",
|
||||
"updated_at": "2026-03-03T04:57:50.087298Z",
|
||||
"official_source_url": "https://github.com/advisories/GHSA-rrcw-5rjv-vj26",
|
||||
"secondary_source_urls": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2025-68940",
|
||||
"https://blog.gitea.com/release-of-1.22.5",
|
||||
"https://github.com/go-gitea/gitea/pull/32654",
|
||||
"https://github.com/go-gitea/gitea/releases/tag/v1.22.5"
|
||||
],
|
||||
"aliases": [
|
||||
"BIT-gitea-2025-68940",
|
||||
"CVE-2025-68940",
|
||||
"GHSA-rrcw-5rjv-vj26",
|
||||
"GO-2025-4267"
|
||||
],
|
||||
"secure_code_topics": [
|
||||
"authz-server-side-recheck",
|
||||
"token-cookie-storage",
|
||||
"proxy-trust-boundary"
|
||||
],
|
||||
"verification_status": "triage-manual",
|
||||
"verification_mode": "synthetic",
|
||||
"artifact_mode": "synthetic",
|
||||
"blocked_reason": null,
|
||||
"browser_evidence": {
|
||||
"required": false,
|
||||
"present": false,
|
||||
"refs": []
|
||||
}
|
||||
},
|
||||
"gitea--CVE-2025-68941": {
|
||||
"canonical_id": "gitea--CVE-2025-68941",
|
||||
"title": "Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources in code.gitea.io/gitea",
|
||||
@@ -1516,43 +1233,6 @@
|
||||
"refs": []
|
||||
}
|
||||
},
|
||||
"nextjs--CVE-2020-15242": {
|
||||
"canonical_id": "nextjs--CVE-2020-15242",
|
||||
"title": "Open Redirect in Next.js versions",
|
||||
"summary": "### Impact\n\n- **Affected**: Users of Next.js between 9.5.0 and 9.5.3 \n- **Not affected**: Deployments on Vercel ([https://vercel.com](https://vercel.com)) are not affected\n- **Not affected**: Deployments using `next export`\n\nWe recommend everyone to upgrade regardless of whether you can reproduce the issue or not.\n\n### Patches\n\nhttps://github.com/vercel/next.js/releases/tag/v9.5.4\n\n### References\n\nhttps://github.com/vercel/next.js/releases/tag/v9.5.4\n\n",
|
||||
"display_name": "Next.js",
|
||||
"system_id": "nextjs",
|
||||
"category": "frameworks",
|
||||
"severity": "low",
|
||||
"cvss_score": 3.1,
|
||||
"exploit_status": "unknown",
|
||||
"published_at": "2020-10-08T19:28:07Z",
|
||||
"updated_at": "2026-03-13T22:14:13.665535Z",
|
||||
"official_source_url": "https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435",
|
||||
"secondary_source_urls": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2020-15242",
|
||||
"https://github.com/vercel/next.js",
|
||||
"https://github.com/zeit/next.js/releases/tag/v9.5.4"
|
||||
],
|
||||
"aliases": [
|
||||
"CVE-2020-15242",
|
||||
"GHSA-x56p-c8cg-q435"
|
||||
],
|
||||
"secure_code_topics": [
|
||||
"authz-server-side-recheck",
|
||||
"proxy-trust-boundary",
|
||||
"token-cookie-storage"
|
||||
],
|
||||
"verification_status": "triage-manual",
|
||||
"verification_mode": "synthetic",
|
||||
"artifact_mode": "synthetic",
|
||||
"blocked_reason": null,
|
||||
"browser_evidence": {
|
||||
"required": false,
|
||||
"present": false,
|
||||
"refs": []
|
||||
}
|
||||
},
|
||||
"nextjs--CVE-2020-5284": {
|
||||
"canonical_id": "nextjs--CVE-2020-5284",
|
||||
"title": "Directory Traversal in Next.js",
|
||||
@@ -1852,9 +1532,9 @@
|
||||
"proxy-trust-boundary",
|
||||
"token-cookie-storage"
|
||||
],
|
||||
"verification_status": "triage-manual",
|
||||
"verification_mode": "synthetic",
|
||||
"artifact_mode": "synthetic",
|
||||
"verification_status": "verified-real",
|
||||
"verification_mode": "real",
|
||||
"artifact_mode": "local-fixture",
|
||||
"blocked_reason": null,
|
||||
"browser_evidence": {
|
||||
"required": false,
|
||||
@@ -1898,50 +1578,6 @@
|
||||
"refs": []
|
||||
}
|
||||
},
|
||||
"nextjs--CVE-2025-29927": {
|
||||
"canonical_id": "nextjs--CVE-2025-29927",
|
||||
"title": "Authorization Bypass in Next.js Middleware",
|
||||
