Python Vulnerabilities

Open-source Python projects categorized as Vulnerabilities

Top 16 Python Vulnerability Projects

  • clusterfuzz

    Scalable fuzzing infrastructure.

    Project mention: An ex-Googler's guide to dev tools | news.ycombinator.com | 2022-07-17

    Then it is clear that the behavior of this for loop is either not important or not being tested. This could mean that the tests that you do have are not useful and can be deleted.

    > For most non-trivial software the possible state-space is enormous and we generally don't/can't test all of it. So "not testing the (full) behaviour of your application is the default for any test strategy", if we could we wouldn't have bugs... Last I checked most software (including Google's) has plenty of bugs.

    I have also used (setup, fixed findings) using https://google.github.io/clusterfuzz/ which uses coverage + properties to find bugs in the way C++ code handles pointers and other things.

    > The next question would be let's say I spend my time writing the tests to resolve this (could be a lot of work) is that time better spent vs. other things I could be doing? (i.e. what's the ROI)

    That is something that will depend largely on the team and the code you are on. If you are in experimental code that isn't in production, is there value to this? Likely not. If you are writing code that if it fails to parse some data correctly you'll have a huge headache trying to fix it? Likely yes.

    The SRE workbook goes over making these calculations.

    > Even ignoring that is there data to support that the quality of software where mutation testing was added improved measurably (e.g. less bugs files against the deployed product, better uptime, etc?)

    I know that there are studies that show that tests reduce bugs but I do not know of studies that say that higher test coverage reduces bugs.

    The goal of mutation testing isn't to drive up coverage though. It is to find out what cases are not being exercised and evaluating if they will cause a problem. For example mutation testing tools have picked up cases like this:

       if (debug) print("Got here!");

  • kube-hunter

    Hunt for security weaknesses in Kubernetes clusters

    Project mention: Looking for Tips on Open Sourcing a kubernetes security tool | reddit.com/r/kubernetes | 2022-10-12
  • Sonar

    Write Clean Python Code. Always.. Sonar helps you commit clean code every time. With over 225 unique rules to find Python bugs, code smells & vulnerabilities, Sonar finds the issues while you focus on the work.

  • rapidscan

    :new: The Multi-Tool Web Vulnerability Scanner.

  • opencve

    CVE Alerting Platform

    Project mention: how to stay up to date with new CVEs? | reddit.com/r/cybersecurity | 2023-05-25
  • dagda

    a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities

    Project mention: Open source container scanning tool to find vulnerabilities and suggest best practice improvements? | reddit.com/r/selfhosted | 2023-04-15

    https://github.com/eliasgranderubio/dagda 1k stars, updated July 27th, 2021

  • cve-bin-tool

    The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 200 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.

    Project mention: 2022 Highlights: Open Source Development! ✨ | dev.to | 2022-12-14

    intel/cve-bin-tool - 2 pull requests

  • CodiumAI

    TestGPT | Generating meaningful tests for busy devs. Get non-trivial tests (and trivial, too!) suggested right inside your IDE, so you can code smart, create more value, and stay confident when you push.

  • PocOrExp_in_Github

    聚合Github上已有的Poc或者Exp,CVE信息来自CVE官网。Auto Collect Poc Or Exp from Github by CVE ID.

  • vulnix

    Vulnerability (CVE) scanner for Nix/NixOS.

    Project mention: Is NixOS a thing? | reddit.com/r/devops | 2022-11-09

    it is very easy to scan your entire dependency tree for known vulnerabilities for Nix, all the way up to a whole OS

  • vulnerable-apps

    Project mention: DeepSource - From Vulnerability discovery to Exploit development | dev.to | 2022-11-01
  • deadshot

    Deadshot is a Github pull request scanner to identify sensitive data being committed to a repository

  • inthewilddb

    Hourly updated database of exploit and exploitation reports

    Project mention: Where do you get your information regarding new vulnerabilities and security risks? | reddit.com/r/sysadmin | 2023-05-09

    intothewild - https://github.com/gmatuz/inthewilddb/blob/master/rss.xml

  • jake

    Check your Python environments for vulnerable Open Source packages with OSS Index or Sonatype Nexus Lifecycle.

  • ochrona-cli

    A command line tool for detecting vulnerabilities in Python dependencies and doing safe package installs

  • wphash-vuln-data

    WordPress vulnerability data

    Project mention: WPHash - Fingerprinting WordPress Plugins, now in public beta and open to feedback and collaboration | reddit.com/r/netsec | 2022-09-04

    Public vulnerability information regarding WordPress plugins is open to anyone who would like to use it, The data lives under https://github.com/cydave/wphash-vuln-data.

  • bogrod

    Manage security vulnerabilities in release notes

    Project mention: Show HN: Manage vuln. exploit data (VEX) in Git and merge with cyclonedx SBOM | news.ycombinator.com | 2023-01-13
  • ONLYOFFICE

    ONLYOFFICE Docs — document collaboration in your environment. Powerful document editing and collaboration in your app or environment. Ultimate security, API and 30+ ready connectors, SaaS or on-premises

NOTE: The open source projects on this list are ordered by number of github stars. The number of mentions indicates repo mentiontions in the last 12 Months or since we started tracking (Dec 2020). The latest post mention was on 2023-05-25.

Python Vulnerabilities related posts

Index

What are some of the best open-source Vulnerability projects in Python? This list will help you:

Project Stars
1 clusterfuzz 5,010
2 kube-hunter 4,270
3 cve-search 2,062
4 rapidscan 1,435
5 opencve 1,378
6 dagda 1,053
7 cve-bin-tool 739
8 PocOrExp_in_Github 646
9 vulnix 307
10 vulnerable-apps 202
11 deadshot 187
12 inthewilddb 133
13 jake 86
14 ochrona-cli 49
15 wphash-vuln-data 8
16 bogrod 3
Access the most powerful time series database as a service
Ingest, store, & analyze all types of time series data in a fully-managed, purpose-built database. Keep data forever with low-cost storage and superior data compression.
www.influxdata.com