The version of phpMyAdmin installed on the remote web server is 4.9.x prior to 4.9.5 or 5.0.x prior to 5.0.2. 因此，它會受到多個弱點影響。
 - 惡意使用者可能會建立導致 SQL 插入的特製使用者名稱。
 - 如果使用者隨後對所建立的表格執行特定搜尋作業，惡意使用者可能會建立導致 SQL 插入的特製資料庫或表格名稱。
 - An attacker may be able to insert crafted data in certain database tables, which when retrieved trigger a XSS attack. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端主機上安裝的 phpMyAdmin 版本未正確處理在使用者帳戶頁面上建立查詢時插入的惡意 sql，進而導致 SQL 插入弱點。Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of phpMyAdmin installed on the remote host does not sanitize the database name parameter inside the Designer feature, leading to exposure to a SQL injection vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

phpMyAdmin 版本受到登入表單中的跨網站要求偽造 (CSRF) 弱點影響，可能導致攻擊者執行 SQL 插入。Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of phpMyAdmin installed on the remote host does not correctly handle malicious database names in the Designer feature leading to a SQL injection vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端主機上安裝的 phpMyAdmin 版本未正確處理惡意使用者名稱，進而導致透過設計器功能發動 SQL 插入攻擊。Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端主機上安裝的 phpMyAdmin 版本未正確封鎖對 LOAD DATA INFILE 函式的存取，導致攻擊者能夠讀取可使用 Web 伺服器權限存取的檔案系統上的任何檔案。Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of phpMyAdmin installed on the remote host does not correctly sanitize database/table names leading to a leading to a Cross-Site Scripting (XSS) vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端主機上安裝的 phpMyAdmin 版本受到一個跨網站要求偽造 (XSRF/CSRF) 弱點影響，可導致插入有害的 SQL 查詢。弱點。Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端主機上安裝的 phpMyAdmin 版本在轉換功能中有一個瑕疵，可能允許經驗證的攻擊者洩漏本機檔案的內容。Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端主機上安裝的 phpMyAdmin 版本未正確處理導致跨網站指令碼 (XSS) 弱點的惡意檔案名稱。Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端主機上安裝的 phpMyAdmin 版本未正確處理頁面重新導向和允許的頁面測試不當，進而導致執行任意程式碼和/或檢視敏感檔案。Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of phpMyAdmin installed on the remote host does not sanitize the database name parameter inside the Designer feature, leading to a Cross-Site Scripting (XSS) vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端主機上安裝的 phpMyAdmin 版本允許攻擊者誘騙使用者按一下特製的 URL 連結，進而允許攻擊者執行任意 SQL 命令。Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

遠端主機上安裝的 phpMyAdmin 版本未清理用於 db_central_columns 參數的使用者輸入，進而導致跨網站指令碼 (XSS) 弱點。Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.10 or 8.6.x prior to 8.13.1. 因此，會受到跨網站要求偽造 (CSRF) 弱點的影響，此弱點是在洩漏使用者 CSRF token 的查閱者標頭中之後發生的。

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

根據 Atlassian Jira 自我報告的版本號碼，遠端 Web 伺服器上主控的執行個體版本為 8.19.1 之前的 8.5.x 版。因此，受到一個弱點影響，其允許已從 Jira Service Management 撤銷其存取權的遠端攻擊者透過 /secure/ViewCollector 端點中的不當驗證弱點，在 Jira Service Management 專案上啟用和停用問題收集器。

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.15 or 8.14.x prior to 8.20.3. It is, therefore, affected by a vulnerability allowing remote attackers with administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

根據 Atlassian Jira 自我報告的版本號碼，遠端 Web 伺服器上託管的執行個體版本早於 8.20.3。因此，受到一個弱點影響，具有 Roadmaps 管理員權限的遠端攻擊者可透過 /rest/jpo/1.0/hierarchyConfiguration 端點中的已儲存跨網站指令碼 (SXSS) 弱點插入任意 HTML 或 JavaScript。

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.16 or 8.14.x prior to 8.20.5. It is, therefore, affected by a vulnerability allowing unauthenticated remote attackers to toggle the Thread Contention and CPU monitoring settings via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/ViewInstrumentation.jspa endpoint.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

根據 Atlassian Jira 自我報告的版本號碼，遠端 Web 伺服器上託管的執行個體版本早於 8.20.1。因此，受到一個弱點影響，該弱點允許經驗證的非管理員遠端攻擊者透過 /secure/admin/ConfigureBatching!default.jspa 端點中的不當授權弱點編輯電子郵件批次組態。

