AlessandroZ/LaZagne

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/chromium_based.py line 19
Likely real: Yes, 98% confidence

The pyCrypto library and its module AES are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.

18 
19 from Crypto.Cipher import AES
20 from Crypto.Hash import SHA1

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/browsers/chromium_based.py line 12
Likely real: Yes, 98% confidence

The pyCrypto library and its module AES are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.

11 # For non-keyring storage
12 from Crypto.Cipher import AES
13

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/chromium_based.py line 21
Likely real: Yes, 98% confidence

The pyCrypto library and its module unpad are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.

20 from Crypto.Hash import SHA1
21 from Crypto.Util.Padding import unpad
22

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/databases/sqldeveloper.py line 16
Likely real: Yes, 98% confidence

The pyCrypto library and its module AES are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.

15 from xml.etree.cElementTree import ElementTree
16 from Crypto.Cipher import AES
17

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/databases/sqldeveloper.py line 14
Likely real: Yes, 98% confidence

The pyCrypto library and its module AES are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.

13 from xml.etree.cElementTree import ElementTree
14 from Crypto.Cipher import AES
15

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/mRemoteNG.py line 21
Likely real: Yes, 98% confidence

The pyCrypto library and its module AES are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.

20 from xml.dom.minidom import parse
21 from Crypto.Cipher import AES
22 from base64 import b64decode

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/mRemoteNG.py line 18
Likely real: Yes, 98% confidence

The pyCrypto library and its module unpad are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.

17 
18 from Crypto.Util.Padding import unpad
19 from hashlib import pbkdf2_hmac, md5

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/rclone.py line 19
Likely real: Yes, 98% confidence

The pyCrypto library and its module AES are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.

18 
19 from Crypto.Cipher import AES
20

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/rclone.py line 18
Likely real: Yes, 98% confidence

The pyCrypto library and its module AES are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.

17 
18 from Crypto.Cipher import AES
19

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/memory/libkeepass/common.py line 251
Likely real: Yes, 85% confidence

The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`.

tree = ElementTree.parse(f).getroot()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/rdpmanager.py line 102
Likely real: Yes, 85% confidence

The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`.

tree = ET.parse(xml_file)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/maven/mavenrepositories.py line 51
Likely real: Yes, 85% confidence

The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`.

settings = ElementTree.parse(maven_settings_file_location).getroot()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/apachedirectorystudio.py line 31
Likely real: Yes, 85% confidence

The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`.

connections = parse(connection_file_location).getroot()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/keepassconfig.py line 60
Likely real: Yes, 85% confidence

The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`.

connections = parse(connection_file_location).getroot()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/keepassconfig.py line 73
Likely real: Yes, 85% confidence

The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`.

connections = parse(connection_file_location).getroot()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/keepassconfig.py line 90
Likely real: Yes, 85% confidence

The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`.

connections = parse(connection_file_location).getroot()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/apachedirectorystudio.py line 30
Likely real: Yes, 85% confidence

The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`.

connections = parse(connection_file_location).getroot()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/maven/mavenrepositories.py line 29
Likely real: Yes, 85% confidence

The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`.

config = ElementTree.parse(master_password_file_location).getroot()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/keepassconfig.py line 59
Likely real: Yes, 85% confidence

The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`.

connections = parse(connection_file_location).getroot()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/keepassconfig.py line 83
Likely real: Yes, 85% confidence

The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`.

connections = parse(connection_file_location).getroot()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/keepassconfig.py line 100
Likely real: Yes, 85% confidence

The native Python `xml` library is vulnerable to XML External Entity (XXE) attacks. These attacks can leak confidential data and "XML bombs" can cause denial of service. Do not use this library to parse untrusted input. Instead the Python documentation recommends using `defusedxml`.

connections = parse(connection_file_location).getroot()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/system/hashdump.py line 54
Likely real: Yes, 54% confidence

Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/system/chainbreaker.py line 70
Likely real: Yes, 54% confidence

Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Mac/lazagne/config/run.py line 43
Likely real: Yes, 54% confidence

Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/browsers/chrome.py line 82
Likely real: Yes, 53% confidence

Found 'subprocess' function 'check_output' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

iv=iv, hex_key=hex_key, hex_enc_password=hex_enc_password), shell=True

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/config/execute_cmd.py line 37
Likely real: Yes, 53% confidence

Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.

stdout=subprocess.PIPE, universal_newlines=True, shell=True)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/iiscentralcertp.py line 39
Likely real: Uncertain, 35% confidence

Starting a process with a shell, possible injection detected, security issue.

