semgrep-rules

elttam の semgrep-rules elttam の公開 semgrep ルールリポジトリへようこそ。 !semgrep ルールht...

DevAudit

참고 : DevAudit은 OSS Index 데이터베이스를 사용하며, 일부 속도 제한이 있습니다. 제한에 도달하는 것을 발견하면 이슈를 제기해 주십시오. 인증된 사용자는 더 높은 제한을 받으며, 곧 DevAudit에 인증을 구현할 예정입니다. 대부분의 비인증 사용자는 많은 사용 사례에서 제한을 느끼지 못할 것입니다. 일반적으로 더 큰 프로젝트나 더 많은 프로젝트 볼륨에서만 작동합니다. DevAudit: 개발 감사 최신 릴리즈는 releases 페이지에서 받으십시오. 목차 About Features Requirements...

Cobra

Cobra 이 프로젝트 설계는 현재 화이트박스 스캔 요구 사항을 충족할 수 없으며, 더 이상 유지보수되지 않습니다. 연구 목적으로만 사용하고 프로덕션 환경에서는 사용하지 마십시오. 소개Introduction Cobra는 소스 코드 보안 감사 도구로, 여러 개발 언어 소스 코드에서 대부분의 주요 보안 문제와 취약점을 탐지할 수 있습니다. 특징Features GUI/CLI/API 모드명령줄 모드 및 API 모드 로컬 웹 서버 서비스를 제공하여 GUI 시각적 조작이 가능하며, 로컬 API 인터페이스도 지원하여 다른 시스템배포 시스템...

DiffCatcher

개발 지원 이 프로젝트가 여러분의 작업에 도움이 된다면, 지속적인 유지보수 및 새로운 기능 개발을 지원해 주세요. ETH 기부 지갑 0x11282eE5726B3370c8B480e321b3B2aA13686582 QR 코드를 스캔하거나 위의 지갑 주소를 복사하세요. Git 저장소를 재귀적으로 검색하고, 상태 변경을 캡처하며, 차이diff를 생성하고, 전체 코드 조각을 포함한 코드 요소를 추출하며, 코드 리뷰 및 감사 워크플로를 위한 보안 중심 보고서를 생성하는 Rust CLI 도구입니다. 🎯 주요 기능 저장소 검색 : 구성 가능한...

MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

SummaryWhen extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE 400 MB and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk. Verified Impact...

MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction

Summary When extracting uploaded ZIP/APK files, MobSF checks if individual files exceed ZIPMAXUNCOMPRESSEDFILESIZE 400 MB and logs "Skipping" — but the code lacks a continue statement, so extraction proceeds anyway. The log message is misleading; the file is still written to disk. Verified Impact...

VulnPilot

VulnPilot VulnPilot is an automation framework for vulnerabil...

security-audit

security-audit A Claude Code skill + plugin marketplace for a...

CVE-2023-45823

Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which by using symbolic links in certain kinds of repositories load...

cve

Here are some vulnerabilities related to variou...

EUVD-2023-46375

Malicious code in bioql PyPI...

Exploit-chain

Exploit-chain Exploit chain range building and penetration xx...

Unencrypted Flying Objects: Security Lessons from University Small Satellite Developers and Their Code

Satellites face a multitude of security risks that set them apart from hardware on Earth. Small satellites may face additional challenges, as they are often developed on a budget and by amateur organizations or universities that do not consider security. We explore the security practices and...

SurrealDB server-takeover via SurrealQL injection on backup import

The SurrealDB command-line tool allows exporting databases through the export command. It was discovered that table or field names are not properly sanitized in exports, leading to a SurrealQL injection when the backup is reimported. For the injection to occur, an authenticated System User with...

SurrealDB has local file read of 2-column TSV files via analyzers

An authenticated system user at the root, namespace, or database levels can use the DEFINE ANALYZER statement to point to arbitrary file locations on the file system, and should the file be tab separated with two columns, the analyzer can be leveraged to exfiltrate the content. This issue was...

GHSA-WQ9X-QWCQ-MMGF Diesel vulnerable to Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts

The following presentation at this year's DEF CON was brought to our attention on the Diesel Gitter Channel: SQL Injection isn't Dead: Smuggling Queries at the Protocol Level Archive link for posterity. Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to...

TikTok: Exploitable live argument in onClick Function leads to Data Leakage of Inactive/Suspended Products

The "Search Product" function in the TikTok Shop Seller API contained a vulnerability that allowed access to inactive or suspended products by manipulating the "live" parameter in the API request. The vulnerability was reported to the team and remediated...

Incorrect Decimals Conversion in Curve2PoolAdapter::primitiveOutputAmount Function

Lines of code Vulnerability details Impact The bug in the primitiveOutputAmount function can lead to incorrect decimal conversions when calculating the rawInputAmount. The rawInputAmount is calculated using the convertDecimals function, but the decimals parameter passed to convertDecimals is...

Unverified Primitives

Lines of code Vulnerability details Impact Interacting with unverified or malicious Ocean primitives could result in loss of funds or incorrect computations. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates...

Users pay higher fee than intended

Lines of code Vulnerability details Impact Protocol mints incorrect depositAmount and depositShare to protocol. Such that reserveFee is higher than defined. Suppose following scenario: 1. Tranche 2 has 20% APR, has 5000 borrowed 2. Tranche 1 has 10% APR, has 10000 borrowed 3. ReserveFee is 10% 4...