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.12 or 8.14.x prior to 8.20.2. 因此受到一個弱點影響，允許匿名遠端攻擊者透過 /secure/admin/ImporterFinishedPage.jspa 錯誤訊息中的跨網站指令碼 (XSS) 弱點插入任意 HTML 或 JavaScript。

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.18 or 8.20.x prior to 8.20.6. It is, therefore, affected by a vulnerability allowing authenticated remote attackers to restore the default configuration of fields via a Cross-Site Request Forgery (CSRF) vulnerability in the /secure/admin/RestoreDefaults.jspa endpoint.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.15 or 8.14.x prior to 8.20.3. 因此，它會受到多個弱點影響：

 - 可在電子郵件範本功能中導致遠端程式碼執行的範本插入，允許具有管理員權限的遠端攻擊者執行任意程式碼。

 - /rest/collectors/

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.13.15 or 8.14.x prior to 8.20.3. 因此，它會受到多個弱點影響：

 - 可在電子郵件範本功能中導致遠端程式碼執行的範本插入，允許具有管理員權限的遠端攻擊者執行任意程式碼。

 - /rest/collectors/1.0/template/custom 端點中有一個反映式跨網站指令碼 (XSS) 弱點，允許遠端攻擊者插入任意 HTML 或 JavaScript。

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is 8.0.x prior to 8.13.22, 8.14.x prior to 8.20.10 or 8.21.x prior to 8.21.4. 因此受到一個弱點影響，該弱點允許經驗證的遠端使用者 (包括透過註冊功能加入的使用者) 透過批次端點執行完整的讀取伺服器端要求。

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ManageEngine ADAudit Plus 7060 之前版本受到 XML 外部實體 (XXE) 弱點影響。未經驗證的遠端攻擊者可利用此弱點，在目標伺服器上上傳序列化的 Java 物件，並透過 `ceworlf` 端點將其還原序列化，進而實現遠端程式碼執行攻擊。

Oracle Fusion Middleware 的 Oracle Access Manager 產品中存在弱點 (元件：OpenSSO Agent)，經由 HTTP 存取網路的未經驗證的攻擊者可藉此入侵 Oracle Access Manager。若成功攻擊此弱點，則可接管 Oracle Access Manager。受影響的支援版本是 11.1.2.3.0、12.2.1.3.0 和 12.2.1.4.0 。

Atlassian Jira 版本 < 8.13.18、8.14.x、8.15.x、8.16.x、8.17.x、8.18.x、8.19.x、8.20.x < 8.20.6、8.21.x 和 Atlassian Jira Service Management 版本 < 4.13.18、4.14.x、4.15.x、4.16.x、4.17.x、4.18.x、4.19.x、4.20.x < 4.20.6 和 4.21.x 使用名為 Atlassian Jira Seraph 的通用驗證架構，而此架構受到驗證繞過弱點影響。

未經驗證的遠端攻擊者可藉由特製特定的 HTTP 要求，利用此弱點來繞過使用受影響設定的 WebWork 動作中的驗證和授權要求。此弱點的影響取決於 Jira 或 Jira Service Management 執行個體中使用的應用程式，以及這些應用程式使用 Jira Seraph 架構的方式。

Oracle Java SE 15、17 和 18 版，以及 Oracle GraalVM Enterprise Edition 21.3.1 和 22.0.0.2 版未正確驗證以橢圓曲線數位簽章演算法 (ECDSA) 為基礎的簽章。攻擊者可藉由將簽章的 `r` 和 `s` 元件值強制為零，針對任何訊息和公開金鑰偽造有效的簽章，而包含弱點的程式庫或元件版本會接受該簽章。攻擊者可利用此弱點來繞過任何依賴此演算法及其 Java 實作的安全性機制。

遠端主機上安裝的 Apache Tomcat 版本介於 8.5.50 至 8.5.81、9.0.30 至 9.0.64、10.0.0-M1 至 10.0.22 或 10.1.0-M1 至 10.1.0-M16 之間。因此，它受到跨網站指令碼 (XSS) 弱點影響。範例 Web 應用程式中的表單驗證範例未經篩選就顯示使用者提供的資料，進而暴露 XSS 弱點。