38         try:
39             os.system(exe_file + " -px " + container + " " + tmp_file + " -pri > nul")
40         except OSError:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/config/run.py line 43
Likely real: Uncertain, 33% confidence

subprocess call with shell=True identified, security issue.

42 def run_cmd(cmd):
43     p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
44     result, _ = p.communicate()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/execute_cmd.py line 37
Likely real: Uncertain, 32% confidence

subprocess call with shell=True identified, security issue.

36         p = subprocess.Popen(full_args, startupinfo=info, stdin=subprocess.PIPE, stderr=subprocess.STDOUT,
37                              stdout=subprocess.PIPE, universal_newlines=True, shell=True)
38         p.stdin.write("$base64=\"\"" + "\n")
39

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/browsers/chrome.py line 82
Likely real: Uncertain, 32% confidence

subprocess call with shell=True identified, security issue.

81                 "openssl enc -base64 -d -aes-128-cbc -iv '{iv}' -K {hex_key} <<< {hex_enc_password} 2>/dev/null".format(
82                     iv=iv, hex_key=hex_key, hex_enc_password=hex_enc_password), shell=True
83             )
84         except Exception as e:
85             decrypted = 'ERROR retrieving password'
86         return decrypted

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/system/hashdump.py line 54
Likely real: Uncertain, 32% confidence

subprocess call with shell=True identified, security issue.

53     def run_cmd(self, cmd):
54         p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
55         result, _ = p.communicate()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/system/chainbreaker.py line 70
Likely real: Uncertain, 32% confidence

subprocess call with shell=True identified, security issue.

69 
70                     p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
71                     stdout, stderr = p.communicate()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/chromium_based.py line 177
Likely real: Yes, 100% confidence

Detected SHA1 hash algorithm which is considered insecure. Use a modern hash algorithm from the SHA-2, SHA-3, or BLAKE2 family instead.

hash_obj = SHA1.new()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/browsers/opera.py line 92
Likely real: Yes, 99% confidence

It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.

passwords.append(plaintext)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/mRemoteNG.py line 139
Likely real: Yes, 99% confidence

It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as scrypt. You can use `hashlib.scrypt`.

self.password = md5(self.password).digest()

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /Linux/lazagne/config/homes.py line 12
Likely real: Yes, 98% confidence

Detects extensive system/network enumeration activities [threat-runtime-enumeration]

# Get all user data stored on the Unix Password Database
    for pw in pwd.getpwall():
        if pw.pw_dir not in visited:
            yield pw.pw_dir

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /Linux/lazagne/config/homes.py line 70
Likely real: Yes, 98% confidence

Detects extensive system/network enumeration activities [threat-runtime-enumeration]

try:
        with open('/proc/%d/environ' % (int(pid))) as env:
            records = [
                record.split('=', 1) for record in env.read().split('\x00')

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /Linux/lazagne/config/homes.py line 88
Likely real: Yes, 98% confidence

Detects extensive system/network enumeration activities [threat-runtime-enumeration]

try:
        for process in psutil.process_iter():
            try:
                if hasattr(process, 'environ'):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/mRemoteNG.py line 124
Likely real: Yes, 98% confidence

Using xml.dom.minidom.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.minidom.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

123 
124         event = parse(filename).firstChild
125

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/iiscentralcertp.py line 77
Likely real: Yes, 98% confidence

Using xml.dom.minidom.parseString to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.dom.minidom.parseString with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

76     def read_RSAKeyValue(self, rsa_key_xml):
77         xmlStructure = minidom.parseString(rsa_key_xml)
78

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/chromium_based.py line 20
Likely real: Yes, 98% confidence

The pyCrypto library and its module SHA1 are no longer actively maintained and have been deprecated. Consider using pyca/cryptography library.

