vulnrepro-benchmark

VulnRepro Un benchmark que verifica si un modelo de IA realmente puede revisar código vulnerable, o si solo suena seguro. La mayoría de los benchmarks de seguridad preguntan: ¿puede el modelo encontrar el fallo? Eso es solo la mitad del trabajo. La otra mitad, la que realmente desgasta en una...

DakshSCRA

Daksh SCRA（源代码审查辅助工具） Author: Debasis Mohanty [email protected] Twitter / X: @coffeensecurity www.coffeeandsecurity.com root@kitploit: 关于 Daksh SCRA Daksh SCRA（源代码审查辅助工具）旨在提升源代码审查流程的效率，为代码审查人员提供一种结构清晰、组织有序的方法。 Daksh SCRA...

autoSource

AutoSource AutoSource 是一个自动化源代码审查框架，集成了 SonarQube，能够执行静态代码分析/审查。它可用于在 SDLC（软件开发生命周期）的早期阶段有效发现漏洞。用户只需通过将 GIT 仓库链接提供给框架即可扫描代码。 AutoSource 框架能够在所有平台（MAC、Linux 和 Windows）上执行源代码审查。 安装 1. 将 AutoSource 仓库下载到您的系统中。 2. 阅读 prerequisites.txt 文件并安装依赖项（每个平台均已注明）。 3. 执行 downloadSonar.py（python3...

CVE-2026-22686

Desafío CTF de Escape de Sandbox de Máquina Virtual Enclave Desafío: "Rompiendo los Muros" Dificultad: Difícil Categoría: Revisión de Código Fuente / Escape de Sandbox Puntos: 500 Escenario Has descubierto un misterioso entorno de ejecución de JavaScript en sandbox...

DakshSCRA v0.38-beta

Daksh SCRA Source Code Review Assist root@kitploit: Author: - Debasis Mohanty [email protected] - Twitter / X: @coffeensecurity - www.coffeeandsecurity.com About Daksh SCRA Daksh SCRA Source Code Review Assist tool is built to enhance the efficiency of the source code review process, providi...

GHSA-X39X-9QW5-GHRF Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL

Summary During a manual source code review, ARIMLABS.AI researchers identified that the browseruse module includes an embedded whitelist functionality to restrict URLs that can be visited. This restriction is enforced during agent initialization. However, it was discovered that these measures can...

Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL

Summary During a manual source code review, ARIMLABS.AI researchers identified that the browseruse module includes an embedded whitelist functionality to restrict URLs that can be visited. This restriction is enforced during agent initialization. However, it was discovered that these measures can...

CVE-2024-28200

The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2. This vulnerability was discovered through internal N-central source code review and N-able has not observed any exploitation in the...

DakshSCRA - Source Code Review Assist

Daksh SCRA Source Code Review Assist tool is built to enhance the efficiency of the source code review process, providing a well-structured and organized approach for code reviewers. Rather than indiscriminately flagging everything as a potential issue, Daksh SCRA promotes thoughtful analysis,...

curl: NULL Pointer dereference in idn.c

Vulnerability description not provided...

MAL-2023-7714 Malicious code in tpvirtualramget (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx e1d5d9368eb71fed1c146965eb23d9fc0f5eeda9d35ab57a5342f84481e6c5a7 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Upgraded Q -> M from 9 [1659036743700]

Judge has assessed an item in Issue 9 as Medium risk. The relevant finding follows: Centralized risk The operator address can mint arbitrary amount of tokens. In addition, operator can also burn tokens from third-party accounts. If the private key of the owner or minter address is compromised, th...

Online Farm Management System 0.1.0 Cross Site Scripting

Exploit Title: Online Farm Management System 0.1.0 - Persistent Cross-Site Scripting Date: 2020-06-29 Exploit Author: KeopssGroup0day,Inc Vendor Homepage: https://www.sourcecodester.com/php/14198/online-farm-management-system-phpmysql.html Software Link:...

AutoSource - Automated Source Code Review Framework Integrated With SonarQube

AutoSource is an automated source code review framework integrated with SonarQube which is capable of performing static code analysis/reviews. It can be used for effectively finding the vulnerabilities at very early stage of the SDLCSoftware Development Life Cycle. The user can scan the code by...

Radancy: Application error message

Request GET / HTTP/1.1 Host: 12345'"'";|%00%0d%0a%bf%27' Referer: https://serverhk.maximum.com:443/ Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Opera/9.80 Windows NT 6.0; U; en Presto/2.8.99 Version/11.10 Accept: / Response HTTP/1.1 500 Internal Server Error Server:...

Openwall 3.1 Released With Fixes for Shellshock, POODLE Attack

The maintainers of the Openwall security enhanced Linux distribution have released a new stable version, which includes fixes for a number of serious vulnerabilities, such as the Shellshock Bash bug and the flaw in SSLv3 that leads to the POODLE attack. Openwall is designed to be a small, compact...

Cloud application security: preventing security vulnerabilities-vulnerability warning-the black bar safety net

Currently, cloud-based applications are widely used, and with amazing speed growing. Since cloud-based applications can be accessed through the Internet, and anyone, anywhere can access – therefore, application security becomes particularly important. This is why the creation and management of...

Google engineers NeelMehta is how to find heart blood vulnerability-vulnerability warning-the black bar safety net

Heartbleed computer security vulnerabilityis by Google engineers NeelMehta found, has always been unwilling to accept media to interview him today for the first time to the media to say how he found this serious vulnerability; and why would go the first time to find the vulnerabilities, and he...

Concrete CMS: FULL PATH DISCLOSUR

Full Path Disclosure FPD vulnerabilities enable the attacker to see the path to the webroot/file. e.g.: /home/omg/htdocs/file/. Certain vulnerabilities, such as using the loadfile within a SQL Injection query to view the page source, require the attacker to have the full path to the file they wis...

BruCON Agnitio workshop Slides and Video Demonstration - Download

BruCON Agnitio workshop Slides and Video Demonstration - Download Workshop by David Rook Security Ninja at BruCON 2011 in Belgium. You can Download Slide from here. Required for the Agnitio hands on demos: A 32bit Windows Operating System XP or 7 preferably – VM will be fine .NET framework 3.5...