Comments (4)
k, wrote this then actually looked at the code. Seems like everything is listed in https://github.com/codesake/codesake_dawn/blob/master/lib/codesake/dawn/knowledge_base.rb and references the common securities and vulnerabilities at http://cve.mitre.org/. Let me know if you would like help putting some documentation together in the readme.
from dawnscanner.
Hi Lance, you can see the list of security checks also https://github.com/codesake/codesake_dawn/blob/master/Competitive_matrix.md or by calling dawn with the -k flag.
What do you think about 'dawn -k' output?
from dawnscanner.
Thanks for the response and direction. Kind of hard to read through the list with the formatting as is, I think primarily due to the description/remediation headers. What about the following?
Name: CVE-2013-1933 CVSS: 9.3 Released: 2013-04-25
The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit
(karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute
arbitrary commands via shell metacharacters in a PDF filename. To remediate,
please upgrade karteek-docsplit version to the latest version available.
from dawnscanner.
Last commit introduced a new behaviour when listing knowledge base content. By default only security check name is echoed, you will have more information asking for --verbose.
from dawnscanner.
Related Issues (20)
- Rewrite CVE_2011_0995
- Rewrite CVE_2013_0256
- Rewrite CVE_2013_6461
- Rewrite cve_2015_1840
- Fix hardcoded knowledge base path HOT 1
- ptools 1.3.6 check_bom: undefined method HOT 3
- Cannot run dawnscanner against the src code of a ruby applcation HOT 2
- `--json` outputs invalid JSON
- Issue with Ruby 3.0.0
- Uninitialized constant FileUtils HOT 1
- File.exists is removed from ruby 3.2 (was deprecated in 2.7). HOT 1
- kb.yaml signature mismatch for thesp0nge/dawnscanner_knowledge_base 1.0.0 HOT 2
- Parsing support with 'parser' gem
- Make KB path configurable
- Redesign knowledge base upgrade procedure
- Integrate CVSS gem as internal code
- Removing dawnscanner Rake tasks
- guess_mvc': can't read pyth-agent-1.4.0/Gemfile.lock (ArgumentError)
- Hackweek 2023: parse a simple sinatra application
- Hackweek 2023: allow a single file to be a good target
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dawnscanner.