849088 matches found
nahsra__antisamy_CVE-2016-10006_1-5-3
antisamy 信頼できないソースから提供されたHTMLを高速かつ設定可能な方法でクレンジングするためのライブラリです。 別の言い方をすれば、クライアントがプロフィールやコメントなどに使用するHTMLに悪意のあるカーゴコードを仕込むのを防ぐためのAPIです。サーバー側で永続化されるHTMLに、クライアントが悪意のあるコードを混入させないようにします。ここでいう「悪意のあるコード」とは、Webアプリケーションにおいては通常「JavaScript」を指します。 Cascading Stylesheets...
threat-model-cookbook
OWASP Threat Model Cookbook プロジェクト このプロジェクトは、脅威モデルの例を作成し公開することを目的としています。それらは、コード、グラフィカルな表現、テキストによる表現の形をとることができます。モデルは多様なテクノロジー、方法論、テクニックを使用します。 これらのモデルから学んだり、自分自身のモデルを始めるためのベースとして使用したり、あるいはモデルの一部に貢献して拡張したりすることができます。これにより、脅威モデルの共同クックブックとなります。 https://owasp.org/www-project-threat-model-cookbook/...
CICD-Goat-Vapt-Writeup
CICD-Goat VAPT Writeup A full vulnerability assessment & penetration test against OWASP CICD-Goat — a deliberately vulnerable CI/CD environment Jenkins, Gitea, GitLab, CTFd — mapped end-to-end against the OWASP Top 10 CI/CD Security Risks. Why this exists Most CI/CD security writeups either stay...
log4shell-coraza
Log4Shell Security Lab — nginx + Coraza WAF Scopo educativo/difensivo : questo lab contiene un'app intenzionalmente vulnerabile Log4j 2.14.1 e un kit di exploit JNDI, SOLO per imparare a rilevare e bloccare Log4Shell in un ambiente isolato. Non distribuire su Internet, non usare per attaccare...
HUNT
Estensioni proxy di HUNT Suite Cos'è HUNT Suite? HUNT Suite è una raccolta di estensioni per Burp Suite Pro/Free e OWASP ZAP. Identifica i parametri comuni vulnerabili a determinate classi di vulnerabilità Burp Suite Pro e OWASP ZAP. Organizza le metodologie di test Burp Suite Pro e Free. HUNT...
training-application-security
Treinamento Gratuito de Codificação Segura e Segurança de Aplicações — Exercícios SCORM de Código Aberto 40 exercícios gratuitos de codificação segura em código aberto que ensinam segurança de aplicações web da forma como os desenvolvedores aprendem — explorando vulnerabilidades reais como injeçã...
CVE-2026-37736
An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...
EUVD-2026-67773
An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2026-37736
An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input. The vulnerability is rated CVSS 3.1: 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, meaning it is network-exploitable with n...
CVE-2026-37736
An issue in the JsonSanitizer.sanitize component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service DoS via a crafted input...
Nest v2026.08.24
!Issueshttps://img.shields.io/github/issues/owasp/nest?color=blue&style=...
Vulnerability_Assessment_and_Exploitation
VulnerabilityAssessmentandExploitation This assessment was...
SecureAI-Scan v0.10.0
SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...
The OWASP LLM Top 10 Was the Warm-Up: What Comes Next
This is Post 3 of a three-part series. Start withPost 1: Agentic AI Security: The Chatbot Era Is Over, then continue to Post 2: Generative AI Security: Why AI Needs a New Kind of Security. When the OWASP Top 10 for LLM Applications arrived, it did the industry a real service. It gave security tea...
exp-labs
exp-labs Cybersecurity Training Platform This modern web secu...
Why API Discovery Is Critical for Modern AppSec Programs
Hidden API Estate And AI-speed Recon Are Reshaping Modern Application Risk Key Takeaways Unknown APIs create unattributed exposure , and such exposure rarely gets tested. Attackers build their own inventory through live reconnaissance; they do not wait for your spreadsheet. API discovery must pul...
SecureAI-Scan v0.8.0
SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...
wazuh-iis-defense
Guia de Configuração — Monitoramento IIS com Wazuh + Sysmon...
SecureAI-Scan v0.7.0
SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...
SecureAI-Scan v0.6.0
SecureAI-Scan The AI security scanner that proves its findings. SecureAI-Scan finds LLM, MCP, Agent Skill, and RAG vulnerabilities in TypeScript, JavaScript, and Python — and shows you the evidence: the exact source → flow → sink path for every dataflow finding, resolved through real imports, not...