CVE packageURL: Join CVE JSON 5.2 Records to SBOM purls
CVE Record Format 5.2.0 added an optional packageURL field to affected entries. We counted it across all 400,445 published records: 1.6% carry one, 12 …
Tag
AppSec
CVE cpeApplicability: CPE Match Nodes, Operators, Ranges
Since CVE Record Format 5.1.1, a CNA can put CPE Applicability Language statements in a cpeApplicability block. Here is how nodes, operator, negate, …
CycloneDX VEX: analysis.state and justification to OpenVEX
CycloneDX VEX uses six analysis states and nine justifications; OpenVEX and CSAF use four statuses and five justifications. Here is a field-by-field …
GitHub Actions OIDC: Stop Storing Cloud Credentials in CI/CD
A static cloud credential stored as a CI secret is valid until someone notices it's wrong. An OIDC-issued credential is valid for one workflow run and …
CVE Affected Versions: lessThan, defaultStatus, versionType
The affected block in a CVE record is a small algorithm, not a list. Here is how version, lessThan, lessThanOrEqual, changes, versionType and …
How to Secure GitHub Actions: Permissions, Secrets, and OIDC
A GitHub Actions workflow often runs with more access than the task actually requires, simply because the defaults are permissive and nobody scoped …
Escape User Input in Regex and SQL LIKE: Tested Fixes
A search box that drops user text into new RegExp() or a LIKE pattern is a small injection bug: a dot matches anything, .* matches everything, and a % …
Dependency Confusion: How Package Managers Can Become an Attack Path
Dependency confusion doesn't exploit a vulnerability in any package. It exploits a resolution assumption most package managers share, and it was …
User-Supplied Regex: How to Run It Without ReDoS
Search filters, alert rules, routing configs and log tools all end up accepting regular expressions from users. In a backtracking engine that is a …
Software Supply Chain Attacks: Where Modern Build Pipelines Break
A build pipeline trusts a long chain of things by default: the package registry, the CI runner, every plugin, every base image. Each link is a place a …
Secure File Uploads in Node.js: A Tested Express Setup
Most upload bugs come from trusting something the client sent: the filename, the Content-Type, or the idea that a file sitting in a public folder …
Node.js Decompression Bombs: zlib Limits That Work
A 100 KB gzip body can decompress to 100 MB. Node's maxOutputLength stops that in the one-shot zlib functions, but streams silently ignore it, and …