heisenberg-ssc-gha

Heisenberg 종속성 건강 검사 GitHub Action 가벼운 PR 가드레일로, 종속성 업데이트를 위한 도구입니다. 신규 또는 변경된 종속성만 스캔하여락/매니페스트 파일에서, 건강 및 위험 신호deps.dev + 휴리스틱를 가져오고, 새로 게시된 패키지를 표시하며, PR에 보고서를 댓글로 남깁니다. 선택적으로 보안 검토 레이블을 추가하고, 정책 위반 시 작업을 실패시킬 수 있습니다. 지원 생태계: PyPI poetry.lock, requirements.txt, uv.lock, npm/yarn...

emba

EMBA The security analyzer for firmware of embedded devices EMBA is designed as the central firmware analysis and SBOM tool for penetration testers, product security teams, developers and responsible product managers. It supports the complete security analysis process starting with firmware...

boot-jackson-cve

Reproducción de CVE-2020-36518 en Spring Boot 2.5.10 Ejecute: root@kitploit: ./mvnw clean verify Fallará con: root@kitploit: ERROR Failed to execute goal org.owasp:dependency-check-maven:7.0.0:check default on project jackson-demo: ERROR ERROR One or more dependencies were identified with...

react2shell

React2Shell脆弱性チェッカー CVE-2025-55182検出ツール（Ubuntu Linux および Windows 10/11 対応） 説明 このツールは、ReactプロジェクトにおけるReact2Shell（CVE-2025-55182）の潜在的な脆弱性を以下の方法で検出します： package.jsonとロックファイルから脆弱なパッケージを確認 nodemodulesディレクトリ内の影響を受ける依存関係を確認 URLに対して受動的にリモート検出を実行 重要： このツールは検出専用です（ローカルおよびURLへの受動的検出）— いかなる...

CVE-2026-92136

Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2026-92136

The Jenkins OWASP Dependency-Check Plugin versions 5.6.4 and earlier fail to escape CWE values sourced from Dependency-Check reports when rendering them in the Jenkins UI, enabling a stored cross-site scripting (XSS) attack. An attacker with Item/Configure permission can inject malicious script t...

EUVD-2026-80760

Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2026-92136

Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

MinimalReproducer

多大な努力の末、最小限の再現プロジェクトにまで削り込みました。 これは、会社の規則によって dependency-check-maven の使用を強いられている私が抱える問題を実証するための、単なる空のプロジェクトです。 ぜひ pom.xml を確認し、以下で検証してください: mvn org.owasp:dependency-check-maven:RELEASE:aggregate または、NVDAPIKEY 環境変数があれば、より高速な方法: mvn org.owasp:dependency-check-maven:RELEASE:aggregate...

MINI-VJ4M-QX8Q-33HX

Bulletin has no description...

GO-2026-5746 vulnerabilities

Vulnerabilities for packages: elastic-agent-fips, envoy-gateway, kots, cri-tools, nrdot-collector-k8s-fips, vault, nerdctl, undock, amazon-cloudwatch-agent-operator, portieris-fips, spire-server-fips, upwind-agent, podman, cloudbeat, docker-credential-gcr-fips, zot, opentelemetry-operator-fips,...

GO-2026-5668 vulnerabilities

Vulnerabilities for packages: spire-server, trivy, rancher-agent, skopeo, opentelemetry-operator, zot, kpt, portieris, docker-credential-gcr, buildah, trivy-operator, ko, undock, envoy-gateway, podman, aws-otel-collector, rancher-machine, grafana, cri-tools, nuclei, nerdctl, rancher, datadog-agen...

EUVD-2022-4126

Malicious code in bioql PyPI...

EUVD-2022-2715

Malicious code in bioql PyPI...

Fedora: Security Advisory (FEDORA-2025-c263d3ebd9)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-28153

Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in a stored cross-site scripting XSS vulnerability...

CVE-2021-43577

Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2018-12036

OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames...

Malicious code in check-dependency-ver-consistency (npm)

--- -= Per source details. Do not edit below this line.=-...

ROS-2-1202

2.1202 Denial of Service in libX11CVE-2021-31535 1. Vulnerability Description: The vulnerability allows a local user to execute a denial of service DoS attack. The vulnerability exists due to insufficient validation of color names in the XLookupColor function. A local user can launch a specially...