19 from Crypto.Cipher import AES
20 from Crypto.Hash import SHA1
21 from Crypto.Util.Padding import unpad

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /Linux/lazagne/softwares/sysadmin/shadow.py line 66
Likely real: Yes, 96% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]

def run(self):
        shadow_file = '/etc/shadow'
        if os.access(shadow_file, os.R_OK):
            pwd_found = []

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /Linux/lazagne/softwares/memory/mimipy.py line 79
Likely real: Yes, 96% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]

hashes = []
        with open('/etc/shadow', 'rb') as f:
            for line in f:
                tab = line.decode().split(":")

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /Linux/lazagne/softwares/browsers/firefox_browsers.py line 8
Likely real: Yes, 96% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]

firefox_browsers = [
    (u'firefox', u'.mozilla/firefox'),
    (u'icecat', u'.mozilla/icecat'),
    (u'waterfox', u'.waterfox'),

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /Linux/lazagne/softwares/git/gitforlinux.py line 52
Likely real: Yes, 96% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]

pwd_found = []
        for location in homes.get(file=[u'.git-credentials', u'.config/git/credentials']):
            pwd_found += self.extract_credentials(location)
            known_locations.add(location)

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /Windows/lazagne/softwares/git/gitforwindows.py line 49
Likely real: Yes, 96% confidence

Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read]

locations = [
            os.path.join(constant.profile["USERPROFILE"], u'.git-credentials'),
            os.path.join(constant.profile["USERPROFILE"], u'.config\\git\\credentials'),
        ]

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/apachedirectorystudio.py line 31
Likely real: Yes, 56% confidence

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

30                 try:
31                     connections = parse(connection_file_location).getroot()
32                     connection_nodes = connections.findall(".//connection")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/memory/libkeepass/common.py line 251
Likely real: Yes, 56% confidence

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

250         # ignore meta, currently there is only version "1.00"
251         tree = ElementTree.parse(f).getroot()
252         # read text from key, data and convert from base64

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/keepassconfig.py line 60
Likely real: Yes, 56% confidence

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

59                 try:
60                     connections = parse(connection_file_location).getroot()
61                     connection_nodes = connections.findall(".//Association")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/keepassconfig.py line 73
Likely real: Yes, 56% confidence

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

72                 try:
73                     connections = parse(connection_file_location).getroot()
74                     connection_nodes = connections.findall(".//LastUsedFile")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/keepassconfig.py line 90
Likely real: Yes, 56% confidence

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

89                 try:
90                     connections = parse(connection_file_location).getroot()
91                     connection_nodes = connections.findall(".//ConnectionInfo")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/maven/mavenrepositories.py line 29
Likely real: Yes, 56% confidence

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

28             try:
29                 config = ElementTree.parse(master_password_file_location).getroot()
30                 master_password_node = config.find(".//master")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/maven/mavenrepositories.py line 51
Likely real: Yes, 56% confidence

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

50             try:
51                 settings = ElementTree.parse(maven_settings_file_location).getroot()
52                 server_nodes = settings.findall(".//%sserver" % self.settings_namespace)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/apachedirectorystudio.py line 30
Likely real: Yes, 56% confidence

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

29             try:
30                 connections = parse(connection_file_location).getroot()
31                 connection_nodes = connections.findall(".//connection")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/keepassconfig.py line 59
Likely real: Yes, 56% confidence

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

58                 try:
59                     connections = parse(connection_file_location).getroot()
60                     connection_nodes = connections.findall(".//Association")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/keepassconfig.py line 83
Likely real: Yes, 56% confidence

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

82                 try:
83                     connections = parse(connection_file_location).getroot()
84                     connection_nodes = connections.findall(".//LastUsedFile")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/keepassconfig.py line 100
Likely real: Yes, 56% confidence

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

99                 try:
100                     connections = parse(connection_file_location).getroot()
101                     connection_nodes = connections.findall(".//ConnectionInfo")

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/rdpmanager.py line 102
Likely real: Yes, 56% confidence

Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

101             import xml.etree.ElementTree as ET
102             tree = ET.parse(xml_file)
103             root = tree.getroot()

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: requirements.txt line 8
Likely real: Yes, 54% confidence

Unpinned dependency: 'pycryptodome' has no version lock — supply chain risk

pycryptodome

Engine: Dependency checker · CVEs, typosquats and risky installs
Counts towards: Supply chain
File: requirements.txt line 3
Likely real: Yes, 54% confidence