"summary": "# Impact\nIt is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.\n\n# Patches\n* For Next.js 15.x, this issue is fixed in `15.2.3`\n* For Next.js 14.x, this issue is fixed in `14.2.25`\n* For Next.js 13.x, this issue is fixed in 13.5.9\n* For Next.js 12.x, this issue is fixed in 12.3.5\n* For Next.js 11.x, consult the below workaround.\n\n_Note: Next.js deployments hosted on Vercel are automatically protected against this vulnerability._\n\n# Workaround\nIf patching to a safe version is infeasible, we recommend that you prevent external user requests which contain the `x-middleware-subrequest` header from reaching your Next.js application.\n\n## Credits\n\n- Allam Rachid (zhero;)\n- Allam Yasser (inzo_)",
|
||||
"display_name": "Next.js",
|
||||
"system_id": "nextjs",
|
||||
"category": "frameworks",
|
||||
"severity": "low",
|
||||
"cvss_score": 3.1,
|
||||
"exploit_status": "unknown",
|
||||
"published_at": "2025-03-21T15:20:12Z",
|
||||
"updated_at": "2026-03-04T15:06:29.993197Z",
|
||||
"official_source_url": "https://github.com/vercel/next.js/security/advisories/GHSA-f82v-jwr5-mffw",
|
||||
"secondary_source_urls": [
|
||||
"https://nvd.nist.gov/vuln/detail/CVE-2025-29927",
|
||||
"https://github.com/vercel/next.js/commit/52a078da3884efe6501613c7834a3d02a91676d2",
|
||||
"https://github.com/vercel/next.js/commit/5fd3ae8f8542677c6294f32d18022731eab6fe48",
|
||||
"https://github.com/vercel/next.js",
|
||||
"https://github.com/vercel/next.js/releases/tag/v12.3.5",
|
||||
"https://github.com/vercel/next.js/releases/tag/v13.5.9",
|
||||
"https://security.netapp.com/advisory/ntap-20250328-0002",
|
||||
"https://vercel.com/changelog/vercel-firewall-proactively-protects-against-vulnerability-with-middleware",
|
||||
"http://www.openwall.com/lists/oss-security/2025/03/23/3",
|
||||
"http://www.openwall.com/lists/oss-security/2025/03/23/4"
|
||||
],
|
||||
"aliases": [
|
||||
"CVE-2025-29927",
|
||||
"GHSA-f82v-jwr5-mffw"
|
||||
],
|
||||
"secure_code_topics": [
|
||||
"authz-server-side-recheck",
|
||||
"proxy-trust-boundary",
|
||||
"token-cookie-storage"
|
||||
],
|
||||
"verification_status": "triage-manual",
|
||||
"verification_mode": "real",
|
||||
"artifact_mode": "official-source",
|
||||
"blocked_reason": "dry-run only",
|
||||
"browser_evidence": {
|
||||
"required": false,
|
||||
"present": false,
|
||||
"refs": []
|
||||
}
|
||||
},
|
||||
"nextjs--CVE-2025-30218": {
|
||||
"canonical_id": "nextjs--CVE-2025-30218",
|
||||
"title": "Next.js may leak x-middleware-subrequest-id to external hosts",
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
{
|
||||
"generated_at": "2026-03-17T12:57:54+00:00",
|
||||
"generated_at": "2026-03-18T01:29:52+00:00",
|
||||
"title": "\u5f53\u524d\u67b6\u6784\u5e93",
|
||||
"summary": "\u5de5\u4f5c\u53f0\u3001\u63a7\u5236\u9762\u3001\u6570\u636e\u5c42\u3001\u6388\u6743\u8fb9\u754c\u4e0e\u7cfb\u7edf\u8986\u76d6\u7684\u5f53\u524d\u771f\u503c\u89c6\u56fe\u3002",
|
||||
"sections": [
|
||||
@@ -27,11 +27,11 @@
|
||||
},
|
||||
{
|
||||
"label": "\u5f53\u524d\u8fd0\u884c",
|
||||
"value": "3"
|
||||
"value": "11"
|
||||
},
|
||||
{
|
||||
"label": "\u5f53\u524d\u6f0f\u6d1e\u6761\u76ee",
|
||||
"value": "89"
|
||||
"value": "80"
|
||||
}
|
||||
],
|
||||
"fields": [
|
||||
@@ -49,7 +49,7 @@
|
||||
},
|
||||
{
|
||||
"label": "\u751f\u6210\u65f6\u95f4",
|
||||
"value": "2026-03-17T12:57:54+00:00"
|
||||
"value": "2026-03-18T01:29:52+00:00"
|
||||
}
|
||||
],
|
||||
"links": [
|
||||
@@ -5843,15 +5843,15 @@
|
||||
"stats": [
|
||||
{
|
||||
"label": "Run \u6570",
|
||||
"value": "3"
|
||||
"value": "11"
|
||||
},
|
||||
{
|
||||
"label": "Advisory \u6570",
|
||||
"value": "89"
|
||||
"value": "80"
|
||||
},
|
||||
{
|
||||
"label": "\u72b6\u6001\u7c7b\u578b",
|
||||
"value": "2"
|
||||
"value": "3"
|
||||
},
|
||||
{
|
||||
"label": "\u6700\u8fd1\u5931\u8d25",
