semgrep

Code scanning at ludicrous speed...

bearer

Scan your source code against top security and privacy risks. Bearer is a static application security testing SAST tool designed to scan your source code and analyze data flows to identify, filter, and prioritize security and privacy risks. Bearer offers a free, open solution, Bearer CLI, and a...

semgrep-rules

semgrep-rules ようこそ！このリポジトリには Semgrep の Community Edition ルールが含まれています。 このリポジトリのルールに加えて、Semgrep Registry ではプロプライエタリな Pro ルール も提供しています。これらは追加の言語カバレッジを提供し、クロスファイルおよびディープデータフロー解析を利用可能にします。 ルールを探す：Semgrep registry search で Community Edition ルールと Pro ルールを検索します。 ルールを使用する：Semgrep AppSec Platform...

codex-security

Codex Security @openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code. 👉👉 See theCodex Security documentation for full documentation. Some cybersecurity requests and protected findings require approval through Trusted Access fo...

CVE-2021-43530-UXSS-On-QRcode-Reader-

CVE-2021-43530-QR码读取器上的UXSS- Firefox for Android中存在一个通用XSS漏洞，原因是处理从QR码扫描的URL时消毒不当。此漏洞仅影响Firefox for Android。其他操作系统不受影响。该漏洞影响Firefox 94。...

ASST

ASST BETA OWASP ASST Automated Software Security Toolkit | A Novel Open Source Web Security Scanner. Note: AWSS is the older name of ASST Introduction Web applications have become an integral part of everyday life, but many of these applications are deployed with critical vulnerabilities that can...

trivy-action

Trivy Action GitHub Action para Trivy !GitHub Releaserelease-imgrelease !GitHub Marketplacemarketplace-imgmarketplace !Licenselicense-imglicense Tabla de contenido Uso Escanear Pipeline de CI Escanear Pipeline de CI con Configuración de Trivy Caché Configuración de Trivy Escanear un Tarball Usar...

jfrog-CVE-2022-21449

CVE-2022-21449 概要 このツールは、コンパイル済みコードアーカイブ（.jar、.war など）をすばやくスキャンし、ECDSA アルゴリズムの使用を示す文字列を探すことで、CVE-2022-21449 への脆弱性をチェックできます。このツールは追加の前提条件なしで Python3 を使用します。 使用方法 root@kitploit: python cve202221449.py root-folder -quiet -exclude folder1 folder2 .. または root@kitploit: python cve202221449.py...

jsecret

jsecret 一个简单快速的工具，用于检测源代码中的敏感数据，例如 JavaScript 文件或其他文件。 安装 go install -v github.com/raoufmaklouf/jsecret@latest 用法 cat jsfiles.txt | jsceret echo http://test.tld/main.js | jsecret 非常感谢 https://twitter.com/medmahmoudi619 在正则表达式方面的帮助。...

URLextractor

URLextractor 信息收集与站点侦查 用法: ./extractor http://www.hackthissite.org/ 提示: Colorex：为输出添加颜色，pip install colorex 然后像这样使用：./extractor http://www.hackthissite.org/ | colorex -g "INFO" -r "ALERT" Tldextract：由dnsenumeration函数使用，pip install tldextract 功能特性: IP与主机信息，如城市和国家（使用 FreegeoIP） DNS服务器（使用 dig）...

sonarcloud-scan

Bitbucket Pipelines Pipe: SonarQube Cloud scan Scan your code with SonarQube Cloud to detects bugs, vulnerabilities and code smells in more than 25 programming languages. Your SonarCloud account must first be associated to your Bitbucket team or user account. SonarQube Cloud is totally free for...

static-code-analysis-helper

Static-Code-Analysis-Helper Descrizione Rileva funzioni che potrebbero causare metodologie di attacco in molti linguaggi di programmazione web e framework nella cartella del progetto. Ti aiuta a eseguire l'analisi statica del codice. Nota: molte delle funzioni descritte qui potrebbero non causare...

raptor

Raptor è uno scanner di vulnerabilità sorgente basato sul web web-service + UI incentrato su GitHub; scansiona un repository semplicemente con l'URL del repo GitHub. Puoi configurare webhook per garantire scansioni automatiche ogni volta che fai un commit o unisci una pull request. La scansione...

joern

Database delle query di Joern "Joern-Scan" Questo è il database centrale delle query per la piattaforma di analisi del codice open-source Joern. Ha due scopi: Fornisce le batterie necessarie per trasformare Joern in uno strumento di scansione del codice pronto all'uso. Le sue query servono come...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in QR scanning in Google Chrome on iOS prior to 89.0.4389.72 allowed an attacker who convinced the user to scan a QR code to bypass navigation restrictions via a crafted QR code...

CVE-2026-41471

The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress po...

CVE-2026-41471

The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress po...

CVE-2026-41471

The CVE concerns the Easy PayPal Events & Tickets WordPress plugin (version 1.3 and earlier). A vulnerability in the QR code scanning endpoint (scan_qr.php) allows unauthenticated attackers to enumerate and retrieve all customer order records by iterating sequential WordPress post IDs, exposing s...

CVE-2026-32834

Summary: CVE-2026-32834 affects the WordPress plugin Easy PayPal Events & Tickets (version 1.3 and earlier). The vulnerability is a hardcoded authentication bypass in the QR code scanning functionality, allowing unauthenticated remote attackers to bypass hash verification by sending the hash para...

WordPress plugin Easy PayPal Events & Tickets 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...