osv-scanner
betterscan-ce
| osv-scanner | betterscan-ce | |
|---|---|---|
| 10 | 34 | |
| 5,856 | 694 | |
| 1.5% | - | |
| 9.6 | 7.3 | |
| 7 days ago | about 1 month ago | |
| Go | Python | |
| Apache License 2.0 | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
osv-scanner
- An Intro to SBOMs
- SBOM and dependencies check tool and vulnerabilities database from Google
- OSV-Scanner: A vulnerability scanner written in Go which uses the data provided by OSV.dev
-
Vulnerability scanner written in Go that uses osv.dev data
- Building a high quality C/C++ vulnerability database.
You can follow the two linked issues here: https://github.com/google/osv-scanner/issues/82 for updates!
- OSV-Scanner
- google/osv-scanner: Vulnerability scanner written in Go which uses the data provided by https://osv.dev
-
Google Launches Largest Distributed Database of Open Source Vulnerabilities
Link to the official GitHub repo: https://github.com/google/osv-scanner
betterscan-ce
-
Cloud and Code Security - betterscan.io
More on the website: www.betterscan.io
-
Do you SLSA or SBOM in your SDLC?
Maybe you will find https://github.com/marcinguy/betterscan-ce useful (scans SBOMs and Dependencies, apart from Code and IaC).
-
SBOM and dependencies check tool and vulnerabilities database from Google
P.S I also added it to my Security Automation/Orchestration project, it was missing there: https://github.com/marcinguy/betterscan-ce Hope it helps somebody.
-
Nosey Parker: a new scanner to find misplaced secrets in textual data and Git history
Congrats on release. Feel free to check out https://github.com/marcinguy/betterscan-ce It is not that fast, but detects 166+ secret types (modified trufflehog3) and also bugs and vulnerabilities in Code and Cloud setups.
-
OpenSSL 3.0.7 Published
If you want to scan binary to see if this uses vulnerable version, use this YARA rule: https://github.com/marcinguy/betterscan-ce/blob/master/analy...
Courtesy of Akamai.
If you don't know YARA tool, you can run this command in the folder where your binary is (it will install everything needed):
sh <(curl https://dl.betterscan.io/cli.sh)
Hope that helps somebody
-
Text4shell CVE-2022-42889 scan
More: https://github.com/marcinguy/betterscan-ce
- Asking for feedback about my business website
- PMD Apex Code Scanner with integration with CLI output (HTML, JSON, Terminal) or Platform
- Open Source (with Professional paid version) Apex Scanning Tool for Salesforce for Security, Quality and Best practices using PMD with many other checks (incl. secrets)
- Checkov + Kubescape + Code checks unified in one interface/UI or output
What are some alternatives?
trivy - Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
awesome-guidelines - A curated list of high quality coding style conventions and standards.
osv.dev - Open source vulnerability DB and triage service.
noseyparker - Nosey Parker is a command-line program that finds secrets and sensitive information in textual data and Git history.
apko - Build OCI images from APK packages directly without Dockerfile
ThreatPlaybook - A unified DevSecOps Framework that allows you to go from iterative, collaborative Threat Modeling to Application Security Test Orchestration
maloss - Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages
CVE-2022-3602
melange - build APKs from source code
packj - Packj stops :zap: Solarwinds-, ESLint-, and PyTorch-like attacks by flagging malicious/vulnerable open-source dependencies ("weak links") in your software supply-chain
trufflehog - Find and verify secrets