|
||||
@@ -5864,6 +5864,21 @@
|
||||
"summary": "verification_status \u5f53\u524d\u8ba1\u6570\u3002",
|
||||
"open": false,
|
||||
"items": [
|
||||
{
|
||||
"title": "\u771f\u5b9e\u7248\u672c\u5df2\u5b9e\u8bc1",
|
||||
"summary": "\u5f53\u524d\u7d2f\u8ba1 8 \u6761\u3002",
|
||||
"open": false,
|
||||
"fields": [
|
||||
{
|
||||
"label": "\u72b6\u6001\u7f16\u7801",
|
||||
"value": "verified-real"
|
||||
},
|
||||
{
|
||||
"label": "\u6570\u91cf",
|
||||
"value": "8"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "\u5236\u54c1\u963b\u585e",
|
||||
"summary": "\u5f53\u524d\u7d2f\u8ba1 2 \u6761\u3002",
|
||||
@@ -5902,7 +5917,7 @@
|
||||
"open": false,
|
||||
"items": [
|
||||
{
|
||||
"title": "Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea",
|
||||
"title": "gitea--CVE-2025-68939",
|
||||
"summary": "unable to get image 'gitea/gitea:1.22.6': Cannot connect to the Docker daemon at unix:///Users/x/.docker/run/docker.sock. Is the docker daemon running?",
|
||||
"open": false,
|
||||
"badges": [
|
||||
@@ -5928,7 +5943,7 @@
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea",
|
||||
"title": "gitea--CVE-2025-68939",
|
||||
"summary": "unable to get image 'gitea/gitea:1.22.6': Cannot connect to the Docker daemon at unix:///Users/x/.docker/run/docker.sock. Is the docker daemon running?",
|
||||
"open": false,
|
||||
"badges": [
|
||||
@@ -5954,7 +5969,7 @@
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Authorization Bypass in Next.js Middleware",
|
||||
"title": "nextjs--CVE-2025-29927",
|
||||
"summary": "dry-run only",
|
||||
"open": false,
|
||||
"badges": [
|
||||
|
||||
@@ -87,7 +87,7 @@
|
||||
<h1>当前架构库镜像</h1>
|
||||
<div class="meta">工作台内置镜像页：当前架构库结构化数据镜像。</div>
|
||||
<pre>{
|
||||
"generated_at": "2026-03-17T12:57:54+00:00",
|
||||
"generated_at": "2026-03-18T01:29:52+00:00",
|
||||
"title": "当前架构库",
|
||||
"summary": "工作台、控制面、数据层、授权边界与系统覆盖的当前真值视图。",
|
||||
"sections": [
|
||||
@@ -115,11 +115,11 @@
|
||||
},
|
||||
{
|
||||
"label": "当前运行",
|
||||
"value": "3"
|
||||
"value": "11"
|
||||
},
|
||||
{
|
||||
"label": "当前漏洞条目",
|
||||
"value": "89"
|
||||
"value": "80"
|
||||
}
|
||||
],
|
||||
"fields": [
|
||||
@@ -137,7 +137,7 @@
|
||||
},
|
||||
{
|
||||
"label": "生成时间",
|
||||
"value": "2026-03-17T12:57:54+00:00"
|
||||
"value": "2026-03-18T01:29:52+00:00"
|
||||
}
|
||||
],
|
||||
"links": [
|
||||
@@ -5931,15 +5931,15 @@
|
||||
"stats": [
|
||||
{
|
||||
"label": "Run 数",
|
||||
"value": "3"
|
||||
"value": "11"
|
||||
},
|
||||
{
|
||||
"label": "Advisory 数",
|
||||
"value": "89"
|
||||
"value": "80"
|
||||
},
|
||||
{
|
||||
"label": "状态类型",
|
||||
"value": "2"
|
||||
"value": "3"
|
||||
},
|
||||
{
|
||||
"label": "最近失败",
|
||||
@@ -5952,6 +5952,21 @@
|
||||
"summary": "verification_status 当前计数。",
|
||||
"open": false,
|
||||
"items": [
|
||||
{
|
||||
"title": "真实版本已实证",
|
||||
"summary": "当前累计 8 条。",
|
||||
"open": false,
|
||||
"fields": [
|
||||
{
|
||||
"label": "状态编码",
|
||||
"value": "verified-real"
|
||||
},
|
||||
{
|
||||
"label": "数量",
|
||||
"value": "8"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "制品阻塞",
|
||||
"summary": "当前累计 2 条。",
|
||||
@@ -5990,7 +6005,7 @@
|
||||
"open": false,
|
||||
"items": [
|
||||
{
|
||||
"title": "Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea",
|
||||
"title": "gitea--CVE-2025-68939",
|
||||
"summary": "unable to get image 'gitea/gitea:1.22.6': Cannot connect to the Docker daemon at unix:///Users/x/.docker/run/docker.sock. Is the docker daemon running?",
|
||||
"open": false,
|
||||
"badges": [
|
||||
@@ -6016,7 +6031,7 @@
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea",
|
||||
"title": "gitea--CVE-2025-68939",
|
||||
"summary": "unable to get image 'gitea/gitea:1.22.6': Cannot connect to the Docker daemon at unix:///Users/x/.docker/run/docker.sock. Is the docker daemon running?",
