fast-security-scanners

快速安全扫描器/检查 对社区的一点小贡献 : 我们在安全评估和漏洞监控服务中使用了所有这些工具。 检查域名的 DNS NS 接管 仓库 docker run --dns=8.8.8.8 -e VULNID=dnsnstakeover -e DOMAIN=site.com whitespots/dnsnstakeover 缓存投毒 仓库 docker run --rm -it --name wcdscanner -e VULNID=wcd -e FINDXSS=False -e DOMAIN=site.com whitespots/wcdxss 通过 Meta 标签实现的...

open-source-web-scanners

open-source-web-scanners A list of open source web security scanners on GitHub and GitLab, ordered by Stars. It does not provide in-depth analysis - for more analysis or a wider range of tools, see the links below. Note that some large projects have multiple repos - in which case the second most...

cve-2021-3007-vulnerable

CVE-2021-3007 Entorno de Prueba Vulnerable Entorno de prueba intencionadamente vulnerable para validar la detección de CVE-2021-3007 en escáneres de seguridad. Resumen de la Vulnerabilidad...

GO-2025-3830 vulnerabilities

Vulnerabilities for packages: buildah, k9s, splunk-otel-collector-fips, grype, nerdctl, splunk-otel-collector, opentelemetry-collector, nerdctl-fips, prometheus-fips, openfga-fips, trivy-fips, beats-fips, apko-fips, zot, buf, chainctl, docker-compose, cadvisor, cg, grype-db, osv-scanner, tw,...

Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents

Security firm AIR built a fake AI agent skill, pushed it through a popular skill marketplace and an Instagram ad, and says it reached roughly 26,000 agents, including some on corporate accounts. Every skill security scanner the firm tested it against marked it safe. The payload was harmless by...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: k9s, grype, headlamp-fips, kube-mgmt, kube-arangodb-fips, gitlab-rails-ce, linkerd2-fips, crossplane, spegel-fips, xeol-fips, rancher, zot, chainctl, falco-no-driver, helm, beats, fuse-overlayfs-snapshotter, steampipe, buildkitd-fips, zarf, buildkitd, consul-k8s-fips...

RealVuln: Benchmarking Rule-Based, General-Purpose LLM, and Security-Specialized Scanners on Real-World Code

How do security scanners perform on real-world code? We present RealVuln, the first open-source benchmark comparing Rule-Based SAST, General-Purpose LLMs, and Security-Specialized scanners on 26 intentionally vulnerable Python repositories educational and Capture-The-Flag applications with 796...

Unpacking Security Scanners for GitHub Actions Workflows

GitHub Actions is a widely used platform that allows developers to automate the build and deployment of their projects through configurable workflows. As the platform's popularity continues to grow, it has become a target of choice for recent software supply chain attacks. These attacks exploit...

Malicious Package

Overview eslint-plugin-unicorn-ts-2 is a malicious package. This package uses typosquatting techniques, which are intended to trick users into downloading and installing the malicious package instead of the intended legitimate one. The malicious payload attempts to exfiltrate sensitive data from...

Malicious npm Package Uses Hidden Prompt and Script to Evade AI Security Tools

Cybersecurity researchers have disclosed details of an npm package that attempts to influence artificial intelligence AI-driven security scanners. The package in question is eslint-plugin-unicorn-ts-2, which masquerades as a TypeScript extension of the popular ESLint plugin. It was uploaded to th...

SUSE CVE-2025-54059

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image,...

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions due to world-writable permissions set on SBOM files in the file system. An attacker can modify or delete SBOM files by gaining local access to the running image, which may confuse security scanners or disru...

melange's world-writable permissions expose SBOM files to potential image tampering

It was discovered that the SBOM files generated by melange in apks had file system permissions mode 666: $ apkrane ls https://packages.wolfi.dev/os/x8664/APKINDEX.tar.gz -P hello-wolfi --full --latest | xargs wget -q -O - | tar tzv 2/dev/null var/lib/db/sbom drwxr-xr-x root/root 0 2025-06-23 14:1...

CVE-2025-54059 melange creates SBOM files in APKs with world-writable permissions

melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image,...

SecuSphere - Efficient DevSecOps

SecuSphere is a comprehensive DevSecOps platform designed to streamline and enhance your organization's security posture throughout the software development life cycle. Our platform serves as a centralized hub for vulnerability management, security assessments, CI/CD pipeline integration, and...

Cross Site Scripting (XSS) Identifies NetScaler Redirect VIP as Vulnerable

NetScaler Virtual IP VIP configured for redirect is being labeled as vulnerable by Security Scanners for Cross Site Scripting XSS...

SUSE-SU-2023:2932-1 Security update for python-pip

This update for python-pip fixes the following issues: - Removed .exe files from the RPM package, to prevent issues with security scanners bsc1212015...

PT-2023-36233 · Unknown · Python-Pip

Name of the Vulnerable Software and Affected Versions: python-pip affected versions not specified Description: The issue with python-pip is related to the presence of .exe files in the RPM package, which could cause problems with security scanners. Recommendations: At the moment, there is no...

PT-2023-36234 · Unknown · Python-Pip

Name of the Vulnerable Software and Affected Versions: python-pip affected versions not specified Description: The issue with python-pip is related to the presence of .exe files in the RPM package, which could cause problems with security scanners. Recommendations: At the moment, there is no...

CVE-2021-3031 PAN-OS: Information exposure in Ethernet data frame construction (Etherleak)

Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewalls are not cleared before the data frame is created. This leaks a small amount of random information from the firewall memory into the...