GitHub Security Lab: CPP: CWE-191 into experimental this reveals a dangerous comparison

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [Java] CWE-755: Query to detect Local Android DoS caused by NFE

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java: Add SSRF query for Java

This bug was reported directly to GitHub Security Lab...

Command Injection

Overview corenlp-js-interface is a deprecated package. Affected versions of this package are vulnerable to Command Injection via the main function. PoC var a = require"corenlp-js-interface"; a"' touch JHU '","","",""; Remediation There is no fixed version for corenlp-js-interface. Credit: JHU...

GitHub Security Lab: [javascript] CWE-614: CodeQL query to detect if cookies are sent without the flag secure being set

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java: CWE-600 Uncaught servlet exception

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: codeql-go: Expand Go standard library taint-tracking models to 63 packages, 554 models and 733 tests (from ~13 packages, ~103 models, ~50 tests)

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [javascript] CWE-90: CodeQL to detect LDAP Injection

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java : add fastjson detection. Improve RemoteFlowSource class, support SpringMvc

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java: Detect remote source from Android intent extra

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [Java] CWE-927: Sensitive broadcast

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java: CWE-749 Unsafe resource loading in Android WebView leaking to injection attacks

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java: CWE-918 - Server Side Request Forgery (SSRF)

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Java : add MongoDB injection sinks

This bug was reported directly to GitHub Security Lab...

GHSA-7QW5-PQHC-XM4G Users with SCRIPT right can execute arbitrary code in XWiki

Impact Any user with SCRIPT right EDIT right before XWiki 7.4 can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. Patches It has been patched in both version XWi...

Users with SCRIPT right can execute arbitrary code in XWiki

Impact Any user with SCRIPT right EDIT right before XWiki 7.4 can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution. Patches It has been patched in both version XWi...

GitHub Security Lab: [CATENACYBER]: [CPP] CWE-476 Null Pointer Dereference : Another query to either missing or redundant NULL check

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: Query to find TLS configurations supporting hardcoded insecure versions of the protocol and cipher suites

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: CodeQL query to detect XSLT injections

This bug was reported directly to GitHub Security Lab...

GitHub Security Lab: [javascript] CWE-117: CodeQL query to detect Log Injection

This bug was reported directly to GitHub Security Lab...