請注意，掃描程式並未嘗試利用這些問題，而是僅依據應用程式自我報告的版本號碼做出判斷。

遠端主機上安裝的 WordPress Ninja Forms Plugin 受到 SQL 插入攻擊弱點影響。

請注意，掃描程式並未測試這些問題，而是僅依據應用程式自我報告的版本號碼做出判斷。

遠端主機上安裝的 WordPress Elementor Plugin 受到跨網站指令碼 (XSS) 弱點影響。

請注意，掃描程式並未測試這些問題，而是僅依據應用程式自我報告的版本號碼做出判斷。

根據其自我報告的版本，遠端 Web 伺服器上執行的 Drupal 執行個體是 9.2.21 之前的 9.2.x、9.3.16 之前的 9.3.x 或 9.4.0-rc2 之前的 9.4.x。Drupal 使用第三方 Guzzle 程式庫來處理 HTTP 要求和對外部服務的回應。Guzzle 已發布兩個安全性公告。這些問題不會影響 Drupal 核心，但可能會影響 Drupal 網站上提供的某些專案或自訂程式碼。

請注意，掃描程式並未測試這些問題，而是僅依據應用程式自我報告的版本號碼做出判斷。

根據其標題，遠端主機上執行的 Apache 版本是比 2.4.54 舊的 2.4.x 版。因此會受到多個弱點影響：

 - Apache HTTP Server 的 mod_proxy_ajp 中存在對 HTTP 要求解釋不一致 (「HTTP 要求走私」) 弱點，攻擊者可藉此將要求走私到其轉送要求的 AJP 伺服器。(CVE-2022-26377)

 - 當設定為使用 mod_isapi 模組處理要求時，Windows 主機上的 HTTP Server 2.4.53 和更舊版本可能會發生超出邊界讀取問題。(CVE-2022-28330)

 - 在 Apache HTTP Server 2.4.53 及更早版本中，若攻擊者能夠使用 ap_rwrite() 或 ap_rputs() (例如使用 mod_luas r:puts() 函式 ) 讓伺服器反映超大型輸入，則 ap_rwrite() 函式可能會讀取非預期的記憶體。(CVE-2022-28614)

 在 Apache HTTP Server 2.4.53 和更舊版本中，當應用程式處理超大型輸入緩衝區時，ap_strcmp_match() 中的超出邊界讀取弱點可能會造成應用程式損毀或資訊洩漏。雖然無法將隨伺服器發佈的程式碼強制轉換為此類呼叫，但使用 ap_strcmp_match() 的第三方模組或 lua 指令碼可能會受到影響。(CVE-2022-28615)

 - 在 Apache HTTP Server 2.4.53 和更舊版本中，由於對可能的輸入大小沒有預設限制，惡意要求呼叫 parsebody(0) 的 lua 指令碼可能會造成應用程式拒絕服務。(CVE-2022-29404)

 - 如果將 Apache HTTP Server 2.4.53 設定為在 mod_sed 的輸入可能非常大的環境中使用 mod_sed 進行轉換，則 mod_sed 可能會進行超大記憶體配置並觸發中止。(CVE-2022-30522)

 - Apache HTTP Server 2.4.53 及更舊版本可能會向呼叫 r: wsread() 的應用程式傳回指向超出為緩衝區配置的儲存區結尾的長度。(CVE-2022-30556)

 - Apache HTTP Server 2.4.53 及更舊版本可能不會根據用戶端的 Connection 標頭逐跳機制將 X-Forwarded-* 標頭傳送至原始伺服器。攻擊者可利用此問題繞過原始伺服器/應用程式上的 IP 型驗證。(CVE-2022-31813)

請注意，掃描程式並未測試這些問題，而是僅依據應用程式自我報告的版本號碼做出判斷。

根據應用程式自我報告的版本號，遠端主機上安裝的 PHP 是 7.4.30 之前的7.4.x 版、8.0.20 之前的 8.0.x 版或 8.1.7 之前的 8.1.x 版。因此會受到多個弱點影響：

 - pg_query_params() 中未初始化的陣列。(CVE-2022-31625)

 - mysqlnd/pdo 密碼緩衝區溢位。(CVE-2022-31626)

