NNTmux / newznab-tmux

1. high Semgrep Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`. /app/Services/ConsoleService.php:210 98%
2. high Semgrep Untrusted input might be used to build a database query, which can lead to a SQL injection vulnerability. An attacker can execute malicious SQL statements and gain unauthorized access to sensitive data, modify, delete data, or execute arbitrary system commands. To prevent this vulnerability, use prepared statements that do not concatenate user-controllable strings and use parameterized queries where SQL commands and user data are strictly separated. Also, consider using an object-relational (ORM) framework to operate with safer abstractions. To build SQL queries safely in PHP, it is possible to adopt prepared statements by using `PDO` with bind variables using `bindParam()`. /app/Services/MusicService.php:192 98%
3. high GuardDog Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] /deploy/baremetal/host.py:285 96%
4. high GuardDog Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] /deploy/baremetal/host.py:284 96%
5. high GuardDog Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] /deploy/baremetal/host.py:280 96%
6. high Semgrep User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare("INSERT INTO test(id, label) VALUES (?, ?)");`) or a safe library. /app/Services/ConsoleService.php:205 56%
7. high Semgrep User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare("INSERT INTO test(id, label) VALUES (?, ?)");`) or a safe library. /app/Services/ConsoleService.php:218 56%
8. high Semgrep User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare("INSERT INTO test(id, label) VALUES (?, ?)");`) or a safe library. /app/Services/MusicService.php:187 56%
9. high Semgrep User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data from the database. Instead, use prepared statements (`$mysqli->prepare("INSERT INTO test(id, label) VALUES (?, ?)");`) or a safe library. /app/Services/MusicService.php:200 56%
10. high Semgrep Generic API Key detected /.env.example:271 52%
11. high Semgrep Executing non-constant commands. This can lead to command injection. /app/Console/Commands/NntmuxESReindex.php:41 43%
12. high Semgrep Executing non-constant commands. This can lead to command injection. /app/Console/Commands/NntmuxESReindex.php:40 43%
13. high Semgrep Executing non-constant commands. This can lead to command injection. /app/Console/Commands/NntmuxESReindex.php:42 43%
14. high Semgrep Executing non-constant commands. This can lead to command injection. /app/Services/Tmux/TmuxSessionManager.php:125 43%
15. high Semgrep Executing non-constant commands. This can lead to command injection. /scripts/benchmark-yenc.php:120 43%
16. high Semgrep Executing non-constant commands. This can lead to command injection. /app/Services/Tmux/Scripts/groupfixrelnames.php:49 43%
17. high Semgrep Executing non-constant commands. This can lead to command injection. /app/Services/Tmux/Scripts/monitor.php:18 43%
18. high Semgrep Executing non-constant commands. This can lead to command injection. /app/Services/Tmux/Scripts/postprocess_pre.php:18 43%
19. high Semgrep Executing non-constant commands. This can lead to command injection. /app/Services/Tmux/Scripts/update_groups.php:15 43%
20. high Semgrep By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. /docker/8.5/Dockerfile:104 22%
21. high YARA YARA rule matched: detect_anti_analysis — Checks for a debugger, VM, or sandbox before continuing - a common malware evasion technique, essentially never present in ordinary application code /scripts/benchmark-yenc.php 18%
22. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /public/js/filament/forms/components/file-upload.js 3%
23. high YARA YARA rule matched: detect_base64_exec — Encoded payload decoded and then executed /public/vendor/horizon/app.js 3%
24. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /scripts/build-rapidyenc.sh 1%
25. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /public/vendor/horizon/js/app.js 1%
26. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /public/vendor/horizon/js/app.js.map 1%
27. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /public/vendor/telescope/app.js 1%
28. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /public/js/filament/forms/components/markdown-editor.js 1%
29. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /public/js/filament/filament/echo.js 1%
30. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /docker/8.5/Dockerfile 0%
31. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /deploy/select.sh 0%
32. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /deploy/cloud/deploy.sh 0%
33. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /infra/terraform/aws/cloud-init.yaml.tftpl 0%
34. medium Semgrep RegExp() called with a `query` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS. /resources/js/alpine/components/search-autocomplete.js:138 100%
35. medium Semgrep By default, AWS SecretManager secrets are encrypted using AWS-managed keys. However, for added security, it's recommended to configure your own AWS KMS encryption key to protect your secrets in the Secret Manager. You can either create a new aws_kms_key resource or use the ARN of an existing key in your AWS account to do so. /infra/terraform/aws/main.tf:123 100%
36. medium Semgrep Ensure EBS Volume is encrypted at rest using KMS CMKs. CMKs gives you control over the encryption key in terms of access and rotation. /infra/terraform/aws/main.tf:100 100%
37. medium Semgrep These permissions `0o700` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else. /deploy/baremetal/host.py:773 100%
38. medium Semgrep EC2 instances should not have a public IP address attached in order to block public access to the instances. To fix this, set your `associate_public_ip_address` to `"false"`. /infra/terraform/aws/main.tf:169 99%
39. medium Semgrep This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a `cooldown` block with `default-days: 7` to each `package-ecosystem` entry under `updates` to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown /.github/dependabot.yml:8 99%
40. medium Semgrep File name based on user input risks server-side request forgery. /server.php:15 55%
41. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/laravel.yml:41 52%
42. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/add_label_to_issue.yml:12 52%
43. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/add_label_to_reopened_issue.yml:12 52%
44. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/close_inactive_issues.yml:13 52%
45. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/laravel.yml:17 52%
46. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/laravel.yml:20 52%
47. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/terraform.yml:45 52%
48. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/terraform.yml:132 52%
49. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/terraform.yml:124 52%
50. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/terraform.yml:112 52%
51. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/terraform.yml:96 52%
52. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/terraform.yml:82 52%
53. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/terraform.yml:66 52%
54. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/terraform.yml:65 52%
55. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/terraform.yml:49 52%
56. medium Semgrep GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`. /.github/workflows/terraform.yml:46 52%
57. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /public/js/filament/widgets/components/chart.js:1 45%
58. medium Semgrep Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object. /public/js/filament/widgets/components/stats-overview/stat/chart.js:1 45%
59. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /app/Services/IRCScraper.php:73 36%
60. medium Semgrep Calling `unserialize()` with user input in the pattern can lead to arbitrary code execution. Consider using JSON or structured data approaches (e.g. Google Protocol Buffers). /app/Services/IRCScraper.php:156 36%
61. medium Bandit Probable insecure usage of temp file/directory. /deploy/baremetal/host.py:772 25%
62. medium Semgrep Using user input when deleting files with `unlink()` is potentially dangerous. A malicious actor could use this to modify or access files they have no right to. /scripts/benchmark-yenc.php:145 20%
63. low GuardDog Detects heavy obfuscation techniques commonly used by malware [threat-runtime-obfuscation] /public/js/filament/forms/components/markdown-editor.js:1 95%
64. low Bandit Consider possible security implications associated with the subprocess module. /deploy/baremetal/host.py:11 13%
65. low Bandit Consider possible security implications associated with the subprocess module. /deploy/baremetal/deploy.py:10 13%
66. low Bandit Starting a process with a partial executable path /deploy/baremetal/deploy.py:175 12%
67. low Bandit Starting a process with a partial executable path /deploy/baremetal/deploy.py:193 12%
68. low Bandit subprocess call - check for execution of untrusted input. /deploy/baremetal/deploy.py:175 3%
69. low Bandit subprocess call - check for execution of untrusted input. /deploy/baremetal/deploy.py:193 3%
70. low Bandit subprocess call - check for execution of untrusted input. /deploy/baremetal/deploy.py:248 3%
71. low Bandit subprocess call - check for execution of untrusted input. /deploy/baremetal/host.py:78 3%
72. low Bandit subprocess call - check for execution of untrusted input. /deploy/baremetal/host.py:373 3%
73. low Dependency checker Loose version constraint: 'vite^8.3' — attacker could push malicious update package.json 2%
74. low Dependency checker Loose version constraint: '@alpinejs/csp^3.17.3' — attacker could push malicious update package.json 2%
75. low Dependency checker Loose version constraint: '@fortawesome/fontawesome-free^7.3.1' — attacker could push malicious update package.json 2%
76. low Dependency checker Loose version constraint: '@melloware/coloris^0.25.0' — attacker could push malicious update package.json 2%
77. low Dependency checker Loose version constraint: '@simonwep/pickr^1.10.2' — attacker could push malicious update package.json 2%
78. low Dependency checker Loose version constraint: '@simplewebauthn/browser^14.0.0' — attacker could push malicious update package.json 2%
79. low Dependency checker Loose version constraint: 'date-fns^4.4.0' — attacker could push malicious update package.json 2%
80. low Dependency checker Loose version constraint: 'vue^3.5.43' — attacker could push malicious update package.json 2%
81. low Dependency checker Loose version constraint: 'tailwindcss^4.3.3' — attacker could push malicious update package.json 2%
82. low Dependency checker Loose version constraint: 'prettier-plugin-tailwindcss^0.7.4' — attacker could push malicious update package.json 2%
83. low Dependency checker Loose version constraint: 'npm-check-updates^23.1.0' — attacker could push malicious update package.json 2%
84. low Dependency checker Loose version constraint: 'lodash^4.18.1' — attacker could push malicious update package.json 2%
85. low Dependency checker Loose version constraint: '@tailwindcss/vite^4.3.3' — attacker could push malicious update package.json 2%
86. low Dependency checker Loose version constraint: '@tailwindcss/forms^0.5.11' — attacker could push malicious update package.json 2%
87. low Dependency checker Loose version constraint: 'vuedraggable^4.1.0' — attacker could push malicious update package.json 2%
88. low Dependency checker Loose version constraint: 'nested-sort^5.2.0' — attacker could push malicious update package.json 2%
89. low Dependency checker Loose version constraint: 'laravel-vite-plugin^3.2' — attacker could push malicious update package.json 2%
90. low Dependency checker Loose version constraint: 'laravel-echo^2.5.0' — attacker could push malicious update package.json 2%
91. low Dependency checker Loose version constraint: 'feather-icons^4.29.2' — attacker could push malicious update package.json 2%
92. low Dependency checker Loose version constraint: 'chart.js^4.5.1' — attacker could push malicious update package.json 2%
93. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /docker/8.5/Dockerfile 0%
94. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /install_composer.sh 0%
95. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /README.md 0%
96. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /install-tmux-fonts.sh 0%

No findings match these filters. Clear filters