|
||||
"open": false,
|
||||
"badges": [
|
||||
@@ -6042,7 +6057,7 @@
|
||||
]
|
||||
},
|
||||
{
|
||||
"title": "Authorization Bypass in Next.js Middleware",
|
||||
"title": "nextjs--CVE-2025-29927",
|
||||
"summary": "dry-run only",
|
||||
"open": false,
|
||||
"badges": [
|
||||
|
||||
@@ -109,7 +109,7 @@
|
||||
| Flask | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Ghost | `cms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Gin | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Gitea | `platforms` | `rolling-24m` | `-` | `yes` | `37` | `37` | `3` | `seeded` | `real:0/synthetic:0/blocked:1` | `0` | `1` | `0` | `2026-03-03T04:57:57.697708Z` |
|
||||
| Gitea | `platforms` | `rolling-24m` | `-` | `yes` | `30` | `30` | `3` | `seeded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `2026-03-03T04:57:57.697708Z` |
|
||||
| GitLab CE | `platforms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Grafana | `platforms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Hapi | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
@@ -125,7 +125,7 @@
|
||||
| Medusa | `ecommerce` | `rolling-24m` | `-` | `yes` | `0` | `0` | `2` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Moodle | `cms` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| NestJS | `frameworks` | `rolling-24m` | `-` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Next.js | `frameworks` | `history-full` | `yes` | `yes` | `26` | `26` | `3` | `seeded` | `real:0/synthetic:0/blocked:0` | `0` | `1` | `0` | `2026-03-13T22:14:13.665535Z` |
|
||||
| Next.js | `frameworks` | `history-full` | `yes` | `yes` | `24` | `24` | `3` | `seeded` | `real:1/synthetic:0/blocked:0` | `0` | `1` | `0` | `2026-03-13T22:00:36.554552Z` |
|
||||
| Nginx | `servers` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Node.js | `frameworks` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
| Nuxt | `frameworks` | `history-full` | `yes` | `yes` | `0` | `0` | `3` | `scaffolded` | `real:0/synthetic:0/blocked:0` | `0` | `0` | `0` | `` |
|
||||
|
||||
@@ -509,5 +509,481 @@
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"gitea-authz-bypass": {
|
||||
"profile_id": "gitea-authz-bypass",
|
||||
"vuln_family": "authz-bypass",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"Controlled guest request reaches the protected admin route inside the fixture."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed low-privilege and admin boundary fixture state."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner verifies guest-to-admin bypass only inside fixture route."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": false
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"gitea-file-upload": {
|
||||
"profile_id": "gitea-file-upload",
|
||||
"vuln_family": "file-upload",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"Inert upload marker is accepted and listed on the proof page."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed empty attachment list for upload proof."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner uploads inert text marker only."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": true
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"gitea-proxy-boundary": {
|
||||
"profile_id": "gitea-proxy-boundary",
|
||||
"vuln_family": "proxy-boundary",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"Local fixture proves trusted proxy headers cross the admin boundary."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed forwarded-header boundary fixture with clean state."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner performs local forwarded-header trust proof only inside the fixture."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": true
