94 matches found
emba
EMBA The security analyzer for firmware of embedded devices EMBA is designed as the central firmware analysis and SBOM tool for penetration testers, product security teams, developers and responsible product managers. It supports the complete security analysis process starting with firmware...
MinimalReproducer
After significant efforts, stripped it down to a minimal replicator. This is just an empty project to demonstrate the issue with dependency-check-maven usage I am forced on doing by my company rules. Do check the pom.xml and do verify: mvn org.owasp:dependency-check-maven:RELEASE:aggregate Or if...
react2shell
React2Shell Vulnerability Checker CVE-2025-55182 Herramienta de detección para Ubuntu Linux y Windows 10/11 Descripción Esta herramienta detecta posibles vulnerabilidades React2Shell CVE-2025-55182 en proyectos de React verificando: Archivos package.json y archivos de bloqueo para paquetes...
boot-jackson-cve
Reproducción de CVE-2020-36518 en Spring Boot 2.5.10 Ejecute: ./mvnw clean verify Fallará con: ERROR Failed to execute goal org.owasp:dependency-check-maven:7.0.0:check default on project jackson-demo: ERROR ERROR One or more dependencies were identified with vulnerabilities that have a CVSS scor...
heisenberg-ssc-gha
Heisenberg Dependency Health Check GitHub Action Una guardia ligera para PRs en actualizaciones de dependencias. Escanea solo las dependencias nuevas o modificadas de tu archivo de bloqueo/manifiesto, obtiene señales de salud y riesgo deps.dev + heurísticas, marca publicaciones recientes, comenta...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Jenkins UI when displaying CWE values from Dependency-Check reports. An attacker can execute arbitrary JavaScript code in the context of other users by injecting malicious content into the CWE values, whi...
CVE-2026-92136
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2026-92136
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2026-92136
The Jenkins OWASP Dependency-Check Plugin version 5.6.4 and earlier is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the failure to escape CWE values from Dependency-Check reports on the Jenkins UI. Attackers with Item/Configure permissions can exploit this to...
EUVD-2026-80760
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2026-92136
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
PT-2026-93779
Name of the Vulnerable Software and Affected Versions Jenkins OWASP Dependency-Check Plugin versions prior to 5.6.5 Description The Jenkins UI fails to escape CWE values from Dependency-Check reports, leading to a stored cross-site scripting XSS issue. This allows attackers with Item/Configure...
CVE-2026-92136: Improper Neutralization of Input During Web Page Generation
Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
Stored XSS vulnerability in dependency-check-jenkins-plugin
dependency-check-jenkins-plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the Jenkins UI. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. TIP: On Jenkins 2.539 and newer, LTS 2.541.1 and...
MINI-VJ4M-QX8Q-33HX
Bulletin has no description...
GO-2026-5746 vulnerabilities
Vulnerabilities for packages: docker-credential-gcr, buildah, skopeo, envoy-gateway-fips, skopeo-fips, upwind-agent, trivy-operator, portieris, buildah-fips, grafana-alloy, grafana-alloy-fips, cloudbeat-fips, kots, nrdot-collector-k8s, rancher, envoy-gateway, zot, kubedock, aws-otel-collector,...
GO-2026-5668 vulnerabilities
Vulnerabilities for packages: osv-scanner, zot, trivy-operator, datadog-agent, grafana-alloy, trivy, kpt, amazon-cloudwatch-agent, rancher-agent, podman, docker-credential-gcr, envoy-gateway, portieris, buildah, aws-otel-collector, grafana, ko, rancher, skopeo, kots, nuclei, nerdctl, cri-tools,...
Malicious code in @wethenorth12/tronweb3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f34dbfde05ea1b80131dc35978c18b429f4ef11da06334e93c109db08c31f19 The package presents itself as a drop-in replacement for the legitimate tronweb SDK author field 'tronprotocol', README advertising tronweb...
MAL-2026-12105 Malicious code in @wethenorth12/tronweb3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f34dbfde05ea1b80131dc35978c18b429f4ef11da06334e93c109db08c31f19 The package presents itself as a drop-in replacement for the legitimate tronweb SDK author field 'tronprotocol', README advertising tronweb...