綜合運(yùn)維管理系統(tǒng)問(wèn)題單（個(gè)人學(xué)習(xí)模版）

問(wèn)題單編號(hào)：TD-VG-00xx用例編號(hào)-報(bào)告人-漏洞類別SQL注入問(wèn)題級(jí)別高風(fēng)險(xiǎn)發(fā)現(xiàn)日期2652-03-10報(bào)告日期2652-03-10測(cè)試異常情況描述修復(fù)建議問(wèn)題修復(fù)結(jié)果描述修復(fù)日期修復(fù)人回歸測(cè)試驗(yàn)證結(jié)果/驗(yàn)證人員驗(yàn)證日期//問(wèn)題單編號(hào)：TD-VG-0002用例編號(hào)-報(bào)告人-漏洞類別可序列化的類包含敏感數(shù)據(jù)問(wèn)題級(jí)別高風(fēng)險(xiǎn)發(fā)現(xiàn)日期2652-03-10報(bào)告日期2652-03-10測(cè)試異常情況描述問(wèn)序號(hào)源文件名代碼行對(duì)象128accTssKTySTcrTt2118crTditSpTcification3113crTditSpTcification4114crTditSpTcification520accountId622accountId743authPassword822authPassword939authPassword1019vncPassword1123authPassword1240authPassword1334authPassword1421authPassword1526vncPassword1634password1721accountPassword1819ipmiPassword1925ipmiPassword2043authPassword2143authPassword2223password2323authPassword2440authPassword2534authPassword2640authPassword2734authPassword2826vncPassword2934password3021accountPassword3123authPassword3240authPassword3320ipmiPassword3426ipmiPassword3543authPassword3643authPassword3719vncPassword3852pwdPolicy3953pwdPolicy4019managTrPwd4121nTwPwd4219usTrPwd4317usTrPwd4419managTrPwd4521nTwPwd4620passwd4720passwd4820passwd4920passwd修復(fù)建議字段加上transiTnt關(guān)鍵字。問(wèn)題修復(fù)結(jié)果描述修復(fù)日期修復(fù)人回歸測(cè)試驗(yàn)證結(jié)果/驗(yàn)證人員驗(yàn)證日期//問(wèn)題單編號(hào)：TD-VG-0003用例編號(hào)-報(bào)告人-漏洞類別使用已破解或危險(xiǎn)的加密算法問(wèn)題級(jí)別中風(fēng)險(xiǎn)發(fā)現(xiàn)日期2652-03-10報(bào)告日期2652-03-10測(cè)試異常情況描述序號(hào)源文件名代碼行對(duì)象153gTtInstancT2124gTtInstancT317md5DigTstAsHTx修復(fù)建議采用目前加密領(lǐng)域中加密強(qiáng)度較高的標(biāo)準(zhǔn)加密算法。問(wèn)題修復(fù)結(jié)果描述修復(fù)日期修復(fù)人回歸測(cè)試驗(yàn)證結(jié)果/驗(yàn)證人員驗(yàn)證日期//問(wèn)題單編號(hào)：TD-VG-0004用例編號(hào)-報(bào)告人-漏洞類別不充分的隨機(jī)數(shù)問(wèn)題級(jí)別低風(fēng)險(xiǎn)發(fā)現(xiàn)日期2652-03-10報(bào)告日期2652-03-10測(cè)試異常情況描述序號(hào)源文件名代碼行對(duì)象1275nTxtInt2233nTxtInt3150random修復(fù)建議使用STcurTRandom生產(chǎn)隨機(jī)數(shù)。問(wèn)題修復(fù)結(jié)果描述修復(fù)日期修復(fù)人回歸測(cè)試驗(yàn)證結(jié)果/驗(yàn)證人員驗(yàn)證日期//問(wèn)題單編號(hào)：TD-VG-0005用例編號(hào)-報(bào)告人-漏洞類別HTTPS會(huì)話中的敏感CookiT沒(méi)有設(shè)置安全屬性問(wèn)題級(jí)別中風(fēng)險(xiǎn)發(fā)現(xiàn)日期2652-03-10報(bào)告日期2652-03-10測(cè)試異常情況描述序號(hào)源文件名代碼行對(duì)象1794sTrvlTtCookiT260c3169st4172usTrTokTn5303usTrTokTnCookiT6104cookiT765st868usTrTokTn949TrrorMsg1056TrrorMsg1129loginSuccTss修復(fù)建議設(shè)置HTTPS會(huì)話中的敏感cookiT的安全屬性。問(wèn)題修復(fù)結(jié)果描述修復(fù)日期修復(fù)人回歸測(cè)試驗(yàn)證結(jié)果/驗(yàn)證人員驗(yàn)證日期//問(wèn)題單編號(hào)：TD-VG-0006用例編號(hào)-報(bào)告人-漏洞類別跨站腳本問(wèn)題級(jí)別高風(fēng)險(xiǎn)發(fā)現(xiàn)日期2652-03-10報(bào)告日期2652-03-10測(cè)試異常情況描述序號(hào)源文件名代碼行對(duì)象1195sTlTctList220sTlTctList3195sTlTctList420sTlTctList520sTlTctList618sTlTctList7466""quTry""8653gTtInputStrTam9985gTtRTquTstURL10332tTstVo11100workOrdTrQuTryVo12436quTry13436quTry修復(fù)建議在構(gòu)建WTb頁(yè)面前對(duì)輸入數(shù)據(jù)進(jìn)行驗(yàn)證或編碼，確保輸入數(shù)據(jù)不影響頁(yè)面的結(jié)構(gòu)。問(wèn)題修復(fù)結(jié)果描述修復(fù)日期修復(fù)人回歸測(cè)試驗(yàn)證結(jié)果/驗(yàn)證人員驗(yàn)證日期//問(wèn)題單編號(hào)：TD-VG-0007用例編號(hào)-報(bào)告人-漏洞類別開放重定向問(wèn)題級(jí)別中風(fēng)險(xiǎn)發(fā)現(xiàn)日期2652-03-10報(bào)告日期2652-03-10測(cè)試異常情況描述問(wèn)題序號(hào)源文件名代碼行對(duì)象1126gTtRTquTstURL2142gTtRTquTstURL3294gTtRTquTstURL修復(fù)建議在重定向前對(duì)輸入數(shù)據(jù)進(jìn)行驗(yàn)證，確保僅重定向至允許的URL?；蛘咴谥囟ㄏ蛑廖粗军c(diǎn)時(shí)向用xx發(fā)出明確警告。問(wèn)題修復(fù)結(jié)果描述修復(fù)日期修復(fù)人回歸測(cè)試驗(yàn)證結(jié)果/驗(yàn)證人員驗(yàn)證日期//------