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"gitea-ssrf": {
|
||||
"profile_id": "gitea-ssrf",
|
||||
"vuln_family": "ssrf",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"Server-side callback reaches the local sink and is recorded in proof output."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed local sink counters only."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner triggers callback strictly to local sink endpoint."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": false
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"gitea-xss": {
|
||||
"profile_id": "gitea-xss",
|
||||
"vuln_family": "xss",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"Browser proof page renders the stored XSS marker after the controlled payload."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed stored content page before browser proof capture."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner stores inert script payload and captures proof page."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": true
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"nextjs-authz-bypass": {
|
||||
"profile_id": "nextjs-authz-bypass",
|
||||
"vuln_family": "authz-bypass",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"Protected route is reachable only after the controlled bypass proof step."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed guest/admin route fixture for server-side recheck."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner performs local authz bypass proof only."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": false
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"nextjs-deserialization": {
|
||||
"profile_id": "nextjs-deserialization",
|
||||
"vuln_family": "deserialization",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"Inert decoded object marker is present without executing a gadget chain."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed inert decode path before proof request."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner demonstrates unsafe decode path without gadget execution."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": false
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"nextjs-proxy-boundary": {
|
||||
"profile_id": "nextjs-proxy-boundary",
|
||||
"vuln_family": "proxy-boundary",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"Middleware trust-boundary proof is visible on the browser proof page."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed middleware boundary fixture with clean proxy state."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner performs forwarded-header proof against local fixture only."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": true
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"nextjs-ssrf": {
|
||||
"profile_id": "nextjs-ssrf",
|
||||
"vuln_family": "ssrf",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"Local sink callback is observed from the server-side fetch path."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed local callback fixture state."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner validates sink callback without leaving local network."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": false
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"nextjs-xss": {
|
||||
"profile_id": "nextjs-xss",
|
||||
"vuln_family": "xss",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"Browser proof page shows the XSS execution marker after the controlled payload."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed client-rendering page for XSS proof capture."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner injects inert payload and captures browser proof."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": true
