Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add board command #46

Merged
merged 1 commit into from Dec 2, 2021
Merged

add board command #46

merged 1 commit into from Dec 2, 2021

Conversation

baneetparmar
Copy link
Collaborator

No description provided.

@baneetparmar baneetparmar merged commit 9b69307 into main Dec 2, 2021
@baneetparmar baneetparmar deleted the 0.04 branch December 2, 2021 09:20
@baneetparmar
Copy link
Collaborator Author

deps-report 🔍

Commit scanned: 1f449ed
ℹ️ Python version 3.9 is used by your project but the latest version is 3.10.

Vulnerable dependencies

2 dependencies have vulnerabilities 😱
Dependency Advisory Versions impacted
aiohttp (transitive) Aiohttp 3.8.0 adds validation of HTTP header keys and values to prevent header injection.
aio-libs/aiohttp#4818 <3.8.0
reportlab (transitive) All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF >=0

Outdated dependencies

21 outdated dependencies found (including 3 outdated major versions)😢
Dependency Installed version Latest version
aiohttp (transitive) 3.7.4.post0 3.8.1
async-timeout (transitive) 3.0.1 4.0.1
black (dev) 21.9b0 21.11b1
certifi (transitive) 2021.5.30 2021.10.8
cffi (transitive) 1.15.0rc1 1.15.0
charset-normalizer (transitive) 2.0.6 2.0.8
click (transitive) 8.0.1 8.0.3
idna (transitive) 3.2 3.3
jishaku 2.3.0 2.3.2
lxml (transitive) 4.6.3 4.6.4
multidict (transitive) 5.1.0 5.2.0
pillow (transitive) 8.3.2 8.4.0
pycparser (transitive) 2.20 2.21
pymongo 3.12.0 4.0
regex (dev,transitive) 2021.9.24 2021.11.10
reportlab (transitive) 3.6.1 3.6.3
soupsieve (transitive) 2.2.1 2.3.1
tinycss2 (transitive) 1.1.0 1.1.1
tomli (dev,transitive) 1.2.1 1.2.2
typing-extensions (transitive) 3.10.0.2 4.0.1
yarl (transitive) 1.6.3 1.7.2

Logs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant