奇安信CodeSafe
奇安信CodeSafe
There is no check for the failed malloc https://github.com/uber/h3/blob/ed5c4f254af2ffbd527d507d3bdd7019df4120fc/src/h3lib/lib/h3Index.c#L355 This in turn would cause a segfault， when buff is dereferenced https://github.com/uber/h3/blob/ed5c4f254af2ffbd527d507d3bdd7019df4120fc/src/h3lib/lib/h3Index.c#L372
https://github.com/vipshop/Saturn/blob/032796b7036d53f09a75de0a13808e48dce210f7/pom.xml#L44 CVE-2018-1270 CVE-2018-1275 CVE-2016-9878 CVE-2018-1272 Recommended upgrade version：4.3.28-1
https://github.com/vipshop/Saturn/blob/032796b7036d53f09a75de0a13808e48dce210f7/pom.xml#L73 CVE-2020-9546 CVE-2018-19360 CVE-2018-19361 CVE-2018-19362 CVE-2019-14379 CVE-2019-14540 Recommended upgrade version：2.9.10.6
https://github.com/vipshop/Saturn/blob/032796b7036d53f09a75de0a13808e48dce210f7/pom.xml#L60 CVE-2018-10237 Recommended upgrade version：24.1.1.jre
https://github.com/vipshop/Saturn/blob/032796b7036d53f09a75de0a13808e48dce210f7/pom.xml#L62 CVE-2016-1000031 CVE-2016-3092 CVE-2014-0050 Recommended upgrade version：1.3.3
https://github.com/Meituan-Dianping/Leaf/blob/5c409fbf111b7747e5a32424394d7ac07b0fa9d8/leaf-core/src/main/java/com/sankuai/inf/leaf/segment/SegmentIDGenImpl.java#L130-L132 Double-Checked Locking is widely cited and used as an efficient method for implementing lazy initialization in a multithreaded environment. Unfortunately, it will not work reliably in a platform independent...
您好： 我是360代码安全的工作人员，在我们的开源代码检测项目中发现perfect-ssm中存在两处反射型xss漏洞，详细信息如下：  在pictureManage.jsp文件的27、28行处接受了get请求中的type、grade参数，并直接在33、75行等地方进行html拼凑，导致恶意攻击者可以通过构造特定的链接 复现： 构造如下链接： http://perfect-ssm.13blog.site/views/pictureManage.jsp?type=1&grade=%22%3E%3C/table%3E%3C/body%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E// 当管理员访问时会执行脚本  这里以弹框为例，实际攻击场景中会将cookie发送到受控制的服务器上
https://github.com/yahoo/fili/blob/afa3b6c4d36493d643adb8644f88ea707c7c3995/fili-sql/pom.xml#L31 CVE-2020-13955 Recommended upgrade version：1.26.0
https://github.com/yahoo/fili/blob/97e9e9b5bcd48a2646e28b0eeb9e543a603c1ead/fili-core/src/main/java/com/yahoo/bard/webservice/web/endpoints/DimensionCacheLoaderServlet.java#L95 https://github.com/yahoo/fili/blob/97e9e9b5bcd48a2646e28b0eeb9e543a603c1ead/fili-core/src/main/java/com/yahoo/bard/webservice/web/endpoints/DimensionCacheLoaderServlet.java#L108 Json serialization libraries which turn object graphs into Json formatted data may include the necessary metadata to reconstruct the objects back from the Json stream. If attackers can...
https://github.com/yahoo/fili/blob/97e9e9b5bcd48a2646e28b0eeb9e543a603c1ead/fili-core/src/main/java/com/yahoo/bard/webservice/util/IntervalUtils.java#L36 Unused Field