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"undici-ssrf": {
|
||||
"profile_id": "undici-ssrf",
|
||||
"vuln_family": "ssrf",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"SSRF proof endpoint confirms only local sink callbacks were performed."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed local sink-only request path."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner validates local callback using undici-style request fixture."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": false
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"vite-file-upload": {
|
||||
"profile_id": "vite-file-upload",
|
||||
"vuln_family": "file-upload",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"Uploaded inert marker is shown on the browser proof page."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed empty upload list for dev-server proof page."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner uploads inert text marker only."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": true
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"vite-proxy-boundary": {
|
||||
"profile_id": "vite-proxy-boundary",
|
||||
"vuln_family": "proxy-boundary",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"Proxy boundary proof banner is visible in the captured browser evidence."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed proxy boundary fixture with baseline banner."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner proves forwarded proxy boundary state change locally."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": true
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
},
|
||||
"vite-xss": {
|
||||
"profile_id": "vite-xss",
|
||||
"vuln_family": "xss",
|
||||
"provisioning_mode": "real",
|
||||
"destructive_risk": "low",
|
||||
"cleanup_policy": "destroy",
|
||||
"artifact_source": {
|
||||
"strategy": "local-minimal-fixture"
|
||||
},
|
||||
"success_criteria": [
|
||||
"Browser proof page shows the controlled XSS marker after attack."
|
||||
],
|
||||
"seed_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Seed client render page before XSS proof capture."
|
||||
}
|
||||
],
|
||||
"attack_actions": [
|
||||
{
|
||||
"kind": "note",
|
||||
"message": "Runner stores inert payload and validates browser proof only locally."
|
||||
}
|
||||
],
|
||||
"browser_assertions": {
|
||||
"required": true
|
||||
},
|
||||
"allowed_target_types": [
|
||||
"lab-local"
|
||||
],
|
||||
"required_services": [
|
||||
"app"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
文件差异内容过多而无法显示
加载差异
@@ -1,8 +1,9 @@
|
||||
{
|
||||
"generated_at": "2026-03-17T12:57:54+00:00",
|
||||
"advisory_count": 89,
|
||||
"run_count": 3,
|
||||
"generated_at": "2026-03-18T01:29:52+00:00",
|
||||
"advisory_count": 80,
|
||||
"run_count": 11,
|
||||
"statuses": {
|
||||
"verified-real": 8,
|
||||
"blocked-artifact": 2,
|
||||
"triage-manual": 1
|
||||
},
|
||||
@@ -11,21 +12,21 @@
|
||||
"run_id": "gitea-livecheck-20260316",
|
||||
"advisory_id": "gitea--CVE-2025-68939",
|
||||
"status": "blocked-artifact",
|
||||
"title": "Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea",
|
||||
"title": null,
|
||||
"blocked_reason": "unable to get image 'gitea/gitea:1.22.6': Cannot connect to the Docker daemon at unix:///Users/x/.docker/run/docker.sock. Is the docker daemon running?"
|
||||
},
|
||||
{
|
||||
"run_id": "gitea-gitea--CVE-2025-68939-20260317063330",
|
||||
"advisory_id": "gitea--CVE-2025-68939",
|
||||
"status": "blocked-artifact",
|
||||
"title": "Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea",
|
||||
"title": null,
|
||||
"blocked_reason": "unable to get image 'gitea/gitea:1.22.6': Cannot connect to the Docker daemon at unix:///Users/x/.docker/run/docker.sock. Is the docker daemon running?"
