semgrep-rules

elttam's semgrep-rules Welcome to elttam's public semgrep rules repository...

DevAudit

Nota : DevAudit utiliza la base de datos de OSS Index, la cual tiene ciertos límites de tasa. Si notas que estás alcanzando el límite, por favor abre un issue. Los usuarios autenticados tienen un límite más alto, y pronto implementaremos autenticación en DevAudit. La mayoría de los usuarios no...

Cobra

Cobra 本プロジェクトの設計は現在のホワイトボックススキャン要件を満たせなくなったため、メンテナンスは終了しています。研究目的でのみ使用し、本番環境では使用しないでください。 Introduction（紹介） Cobraはソースコードセキュリティ監査 ツールであり、複数の開発言語のソースコードにおけるほとんどの顕著な セキュリティ問題や脆弱性を検出できます。 Features（特徴） Multi-language Supported（複数の開発言語をサポート） PHP、Javaなどの開発言語をサポートし、数十種類のファイル形式に対応しています。 Multi-Vulnerabiliti...

DiffCatcher

Apoya el Desarrollo Si este proyecto ayuda tu trabajo, apoya el mantenimiento continuo y nuevas funcionalidades. Dirección de Donación en ETH 0x11282eE5726B3370c8B480e321b3B2aA13686582 Escanee el código QR o copie la dirección de billetera anterior. Una herramienta CLI en Rust que descubre...

MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

SummaryWhen extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE 400 MB and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk. Verified Impact...

MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

Summary When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE 400 MB and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk. Verified Impact...

-

Vuln-Archive Skill A Claude Codehttps://claude.com/product...

vigolium v0.3.9

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...

vigolium v0.3.5

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...

Vulnerability-Reports

Vulnerability Reports 🔐 Security Vulnerability Assessment R...

VulnPilot

VulnPilot VulnPilot is an automation framework for vulnerabil...

security-audit

security-audit A Claude Code skill + plugin marketplace for a...

CVE-2023-45823

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which by using symbolic links in certain kinds of repositories load...

cve

Here are some vulnerabilities related to variou...

EUVD-2023-46375

Malicious code in bioql PyPI...

Exploit-chain

Exploit-chain Exploit chain range building and penetration xx...

Unencrypted Flying Objects: Security Lessons from University Small Satellite Developers and Their Code

Satellites face a multitude of security risks that set them apart from hardware on Earth. Small satellites may face additional challenges, as they are often developed on a budget and by amateur organizations or universities that do not consider security. We explore the security practices and...

SurrealDB server-takeover via SurrealQL injection on backup import

The SurrealDB command-line tool allows exporting databases through the export command. It was discovered that table or field names are not properly sanitized in exports, leading to a SurrealQL injection when the backup is reimported. For the injection to occur, an authenticated System User with...

SurrealDB has local file read of 2-column TSV files via analyzers

An authenticated system user at the root, namespace, or database levels can use the DEFINE ANALYZER statement to point to arbitrary file locations on the file system, and should the file be tab separated with two columns, the analyzer can be leveraged to exfiltrate the content. This issue was...

GHSA-WQ9X-QWCQ-MMGF Diesel vulnerable to Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts

The following presentation at this year's DEF CON was brought to our attention on the Diesel Gitter Channel: SQL Injection isn't Dead: Smuggling Queries at the Protocol Level Archive link for posterity. Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to...