technology software

English

__cfpid

The domain name 'p.sda1.dev' uses the developer-focused generic top-level domain (.dev) with subdomain 'p'. The registrable portion 'sda1' spans 4 characters split between one vowel and 2 consonants; it also includes 1 digit. Splitting it apart reveals two words: sda, 1. Median word length is two characters. No strong language cues emerged from the frequency lists.

file

html/4b/25/4b2526d5-4229-4ac7-91f2-cc4e11cc9247.html.gz

require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs

aswift_0

google_esf

bb9704879584054c387bbeef4bb0499e15360a83fe071a9fc2185a936c985979

51378794772b9d09ae8f488a4d15939650254ea84c8928d251e9992b5f6ebe21

eb795deda8983fa5310627c9584cf3f3b95d272567113500059018b3941cb267

87083882cc6015984eb0411a99d3981817f5dc5c90ba24f0940420c5548d82de

893c7f6aca9aca8c8aded19a9cd8919cbd7a205cff7f6503d1241b8fa2f721ff

e984b85c6e49a84e4e94a685496b15ac0432e2c2b24eff7a425d3e20daf01393

ff574884c492e3eac07aaf2f8a7be6c65824c5b43da3c83867e3f3905050efb1

8afbbd8d17fddb0b3243c7adf3e6d4c1dbfb90032e8ccb8e93e9e3baac7ef2a3

2ac46ebee46d515be86deeba385b4e41f8cff160364b362c9a6e153df327c66b

0890e1fe3ab7bb06dd68788988944f3366f5b5e073b138f4712087dd5eac6e3a

6ae0f57468afe51111f21ff30f40b8b0037ca4fcc74f90e575baa34600aa87d5

fe55323689334ce5d5f45a522c184b6e41f601d32caf05dafe44abc84c8058cd

b14c88d7af5bc5842b044d1e4cb119343f2ee39f2074230f0981f216f4420565

9e0258f770b81f7f586e6ad68672f34b289ea51b900d528334258eda2c8ccc5c

d10e629ac29427972206f62fee4aedeacd73cdf9a3d1793cc51d0060e59f452e

9318fbbe8c59889f8ab6412c9545577dddf73c7bff9b54c4f605301a27a91ce5

XSS in data-template, data-content and data-title properties of tooltip/popover

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution

passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.

Regex in its jQuery.htmlPrefilter sometimes may introduce XSS

Fixed an mXSS-based bypass caused by nested forms inside MathML

possible to bypass the package sanitization through Mutation XSS

Fixed another bypass causing mXSS by using MathML

Fixed several possible mXSS patterns, thanks @hackvertor

Fix a possible XSS in Chrome that is hidden behind #enable-experimental-web-platform-features

Fixed an mXSS bypass dropped on us publicly via

Fixed a new MathML-based bypass submitted by PewGrand. Fixed a new SVG-related bypass submitted by SecurityMB

DOMPurify vulnerable to tampering by prototype polution

DOMPurify allows tampering by prototype pollution

DOMPurify allows Cross-site Scripting (XSS)

Disallow calling helperMissing and blockHelperMissing directly

Regular Expression Denial of Service in Handlebars

Affected versions of `handlebars` are vulnerable to Denial of Service. The package's parser may be forced into an endless loop while processing specially-crafted templates. This may allow attackers to exhaust system resources leading to Denial of Service.


## Recommendation

Upgrade to version 4.4.5 or later.

Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).

The following template can be used to demonstrate the vulnerability:  
```{{#with "constructor"}}
	{{#with split as |a|}}
		{{pop (push "alert('Vulnerable Handlebars JS');")}}
		{{#with (concat (lookup join (slice 0 1)))}}
			{{#each (slice 2 3)}}
				{{#with (apply 0 a)}}
					{{.}}
				{{/with}}
			{{/each}}
		{{/with}}
	{{/with}}
{{/with}}```


## Recommendation

Upgrade to version 3.0.8, 4.5.2 or later.

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It is due to an incomplete fix for a [previous issue](https://www.npmjs.com/advisories/1316). This vulnerability can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting)

Remote code execution in handlebars when compiling templates

3799a36a33885c67c16b1665794a6b2c5ecda57b7ac21aebb23abbe1ac7eefd2

aa59492349131b69a7ceb4764dba4e437d4aa4bd538ab16ec1305a0a48dce38d

width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no

viewport

AlK2UR5SkAlj8jjdEc9p3F3xuFYlF6LYjAML3EOqw1g26eCwWPjdmecULvBH5MVPoqKYrOfPhYVL71xAXI1IBQoAAAB8eyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiV2ViVmlld1hSZXF1ZXN0ZWRXaXRoRGVwcmVjYXRpb24iLCJleHBpcnkiOjE3NTgwNjcxOTksImlzU3ViZG9tYWluIjp0cnVlfQ==

Amm8/NmvvQfhwCib6I7ZsmUxiSCfOxWxHayJwyU1r3gRIItzr7bNQid6O8ZYaE1GSQTa69WwhPC9flq/oYkRBwsAAACCeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZXN5bmRpY2F0aW9uLmNvbTo0NDMiLCJmZWF0dXJlIjoiV2ViVmlld1hSZXF1ZXN0ZWRXaXRoRGVwcmVjYXRpb24iLCJleHBpcnkiOjE3NTgwNjcxOTksImlzU3ViZG9tYWluIjp0cnVlfQ==

A9nrunKdU5m96PSN1XsSGr3qOP0lvPFUB2AiAylCDlN5DTl17uDFkpQuHj1AFtgWLxpLaiBZuhrtb2WOu7ofHwEAAACKeyJvcmlnaW4iOiJodHRwczovL2RvdWJsZWNsaWNrLm5ldDo0NDMiLCJmZWF0dXJlIjoiQUlQcm9tcHRBUElNdWx0aW1vZGFsSW5wdXQiLCJleHBpcnkiOjE3NzQzMTA0MDAsImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9

A93bovR+QVXNx2/38qDbmeYYf1wdte9EO37K9eMq3r+541qo0byhYU899BhPB7Cv9QqD7wIbR1B6OAc9kEfYCA4AAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZXN5bmRpY2F0aW9uLmNvbTo0NDMiLCJmZWF0dXJlIjoiQUlQcm9tcHRBUElNdWx0aW1vZGFsSW5wdXQiLCJleHBpcnkiOjE3NzQzMTA0MDAsImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9

A1S5fojrAunSDrFbD8OfGmFHdRFZymSM/1ss3G+NEttCLfHkXvlcF6LGLH8Mo5PakLO1sCASXU1/gQf6XGuTBgwAAACQeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZXRhZ3NlcnZpY2VzLmNvbTo0NDMiLCJmZWF0dXJlIjoiQUlQcm9tcHRBUElNdWx0aW1vZGFsSW5wdXQiLCJleHBpcnkiOjE3NzQzMTA0MDAsImlzU3ViZG9tYWluIjp0cnVlLCJpc1RoaXJkUGFydHkiOnRydWV9

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

html/4b/25/4b2526d5-4229-4ac7-91f2-cc4e11cc9247_nodriver.html.gz

流浪图床 - Image Upload - P.SDA1.DEV - Serverless Image Hosting

NameSilo Admin

NameSilo, LLC

sda1.dev

Abuse

Google LLC

GOOGLE


        <fieldset style="margin-top: 10px;">
            <legend><img src="https://p.sda1.dev/assets/images/icons/photo.png" alt="" style="vertical-align:middle; line-height:16px; height:16px; padding-right:5px;">{{filename}}</legend>
            <table style="width:100%;">
                <tbody><tr>
                    <td style="width:260px; text-align: center;">
                        <img class="lazy" onload="DrawImage(this, 260, 260)" width="{{width}}" height="{{height}}" src="{{url}}" style="max-width: 300px;max-height: 300px;">
                    </td>
                    <td class="padding10" style="text-align:left;">
                      <div class="dlinput_header">URL</div>
                      <div class="dlinput_container">
                          <div class="row">
                              <div class="col-md-8">
                                  <input class="form-control" type="text" onclick="this.select();" value="{{url}}">
                              </div>
                          </div>
                      </div>
                        <div class="dlinput_header">HTML</div>
                        <div class="dlinput_container">
                            <div class="row">
                                <div class="col-md-8">
                                    <input class="form-control" type="text" onclick="this.select();" value="<img src=&quot;{{url}}&quot; >">
                                </div>
                            </div>
                        </div>
                        <div class="dlinput_header mt3">BBCode</div>
                        <div class="dlinput_container">
                            <div class="row">
                                <div class="col-md-8">
                                    <input class="form-control" type="text" onclick="this.select();" value="[img]{{url}}[/img]">
                                </div>
                            </div>
                        </div>
                        <div class="dlinput_header mt3">Markdown</div>
                        <div class="dlinput_container">
                            <div class="row">
                                <div class="col-md-8">
                                    <input class="form-control" type="text" onclick="this.select();" value="![{{filename}}]({{url}})">
                                </div>
                            </div>
                        </div>
                        <div class="dlinput_header mt3">Removal Link (to delete the image)</div>
                        <div class="dlinput_container">
                            <div class="row">
                                <div class="col-md-8">
                                    <input class="form-control" type="text" onclick="this.select();" value="{{delete_url}}">
                                </div>
                            </div>
                        </div>
                    </td>

                                                <td style="width:260px;" class="advert">
                        </td>

                </tr></tbody>
            </table>
        </fieldset>
    

Requests	IP Address	Location	AS Autonomous System
14	142.250.201.162	United States	AS15169Google LLC
14	151.101.65.229	United States	AS54113Fastly, Inc.
14	188.114.97.3	United States	AS13335Cloudflare, Inc.
42	3	-	-

Security Scan Report: p.sda1.dev

Summary

AI Security Verdict

Safe Website

Safety Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Detected Technologies11

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History