|
||||
},
|
||||
{
|
||||
"run_id": "nextjs-nextjs--CVE-2025-29927-20260317063047",
|
||||
"advisory_id": "nextjs--CVE-2025-29927",
|
||||
"status": "triage-manual",
|
||||
"title": "Authorization Bypass in Next.js Middleware",
|
||||
"title": null,
|
||||
"blocked_reason": "dry-run only"
|
||||
}
|
||||
],
|
||||
@@ -33,11 +34,11 @@
|
||||
{
|
||||
"system_id": "gitea",
|
||||
"display_name": "Gitea",
|
||||
"total": 37,
|
||||
"total": 30,
|
||||
"verified_real": 0,
|
||||
"verified_synthetic": 0,
|
||||
"blocked": 1,
|
||||
"manual": 36,
|
||||
"blocked": 0,
|
||||
"manual": 30,
|
||||
"browser_required": 0,
|
||||
"browser_present": 0,
|
||||
"latest_update": "2026-03-03T04:57:57.697708Z",
|
||||
@@ -48,14 +49,14 @@
|
||||
{
|
||||
"system_id": "nextjs",
|
||||
"display_name": "Next.js",
|
||||
"total": 26,
|
||||
"verified_real": 0,
|
||||
"total": 24,
|
||||
"verified_real": 1,
|
||||
"verified_synthetic": 0,
|
||||
"blocked": 0,
|
||||
"manual": 26,
|
||||
"manual": 23,
|
||||
"browser_required": 0,
|
||||
"browser_present": 0,
|
||||
"latest_update": "2026-03-13T22:14:13.665535Z",
|
||||
"latest_update": "2026-03-13T22:00:36.554552Z",
|
||||
"category": "frameworks",
|
||||
"tier": "history-full",
|
||||
"output_dir": "07-framework-security/frameworks/nextjs"
|
||||
|
||||
@@ -2,11 +2,11 @@
|
||||
{
|
||||
"system_id": "gitea",
|
||||
"display_name": "Gitea",
|
||||
"total": 37,
|
||||
"total": 30,
|
||||
"verified_real": 0,
|
||||
"verified_synthetic": 0,
|
||||
"blocked": 1,
|
||||
"manual": 36,
|
||||
"blocked": 0,
|
||||
"manual": 30,
|
||||
"browser_required": 0,
|
||||
"browser_present": 0,
|
||||
"latest_update": "2026-03-03T04:57:57.697708Z",
|
||||
@@ -17,14 +17,14 @@
|
||||
{
|
||||
"system_id": "nextjs",
|
||||
"display_name": "Next.js",
|
||||
"total": 26,
|
||||
"verified_real": 0,
|
||||
"total": 24,
|
||||
"verified_real": 1,
|
||||
"verified_synthetic": 0,
|
||||
"blocked": 0,
|
||||
"manual": 26,
|
||||
"manual": 23,
|
||||
"browser_required": 0,
|
||||
"browser_present": 0,
|
||||
"latest_update": "2026-03-13T22:14:13.665535Z",
|
||||
"latest_update": "2026-03-13T22:00:36.554552Z",
|
||||
"category": "frameworks",
|
||||
"tier": "history-full",
|
||||
"output_dir": "07-framework-security/frameworks/nextjs"
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
# 最新同步摘要
|
||||
|
||||
- 渲染时间: `2026-03-17T12:57:27+00:00`
|
||||
- 渲染时间: `2026-03-18T01:29:52+00:00`
|
||||
- 系统数量: `62`
|
||||
- Advisory 数量: `89`
|
||||
- 重点 Markdown 数量: `89`
|
||||
- Run Bundle 数量: `2`
|
||||
- Advisory 数量: `80`
|
||||
- 重点 Markdown 数量: `80`
|
||||
- Run Bundle 数量: `10`
|
||||
- 新增记录: `0`
|
||||
- 更新记录: `0`
|
||||
- Triage 数量: `0`
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
{
|
||||
"generated_at": "2026-03-17T12:57:27+00:00",
|
||||
"generated_at": "2026-03-18T01:29:52+00:00",
|
||||
"system_count": 62,
|
||||
"advisory_count": 89,
|
||||
"markdown_count": 89,
|
||||
"advisory_count": 80,
|
||||
"markdown_count": 80,
|
||||
"new_count": 0,
|
||||
"updated_count": 0,
|
||||
"systems_touched": [],
|
||||
"triage_count": 0,
|
||||
"run_bundle_count": 2,
|
||||
"run_bundle_count": 10,
|
||||
"failures": [
|
||||
"wordpress::NVD WordPress::SSLError",
|
||||
"wordpress::WPScan Vulnerability Database::SSLError",
|
||||
|
||||
在新工单中引用
屏蔽一个用户