DevAudit

Note : DevAudit uses the OSS Index database, which has some rate limiting. If you notice you are hitting the limit please raise an issue. Authenticated users get a higher limit, and we am implementing authentication into DevAudit soon. Most non-authenticated users probably won't notice the limit...

Cobra

Cobra 本プロジェクトの設計は現在のホワイトボックススキャン要件を満たせなくなったため、メンテナンスは終了しています。研究目的でのみ使用し、本番環境では使用しないでください。 Introduction（紹介） Cobraはソースコードセキュリティ監査 ツールであり、複数の開発言語のソースコードにおけるほとんどの顕著な セキュリティ問題や脆弱性を検出できます。 Features（特徴） Multi-language Supported（複数の開発言語をサポート）...

semgrep-rules

elttam 的 semgrep-rules 欢迎来到 elttam 的公开 semgrep 规则仓库。 !semgrep ruleshttp...

DiffCatcher

開発支援 このプロジェクトがあなたの仕事に役立っているなら、継続的なメンテナンスと新機能の開発を支援してください。 ETH 寄付ウォレット 0x11282eE5726B3370c8B480e321b3B2aA13686582 上記のQRコードをスキャンするか、ウォレットアドレスをコピーしてください。 Rust製CLIツール。Gitリポジトリを再帰的に検出し、状態変更をキャプチャ、差分を生成、コード要素を完全スニペット付きで抽出、コードレビューや監査ワークフロー向けのセキュリティ重視レポートを出力します。 🎯 主な機能 リポジトリ検出 :...

MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

Summary When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE 400 MB and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk. Verified Impact...

VulnPilot

VulnPilot VulnPilot is an automation framework for vulnerabil...

security-audit

security-audit A Claude Code skill + plugin marketplace for a...

CVE-2023-45823

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which by using symbolic links in certain kinds of repositories load...

cve

Here are some vulnerabilities related to variou...

EUVD-2023-46375

Malicious code in bioql PyPI...

Exploit-chain

Exploit-chain Exploit chain range building and penetration xx...

Unencrypted Flying Objects: Security Lessons from University Small Satellite Developers and Their Code

Satellites face a multitude of security risks that set them apart from hardware on Earth. Small satellites may face additional challenges, as they are often developed on a budget and by amateur organizations or universities that do not consider security. We explore the security practices and...

SurrealDB server-takeover via SurrealQL injection on backup import

The SurrealDB command-line tool allows exporting databases through the export command. It was discovered that table or field names are not properly sanitized in exports, leading to a SurrealQL injection when the backup is reimported. For the injection to occur, an authenticated System User with...

SurrealDB has local file read of 2-column TSV files via analyzers

An authenticated system user at the root, namespace, or database levels can use the DEFINE ANALYZER statement to point to arbitrary file locations on the file system, and should the file be tab separated with two columns, the analyzer can be leveraged to exfiltrate the content. This issue was...

GHSA-WQ9X-QWCQ-MMGF Diesel vulnerable to Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts

The following presentation at this year's DEF CON was brought to our attention on the Diesel Gitter Channel: SQL Injection isn't Dead: Smuggling Queries at the Protocol Level Archive link for posterity. Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to...

TikTok: Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended Products

The "Search Product" function in the TikTok Shop Seller API contained a vulnerability that allowed access to inactive or suspended products by manipulating the "live" parameter in the API request. The vulnerability was reported to the team and remediated...

Incorrect Decimals Conversion in Curve2PoolAdapter::primitiveOutputAmount Function

Lines of code Vulnerability details Impact The bug in the primitiveOutputAmount function can lead to incorrect decimal conversions when calculating the rawInputAmount. The rawInputAmount is calculated using the convertDecimals function, but the decimals parameter passed to convertDecimals is...

Unverified Primitives

Lines of code Vulnerability details Impact Interacting with unverified or malicious Ocean primitives could result in loss of funds or incorrect computations. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates...

Users pay higher fee than intended

Lines of code Vulnerability details Impact Protocol mints incorrect depositAmount and depositShare to protocol. Such that reserveFee is higher than defined. Suppose following scenario: 1. Tranche 2 has 20% APR, has 5000 borrowed 2. Tranche 1 has 10% APR, has 10000 borrowed 3. ReserveFee is 10% 4...

Missing balance checks in _reserveTokenSpecified()

Lines of code Vulnerability details Impact By calling depositGivenInputAmount and withdrawGivenOutputAmount which both call 'reserveTokenSpecified', users may potentially create scenarios where the balance ratio allowed for the EvolvedProtocol.sol deployment is violated. POC depositGivenInputAmou...