13120 matches found
rbndr
rbndr Simple DNS Rebinding Service rbndr is a very simple, non-conforming, name server for testing software against DNS rebinding vulnerabilities. The server responds to queries by randomly selecting one of the addresses specified in the hostname and returning it as the answer with a very low ttl...
guac
GUAC: Graph for Understanding Artifact Composition Note: GUAC is under active development - if you are interested in contributing, please look at contributor guide. GUAC is an OpenSSF incubating project under the Supply Chain Integrity WG. Graph for Understanding Artifact Composition GUAC...
threat-modeling-playbook
Intro We aim to improve product and software security with our new threat modeling playbook. We consider threat modeling as a foundational activity to improve your software assurance. We are convinced that a good threat modeling practice will measurably decrease security issues of delivered...
DirtyPipe-CVE-2022-0847
DirtyPipe-CVE-2022-0847 This repository is developed to analysis and understand DirtyPipe exploit CVE-2022-0847 for my 3rd year 1st year secure software system assignment. Paper I wrote paper will availble after my semester ends...
Gitea 1.1.0 - 1.12.5 - Remote Code Execution
Gitea 1.1.0 through 1.12.5 is susceptible to authenticated remote code execution, via the git hook functionality, in customer environments where the documentation is not understood e.g., one viewpoint is that the dangerousness of this feature should be documented immediately above the...
Dahua IPC/VTH/VTO - Authentication Bypass
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. id: CVE-2021-33045 info: name: Dahua IPC/VTH/VTO - Authentication Bypass author: phantomowl severity:...
Investigating Developer-Reported Software Security Testing Challenges
Software security testing SST is essential for identifying vulnerabilities and improving software security, but developers often face practical challenges when selecting tools, configuring test environments, interpreting scanner outputs, testing authentication workflows, and acting on reported...
MOVEit Transfer - Remote Code Execution
In Progress MOVEit Transfer before 2021.0.6 13.0.6, 2021.1.4 13.1.4, 2022.0.4 14.0.4, 2022.1.5 14.1.5, and 2023.0.1 15.0.1, a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database...
LLM-Based Agents for Software and Systems Security: Approaches, Applications, and Assessment
Software and systems security workflows are typically procedural: analysts inspect heterogeneous artifacts, form hypotheses, invoke tools, interpret outputs, and revise plans. Large language model LLM-based agents, which can plan, use tools, retain state, and revise actions across multi-step...
MINI-J248-4FR3-3456
Bulletin has no description...
GHSA-Q496-Q274-JGH9 vulnerabilities
Vulnerabilities for packages: exim...
MINI-6VGX-C24M-5JJG
Bulletin has no description...
MINI-WVG2-F9XQ-2JP6
Bulletin has no description...
CVE-2026-19489
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21...
Adobe Lightroom Classic Auth Bypass RCE
The vulnerability of Adobe Lightroom Classic’s graphic editor is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to execute arbitrary code...
CVE-2026-62462
Oracle E-Business Suite Work in Process (component: Internal Operations) versions 12.2.3-12.2.15 is vulnerable. A low-privileged attacker with network access via HTTP can exploit it for full CIA impact (CVSS 8.8 HIGH). Oracle's August 2026 CPU advisory is referenced for patch details; no exploit ...
BELL-CVE-2026-74373
Bulletin has no description...
BELL-CVE-2026-74361
Bulletin has no description...
