94 matches found
emba
EMBA The security analyzer for firmware of embedded devices EMBA is designed as the central firmware analysis and SBOM tool for penetration testers, product security teams, developers and responsible product managers. It supports the complete security analysis process starting with firmware...
react2shell
React2Shell Vulnerability Checker CVE-2025-55182 Herramienta de detección para Ubuntu Linux y Windows 10/11 Descripción Esta herramienta detecta posibles vulnerabilidades React2Shell CVE-2025-55182 en proyectos de React verificando: Archivos package.json y archivos de bloqueo para paquetes...
boot-jackson-cve
Reproducción de CVE-2020-36518 en Spring Boot 2.5.10 Ejecute: ./mvnw clean verify Fallará con: ERROR Failed to execute goal org.owasp:dependency-check-maven:7.0.0:check default on project jackson-demo: ERROR ERROR One or more dependencies were identified with vulnerabilities that have a CVSS scor...
heisenberg-ssc-gha
Heisenberg 依赖健康检查（GitHub Action） 一个轻量级的 PR 防护栏，用于依赖更新。 它仅扫描新增或变更的依赖项（来自您的锁定/清单文件），获取健康与风险信号（deps.dev + 启发式分析），标记新近发布的包，在 PR 上评论一份报告，可选地为安全审查添加标签，并且可以在策略命中时使任务失败。 支持的生态系统： PyPI（poetry.lock、requirements.txt、uv.lock）、npm/yarn（package-lock.json、yarn.lock）、Go（go.mod）。 它的作用 仅检测您在 PR...
MinimalReproducer
经过大量努力，将问题缩减为一个最小复现项目。 这只是一个空项目，用于展示我在公司规定下被迫使用的 dependency-check-maven 的问题。 请检查 pom.xml 并执行验证： mvn org.owasp:dependency-check-maven:RELEASE:aggregate 或者如果您有 NVDAPIKEY 环境变量，可以更快地执行： mvn org.owasp:dependency-check-maven:RELEASE:aggregate -DnvdApiKey=$NVDAPIKEY 然后您会看到大量问题，包括： ... ERROR...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Jenkins UI when displaying CWE values from Dependency-Check reports. An attacker can execute arbitrary JavaScript code in the context of other users by injecting malicious content into the CWE values, whi...
CVE-2026-92136
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2026-92136
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2026-92136
The Jenkins OWASP Dependency-Check Plugin version 5.6.4 and earlier is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the failure to escape CWE values from Dependency-Check reports on the Jenkins UI. Attackers with Item/Configure permissions can exploit this to...
CVE-2026-92136
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
EUVD-2026-80760
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
PT-2026-93779
Name of the Vulnerable Software and Affected Versions Jenkins OWASP Dependency-Check Plugin versions prior to 5.6.5 Description The Jenkins UI fails to escape CWE values from Dependency-Check reports, leading to a stored cross-site scripting XSS issue. This allows attackers with Item/Configure...
CVE-2026-92136: Improper Neutralization of Input During Web Page Generation
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
Stored XSS vulnerability in dependency-check-jenkins-plugin
dependency-check-jenkins-plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. TIP: On Jenkins 2.539 and newer, LTS 2.541.1 and...
MINI-VJ4M-QX8Q-33HX
Bulletin has no description...
GO-2026-5746 vulnerabilities
Vulnerabilities for packages: beats, envoy-gateway, grafana-alloy, docker-credential-gcr, docker-fips, opentelemetry-operator-fips, podman-fips, elastic-agent, opentelemetry-operator, undock, amazon-cloudwatch-agent-fips, nuclei, trivy-operator-fips, prometheus-podman-exporter, datadog-agent,...
GO-2026-5668 vulnerabilities
Vulnerabilities for packages: rancher-agent, envoy-gateway, buildah, docker-credential-gcr, zot, cri-tools, spire-server, trivy, podman, grafana, portieris, undock, opentelemetry-operator, ko, amazon-cloudwatch-agent-operator, grafana-alloy, rancher-machine, nuclei, kpt, nerdctl, rancher, kots,...
Malicious code in @wethenorth12/tronweb3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f34dbfde05ea1b80131dc35978c18b429f4ef11da06334e93c109db08c31f19 The package presents itself as a drop-in replacement for the legitimate tronweb SDK author field 'tronprotocol', README advertising tronweb...
MAL-2026-12105 Malicious code in @wethenorth12/tronweb3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f34dbfde05ea1b80131dc35978c18b429f4ef11da06334e93c109db08c31f19 The package presents itself as a drop-in replacement for the legitimate tronweb SDK author field 'tronprotocol', README advertising tronweb...