13120 matches found
threat-modeling-playbook
简介 我们旨在通过这份新的威胁建模手册来提升产品和软件的安全性。我们认为威胁建模是改善软件保障的一项基础性活动。我们坚信，良好的威胁建模实践将显著减少所交付产品中的安全问题。 作为开源的坚定支持者、OWASP 的积极贡献者，为了将我们的影响力扩展到 Toreon 客户之外，我们将这份威胁建模手册捐赠给社区。 我们希望您能利用这份手册来改进您的威胁建模实践。同时，我们也鼓励您向我们的 OWASP 威胁建模 社区提供反馈，以便我们在下一个版本中让这份手册更加完善。 我感谢我们的合作者（按字母顺序）：Jonas Muylaert、Joris Van den Broeck、Sebastien...
guac
GUAC: Graph for Understanding Artifact Composition Note: GUAC is under active development - if you are interested in contributing, please look at contributor guide. GUAC is an OpenSSF incubating project under the Supply Chain Integrity WG. Graph for Understanding Artifact Composition GUAC...
rbndr
rbndr Simple DNS Rebinding Service rbndr is a very simple, non-conforming, name server for testing software against DNS rebinding vulnerabilities. The server responds to queries by randomly selecting one of the addresses specified in the hostname and returning it as the answer with a very low ttl...
DirtyPipe-CVE-2022-0847
DirtyPipe-CVE-2022-0847 这个仓库是为了分析和理解DirtyPipe漏洞CVE-2022-0847而开发的，用于我的第三学年第一学期的安全软件系统作业。 我写的论文 论文将在学期结束后可用。...
Gitea 1.1.0 - 1.12.5 - Remote Code Execution
Gitea 1.1.0 through 1.12.5 is susceptible to authenticated remote code execution, via the git hook functionality, in customer environments where the documentation is not understood e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the...
Dahua IPC/VTH/VTO - Authentication Bypass
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. id: CVE-2021-33045 info: name: Dahua IPC/VTH/VTO - Authentication Bypass author: phantomowl severity:...
Investigating Developer-Reported Software Security Testing Challenges
Software security testing SST is essential for identifying vulnerabilities and improving software security, but developers often face practical challenges when selecting tools, configuring test environments, interpreting scanner outputs, testing authentication workflows, and acting on reported...
MOVEit Transfer - Remote Code Execution
In Progress MOVEit Transfer before 2021.0.6 13.0.6, 2021.1.4 13.1.4, 2022.0.4 14.0.4, 2022.1.5 14.1.5, and 2023.0.1 15.0.1, a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database...
LLM-Based Agents for Software and Systems Security: Approaches, Applications, and Assessment
Software and systems security workflows are typically procedural: analysts inspect heterogeneous artifacts, form hypotheses, invoke tools, interpret outputs, and revise plans. Large language model LLM-based agents, which can plan, use tools, retain state, and revise actions across multi-step...
MINI-J248-4FR3-3456
Bulletin has no description...
GHSA-Q496-Q274-JGH9 vulnerabilities
Vulnerabilities for packages: exim...
MINI-6VGX-C24M-5JJG
Bulletin has no description...
MINI-WVG2-F9XQ-2JP6
Bulletin has no description...
CVE-2026-19489
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21...
The vulnerability of the Adobe Lightroom Classic graphic editor lies in its authentication procedures’ flaws, which allow a hacker to execute arbitrary code.
The vulnerability of Adobe Lightroom Classic’s graphic editor is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to execute arbitrary code...
CVE-2026-62462
Oracle E-Business Suite Work in Process (component: Internal Operations) versions 12.2.3-12.2.15 is vulnerable. A low-privileged attacker with network access via HTTP can exploit it for full CIA impact (CVSS 8.8 HIGH). Oracle's August 2026 CPU advisory is referenced for patch details; no exploit ...
BELL-CVE-2026-74373
Bulletin has no description...
BELL-CVE-2026-74361
Bulletin has no description...