請注意，掃描程式並未測試這些問題，而是僅依據應用程式自我報告的版本號碼做出判斷。

ID	名稱	嚴重性
113302	phpMyAdmin 5.0.x < 5.0.2 Multiple Vulnerabilities	high
113301	phpMyAdmin 4.9.x < 4.9.5 Multiple Vulnerabilities	high
113300	phpMyAdmin 5.0.x < 5.0.1 SQL Injection	high
113299	phpMyAdmin 4.8.x < 4.9.4 SQL Injection	high
113298	phpMyAdmin 4.7.7 < 4.9.2 SQL Injection	critical
113297	phpMyAdmin 4.x < 4.9.0 Cross-Site Request Forgery	medium
113296	phpMyAdmin < 4.8.6 SQL Injection	critical
113295	phpMyAdmin 4.5.x < 4.8.5 SQL Injection	critical
113294	phpMyAdmin 4.x < 4.8.5 任意檔案讀取	medium
113293	phpMyAdmin 4.x < 4.8.4 Cross-Site Scripting	medium
113292	phpMyAdmin 4.7.x < 4.8.4 Cross-Site Request Forgery	high
113291	phpMyAdmin 4.x < 4.8.4 Local File Inclusion	medium
113290	phpMyAdmin 4.x < 4.8.3 Cross-Site Scripting	medium
113289	phpMyAdmin 4.8.x < 4.8.2 Remote Code Execution	high
113288	phpMyAdmin 4.x < 4.8.2 Cross-Site Scripting	medium
113287	phpMyAdmin 4.8.x < 4.8.0-1 Cross-Site Request Forgery	high
113286	phpMyAdmin 4.7.x < 4.7.8 Cross-Site Scripting	medium
113285	Atlassian Jira 8.6.x < 8.13.1 Cross-Site Request Forgery	medium
113284	Atlassian Jira < 8.5.10 Cross-Site Request Forgery	medium
113283	Atlassian Jira < 8.19.1 Improper Authentication	high
113282	Atlassian Jira 8.14.x < 8.20.3 Template Injection	high
113281	Atlassian Jira < 8.13.15 Template Injection	high
113280	Atlassian Jira < 8.20.3 Cross-Site Scripting	medium
113279	Atlassian Jira 8.14.x < 8.20.5 Cross-Site Request Forgery	medium
113278	Atlassian Jira < 8.13.16 Cross-Site Request Forgery	medium
113277	Atlassian Jira < 8.20.1 Improper Authorization	medium
113276	Atlassian Jira 8.14.x < 8.20.2 Cross-Site Scripting	medium
113275	Atlassian Jira < 8.13.12 Cross-Site Scripting	medium
113274	Atlassian Jira 8.20.x < 8.20.6 Cross-Site Request Forgery	medium
113273	Atlassian Jira < 8.13.18 Cross-Site Request Forgery	medium
113272	Atlassian Jira 8.14.x < 8.20.3 Multiple Vulnerabilities	high
113271	Atlassian Jira < 8.13.15 多個弱點	high
113270	Atlassian Jira 8.21.x < 8.22.4 Server-Side Request Forgery	medium
113269	Atlassian Jira 8.14.x < 8.20.10 Server-Side Request Forgery	medium
113268	Atlassian Jira 8.0.x < 8.13.22 Server-Side Request Forgery	medium
113266	ManageEngine ADAudit Plus XML 外部實體	critical
113259	Oracle Access Manager 遠端程式碼執行	critical
113249	Atlassian Jira Seraph 驗證繞過	critical
113242	Java Psychic 簽章	high
113265	Apache Tomcat 8.5.50 < 8.5.82 跨網站指令碼	medium
113264	Apache Tomcat 9.0.30 < 9.0.65 跨網站指令碼	medium
113263	Apache Tomcat 10.0.0-M1 < 10.0.23 跨網站指令碼	medium
113262	Apache Tomcat 10.1.0-M1 < 10.1.0-M17 跨網站指令碼	medium
113261	Ninja Forms Plugin for WordPress < 3.6.11 程式碼插入	critical
113260	Elementor Plugin for WordPress < 3.5.6 跨網站指令碼	medium
113257	Drupal 9.2.x < 9.2.21 第三方程式庫弱點	high
113256	Drupal 9.3.x < 9.3.16 第三方程式庫弱點	high
113255	Drupal 9.4.x < 9.4.0-rc2 第三方程式庫弱點	high
113254	Apache 2.4.x < 2.4.54 多個弱點	critical
113253	PHP 7.4.x < 7.4.30 多個弱點	high

偵測

Web App Scanning 的 Component Vulnerability 系列

high

high

high

high

critical

medium

critical

critical

medium

medium

high

medium

medium

high

medium

high

medium

medium

medium

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

high

high

medium

medium

medium

critical

critical

critical

high

medium

medium

medium

medium

critical

medium

high

high

high

critical

high