semgrep-rules

elttams semgrep-rules Willkommen im öffentlichen Repository für semgrep-Reg...

DiffCatcher

Unterstützung der Entwicklung Wenn dieses Projekt Ihre Arbeit unterstützt, tragen Sie zur laufenden Wartung und zu neuen Funktionen bei. ETH-Spenden-Wallet 0x11282eE5726B3370c8B480e321b3B2aA13686582 Scannen Sie den QR-Code oder kopieren Sie die obige Wallet-Adresse. Ein Rust-CLI-Tool, das rekursi...

DevAudit

Nota : DevAudit utilizza il database OSS Index, che ha alcune limitazioni di frequenza. Se noti di aver raggiunto il limite, per favore apri una segnalazione. Gli utenti autenticati hanno un limite più alto, e stiamo implementando l'autenticazione in DevAudit a breve. La maggior parte degli utent...

Cobra

Cobra Il design di questo progetto non è più in grado di soddisfare i requisiti attuali di scansione white-box, non è più mantenuto ed è utilizzabile solo a scopo di ricerca: non utilizzarlo in ambienti di produzione. Introduzione Cobra è uno strumento di audit di sicurezza del codice sorgente , ...

MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

Summary When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE 400 MB and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk. Verified Impact...

VulnPilot

VulnPilot VulnPilot is an automation framework for vulnerabil...

security-audit

security-audit A Claude Code skill + plugin marketplace for a...

CVE-2023-45823

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which by using symbolic links in certain kinds of repositories load...

cve

Here are some vulnerabilities related to variou...

EUVD-2023-46375

Malicious code in bioql PyPI...

Exploit-chain

Exploit-chain Exploit chain range building and penetration xx...

Unencrypted Flying Objects: Security Lessons from University Small Satellite Developers and Their Code

Satellites face a multitude of security risks that set them apart from hardware on Earth. Small satellites may face additional challenges, as they are often developed on a budget and by amateur organizations or universities that do not consider security. We explore the security practices and...

SurrealDB server-takeover via SurrealQL injection on backup import

The SurrealDB command-line tool allows exporting databases through the export command. It was discovered that table or field names are not properly sanitized in exports, leading to a SurrealQL injection when the backup is reimported. For the injection to occur, an authenticated System User with...

SurrealDB has local file read of 2-column TSV files via analyzers

An authenticated system user at the root, namespace, or database levels can use the DEFINE ANALYZER statement to point to arbitrary file locations on the file system, and should the file be tab separated with two columns, the analyzer can be leveraged to exfiltrate the content. This issue was...

GHSA-WQ9X-QWCQ-MMGF Diesel vulnerable to Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts

The following presentation at this year's DEF CON was brought to our attention on the Diesel Gitter Channel: SQL Injection isn't Dead: Smuggling Queries at the Protocol Level Archive link for posterity. Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to...

TikTok: Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended Products

The "Search Product" function in the TikTok Shop Seller API contained a vulnerability that allowed access to inactive or suspended products by manipulating the "live" parameter in the API request. The vulnerability was reported to the team and remediated...

Incorrect Decimals Conversion in Curve2PoolAdapter::primitiveOutputAmount Function

Lines of code Vulnerability details Impact The bug in the primitiveOutputAmount function can lead to incorrect decimal conversions when calculating the rawInputAmount. The rawInputAmount is calculated using the convertDecimals function, but the decimals parameter passed to convertDecimals is...

Unverified Primitives

Lines of code Vulnerability details Impact Interacting with unverified or malicious Ocean primitives could result in loss of funds or incorrect computations. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates...

Users pay higher fee than intended

Lines of code Vulnerability details Impact Protocol mints incorrect depositAmount and depositShare to protocol. Such that reserveFee is higher than defined. Suppose following scenario: 1. Tranche 2 has 20% APR, has 5000 borrowed 2. Tranche 1 has 10% APR, has 10000 borrowed 3. ReserveFee is 10% 4...

Missing balance checks in _reserveTokenSpecified()

Lines of code Vulnerability details Impact By calling depositGivenInputAmount and withdrawGivenOutputAmount which both call 'reserveTokenSpecified', users may potentially create scenarios where the balance ratio allowed for the EvolvedProtocol.sol deployment is violated. POC depositGivenInputAmou...