owasp

Is your feature request related to a problem?

The Traditional and Traditional Plus JSON reports treat "Other Info" as consistent between alerts which is not always the case. A new JSON report should be added which treats "Other Info" as potentially unique per alert instance.

As per the original issue a perfect way to test/experience this need is the Retire.JS passive scan alerts which i

What and where?
Please give the broken URL. Where is the link located?

Would you like to be assigned to this issue?
Check the box if you will submit a PR to fix this issue. Please read CONTRIBUTING.md.
-KONG [ ] Assign me, please!

It seems that the link to A Roadmap for Node.js Security is dead. The proposed link on lirantal/awesome-nodejs-security#42 (comment) does work though. It might better be replaced in the documentation.

Description

BeanUtils is a library that is doing automatic mapping to Java object.
It can cause arm when the attack controls part of the list of properties being sets. BeanUtils does not blacklist properties like class, classloader or other objects that are likely to load arbitrary classes and possibly run code.

Code

import org.apache.commons.beanutils.BeanUtils;

public

Current Behavior:

As identified in #1727, there may be multiple fields of CycloneDX BOMs that we currently don't ingest or display.

Proposed Behavior:

Assess DT's coverage of CycloneDX v1.4 fields and add support for ingesting and displaying missing fields.

There is no information on where this list comes from but undoubtedly should come from the official php config directives list.

This is low hanging 🥝 🍓 🍍 also!