mcp-server

Offensive360 MCP 服务器 在您的 AI 助手中运行 Offensive360 SAST 扫描。 这个 Model Context Protocol 服务器为 Claude Code、 Claude Desktop、Cursor 以及任何其他 MCP 客户端提供两个工具： 工具| 功能 ---|--- o360scanpath| 压缩本地目录，运行完整的 SAST 扫描（支持 60+ 种语言、污点/数据流分析），返回包含文件/行号、严重级别和修复建议的发现结果 o360scanstatus| 正在运行的扫描的队列位置 向您的助手提问，例如 "使用 Offensive360...

sast-scan-action

Offensive360 SAST 扫描 — GitHub Action 在每次推送或拉取请求时运行完整的 Offensive360 静态应用安全扫描（SAST）。支持 60+ 种语言的深度污点分析和数据流分析，结果以 SARIF 格式呈现于 GitHub 代码扫描 标签页，并为你的流水线提供严重性门禁。 开源免费： 公共仓库可申请免费扫描令牌 — 请参阅 offensive360.com/free-for-open-source。 快速开始 name: SAST on: push: branches: main pullrequest: permissions: contents:...

GitLeaks

GitLeaks GitLab CI コンポーネント Gitleaks 用の GitLab CI コンポーネント - パスワード、API キー、トークンといったハードコードされた秘密情報を git リポジトリで検出・防止する SAST ツールです。 機能 シークレット検出 : リポジトリをスキャンし、ハードコードされた秘密情報や機密情報を検出します。 包括的なルール : さまざまな種類の秘密情報を検出するための豊富なビルトインルール カスタム設定 : ローカルおよびリモート設定ファイルのサポート 複数の出力形式 : JSON、SARIF、その他のレポート形式をサポート 柔軟な引数 :...

CVE-2022-24449

CVE-2022-24449 Solar Appscreener XXE 提案された説明 Solar AppScreener SASTツールのバージョン3.10.4までに問題が見つかりました。権限のない攻撃者は、脆弱なバージョンがインストールされている影響を受けるホストに対して、有効期限切れまたは未インストールのライセンスを持つホストに特別に細工されたXMLファイルをアップロードすることで悪用する可能性があります。最低限認められた影響はXXE-SSRFです。 追加情報 修正バージョン: 3.10.4 脆弱性タイプ Other CWE-611: XML外部エンティティ参照の不適切な制限...

njsscan v1.0.1

njsscan njsscan is a static application testing SAST tool that can find insecure code patterns in your node.js applications using simple pattern matcher from libsast and syntax-aware semantic code pattern search tool semgrep. Made with in India Support njsscan Donate via Paypal: Sponsor the...

semgrep v1.177.0

Code scanning at ludicrous speed. Semgrep is a fast, open-source, static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards. Semgrep supports 30+ languages and can run in an IDE, as a pre-commit check, and as part of CI/CD workflows. Semgrep is...

mobileAudit v3.2.0

Mobile Audit Security analysis for Android APKs, from upload to actionable findings. Mobile Audit is a Django application for static application security testing and malware inspection. It extracts APK metadata, detects risky implementation patterns, organizes findings by severity, and provides a...

noir v1.3.1

Hunt every Endpoint in your code, expose Shadow APIs, map the Attack Surface. Documentation • Installation • Usage • Contributing • Changelog Noir is a SAST tool that reads source code and extracts the endpoints an application exposes — paths, methods, parameters, headers, cookies, and the source...

Eopi-Hunt-Skill

Eopi-Hunt-Skill Authorized security research toolkit comb...

CVE-2026-24069

Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application. Kiuwan Cloud was affected, and Kiuwan SAST on-premise KOP was affected before 2.8.2509.4...

📄 Kiuwan SAST 2.8.2412.0 Improper Enforcement

It was found out that a user is still able to login at the Kiuwan WebUI via SSO, even if the Kiuwan mapped account has been disabled in the user settings by an admin. This issue has been addressed in version 2.8.2509.4. SEC Consult Vulnerability Lab Security Advisory...

CVE-2026-24069

Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application. Kiuwan Cloud was affected, and Kiuwan SAST on-premise KOP was affected before 2.8.2509.4...

CVE-2026-24069 Improper Enforcement of Disabled Accounts in WebUI SSO in Kiuwan SAST

Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application. Kiuwan Cloud was affected, and Kiuwan SAST on-premise KOP was affected before 2.8.2509.4...

CVE-2026-24069: Incorrect Authorization

Kiuwan SAST improperly authorizes SSO logins for locally disabled mapped user accounts, allowing disabled users to continue accessing the application. Kiuwan Cloud was affected, and Kiuwan SAST on-premise KOP was affected before 2.8.2509.4...

Kiuwan SAST 安全漏洞

Kiuwan SAST is an application code static security analysis platform developed by Kiuwan Corporation. Versions of Kiuwan SAST prior to version 2.8.2509.4 contained security vulnerabilities. These vulnerabilities stemmed from improper authorization for SSO login for locally disabled mapped user...

Obfuscating Code Vulnerabilities against Static Analysis in JavaScript Code

Code obfuscation is widely adopted in modern software development to protect intellectual property and hinder reverse engineering, but it also provides attackers with a powerful means to conceal malicious logic inside otherwise legitimate JavaScript code. In a software supply chain where a single...

sonarcloud-poc

SonarCloud PoC - SAST Test Projeto de teste para validar dete...

Exploit for CVE-2020-1938

...

EUVD-2020-18953

Malware in sbrugna...

CVE-2024-57965

In axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribute'href',href call. NOTE: some parties feel that the code change only addresses a warning message from a SAST tool and does not fix a vulnerability...