Node.js安全漏洞
Shoulder检测到125个特定于使用Node.js构建的Node.js应用程序的安全模式。
框架覆盖
漏洞类别
CWE-20
7 规则
Improper Input Validation
CWE-200
5 规则
Exposure of Sensitive Information to an Unauthorized Actor
2 critical
CWE-704
5 规则
Incorrect Type Conversion or Cast
CWE-798
5 规则
Use of Hard-coded Credentials
2 critical
CWE-89
4 规则
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
4 critical
CWE-79
3 规则
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
1 critical
CWE-94
3 规则
Improper Control of Generation of Code ('Code Injection')
1 critical
CWE-285
3 规则
Improper Authorization
3 critical
CWE-639
3 规则
Authorization Bypass Through User-Controlled Key
1 critical
CWE-22
2 规则
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
1 critical
CWE-117
2 规则
Improper Output Neutralization for Logs
CWE-209
2 规则
Generation of Error Message Containing Sensitive Information
CWE-327
2 规则
Use of a Broken or Risky Cryptographic Algorithm
CWE-400
2 规则
Uncontrolled Resource Consumption
CWE-502
2 规则
Deserialization of Untrusted Data
1 critical
CWE-601
2 规则
URL Redirection to Untrusted Site ('Open Redirect')
CWE-770
2 规则
Allocation of Resources Without Limits or Throttling
CWE-915
2 规则
Improperly Controlled Modification of Dynamically-Determined Object Attributes
2 critical
CWE-918
2 规则
Server-Side Request Forgery (SSRF)
CWE-1104
2 规则
Use of Unmaintained Third Party Components