962 matches found
pip-audit
pip-audit pip-audit 是一个用于扫描 Python 环境中已知漏洞包的工具。它通过 PyPI JSON API 使用 Python 打包咨询数据库 https://github.com/pypa/advisory-database 作为漏洞报告的来源。 该项目由 Trail of Bits 部分维护，并得到 Google 的支持。这不是 Google 或 Trail of Bits 的官方产品。 索引 特性 安装 第三方包 GitHub Actions pre-commit 支持 用法 环境变量 退出码 空运行 示例 故障排除 技巧与提示 安全模型 许可 贡献 行为准则...
heaphopper
heaphopper HeapHopper is a bounded model checking framework for Heap-implementations. Overview Setup sudo apt update && sudo apt install build-essential python3-dev virtualenvwrapper git clone https://github.com/angr/heaphopper.git && cd ./heaphopper mkvirtualenv -ppython3 heaphopper pip install ...
tcconfig
.. contents:: tcconfig :backlinks: top :depth: 2 Summary tcconfig is a tc command wrapper. Make it easy to set up traffic control of network bandwidth/latency/packet-loss/packet-corruption/etc. to a network-interface/Docker-containerveth. |PyPI pkg ver| |Supported Python ver| |CI status| |CodeQL|...
prowler
Prowler Prowler is a Network Vulnerability Scanner implemented on a Raspberry Pi Cluster, first developed during Singapore Infosec Community Hackathon - HackSmith v1.0. Capabilities Scan a network a particular subnet or a list of IP addresses for all IP addresses associated with active network...
advisory-database
Base de datos de avisos de empaquetado de Python Este es un repositorio propiedad de la comunidad que contiene avisos para paquetes publicados en https://pypi.org. Los avisos se encuentran en el directorio vulns y utilizan una codificación YAML de un formato simple. Contribuir con avisos Realizar...
Pip-Intel
🌐PIP-INTEL - 开源情报与网络智能工具🌐 测试环境：Kali-Linux Pip-Intel 是一款专为 OSINT（开源情报）和网络情报收集活动设计的强大工具。 它将多种开源工具整合到一个用户友好的界面中， 简化了研究人员和网络安全专业人员的数据收集与分析流程。 Pip-Intel 利用 Python 编写的 pip 包从各种数据点收集信息。 该工具具备通过电子邮件地址、电话号码、IP 地址和社交媒体账户收集详细情报的能力。 它提供广泛的功能，包括基于电子邮件的 OSINT 操作、 基于电话号码的查询、IP 地址地理定位、社交媒体与用户分析，甚至暗网搜索。...
aura
.. image:: https://cdn.sourcecode.ai/imgs/logotype.png :target: https://aura.sourcecode.ai/ ====== .. class:: center |homepageflair| |docsflair| |dockerflair| |licenseflair| |travisflair| |pypiflair| Source code auditing and static code analysis Aura is a static analysis framework developed as a...
AuraBorealisApp
AuraBorealis：你了解你的 Python 包中包含什么吗？ 关于 AuraBorealis 是一个用于可视化 Python 包注册表中异常及潜在恶意代码的 Web 应用程序。它利用通过 Aura 扫描 Python 包索引（PyPI）所产生的安全审计数据，Aura 是一种专为大规模 Python 包安全审计而设计的静态分析工具。当前版本为概念验证，包含部分实时的 Aura 数据以及一些用于演示的模拟数据。 当前功能包括： 扫描整个 Python 包注册表，以便： 列出安全警告数量最多的包，按 Aura 警告类型 排序 列出按警告总数和唯一警告数量排序的包...
GHSA-6R2R-WW24-7H52 vulnerabilities
Vulnerabilities for packages: awx, opal, mlflow, checkov, datahub-ingestion, datahub-ingestion-fips...
GHSA-7JX3-JQCP-HHGC vulnerabilities
Vulnerabilities for packages: checkov, mlflow, awx, opal...
GHSA-5CC2-282F-JJQ2 vulnerabilities
Vulnerabilities for packages: airflow, mlrun, datadog-agent-fips, datadog-agent, keep-fips, keep, mlrun-fips...
Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...
Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1995)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1995 advisory. The incremental HTML parser html.parser.HTMLParser allows for CPUdenial-of-service through repeated unterminated markup declarations whenprocessing uncontrolled data. CVE-2026-15308 In the...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
Malicious code in catalogai (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccb9ff2c71a85c2bac770a874ed3c811e963ba9b3da37417fb600678d8119991 catalogai 0.1.2 presents itself as a semantic-search / AI-catalog library but the shipped modules perform browser credential theft and...
GHSA-7QJ2-Q5C8-CXX5 vulnerabilities
Vulnerabilities for packages: python...
GHSA-7QJ2-Q5C8-CXX5 vulnerabilities
Vulnerabilities for packages: python...
CVE-2026-15308 vulnerabilities
Vulnerabilities for packages: python...
Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1933)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1933 advisory. The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result ...