Unpinned dependency: 'pyasn1' has no version lock — supply chain risk

pyasn1

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/chats/skype.py line 64
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

salt = hashlib.sha1('\x00\x00\x00\x00' + key).digest() + hashlib.sha1('\x00\x00\x00\x01' + key).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/browsers/mozilla.py line 313
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

hp = sha1(global_salt + master_password).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/browsers/mozilla.py line 315
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

chp = sha1(hp + entry_salt).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/browsers/mozilla.py line 336
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

k = sha1(global_salt + master_password).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/browsers/mozilla.py line 315
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

hp = sha1(global_salt + master_password).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/browsers/mozilla.py line 317
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

chp = sha1(hp + entry_salt).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/browsers/mozilla.py line 338
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

k = sha1(global_salt + master_password).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/config/DPAPI/crypto.py line 146
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

masterkey = hashlib.sha1(masterkey).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/config/DPAPI/crypto.py line 161
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

strongPassword = hashlib.sha1(strongPassword.rstrip("\x00").encode("UTF-16LE")).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/config/DPAPI/crypto.py line 184
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

masterkey = hashlib.sha1(masterkey).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/config/DPAPI/masterkey.py line 103
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

self.key_hash = hashlib.sha1(self.key).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/mozilla.py line 303
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

hp = sha1(global_salt + master_password).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/mozilla.py line 305
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

chp = sha1(hp + entry_salt).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/mozilla.py line 326
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

k = sha1(global_salt + master_password).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/chats/skype.py line 64
Likely real: Yes, 53% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

salt = hashlib.sha1('\x00\x00\x00\x00' + key).digest() + hashlib.sha1('\x00\x00\x00\x01' + key).digest()

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/config/DPAPI/credhist.py line 145
Likely real: Yes, 52% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

self.decrypt_with_hash(hashlib.sha1(password.encode("UTF-16LE")).digest())

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/ie.py line 36
Likely real: Yes, 52% confidence

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.

hash_tables.append([h, hashlib.sha1(h).hexdigest().lower()])

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/WinCompile.yml line 14
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v2

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/WinCompile.yml line 17
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/setup-python@v4

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/WinCompile.yml line 32
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/create-release@v1

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/WinCompile.yml line 43
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

uses: actions/upload-release-asset@v1

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint_python.yml line 7
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/checkout@v3

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /.github/workflows/lint_python.yml line 8
Likely real: Yes, 52% confidence

GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. `uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608`.

- uses: actions/setup-python@v4

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/memory/libkeepass/kdb4.py line 324
Likely real: Yes, 52% confidence

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

323         # print etree.tostring(self.obj_root)
324         root = ElementTree.fromstring(ElementTree.tostring(self.obj_root))
325         for entry in root.findall('.//Root//Entry'):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/memory/libkeepass/kdb4.py line 275
Likely real: Yes, 52% confidence

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

274         # self.obj_root = self.tree.getroot()
275         self.obj_root = ElementTree.fromstring(self.in_buffer.read())
276

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/system/hashdump.py line 126
Likely real: Yes, 52% confidence

Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called

125             if len(raw) > 100:
126                 root = ElementTree.fromstring(raw)
127                 children = root[0][1].getchildren()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/mRemoteNG.py line 139
Likely real: Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

138         if ciphername == "CBC":
139             self.password = md5(self.password).digest()
140             self._decrypt = self.cbc_decrypt

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/windows/creddump7/win32/hashdump.py line 161
Likely real: Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

160     if revision == 2:
161         md5 = hashlib.md5(F[0x70:0x80] + aqwerty + bootkey + anum)
162         rc4_key = md5.digest()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/windows/creddump7/win32/hashdump.py line 196
Likely real: Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

195     d2 = des(des_k2, ECB)
196     md5 = hashlib.md5()
197     md5.update(hbootkey[:0x10] + pack("<L", rid) + lmntstr)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/DPAPI/credhist.py line 145
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

144 
145         self.decrypt_with_hash(hashlib.sha1(password.encode("UTF-16LE")).digest())

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/browsers/mozilla.py line 313
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

312             # See http://www.drh-consultancy.demon.co.uk/key3.html
313             hp = sha1(global_salt + master_password).digest()
314             pes = entry_salt + convert_to_byte('\x00') * (20 - len(entry_salt))

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/browsers/mozilla.py line 315
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

314             pes = entry_salt + convert_to_byte('\x00') * (20 - len(entry_salt))
315             chp = sha1(hp + entry_salt).digest()
316             k1 = hmac.new(chp, pes + entry_salt, sha1).digest()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/browsers/mozilla.py line 336
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

335 
336             k = sha1(global_salt + master_password).digest()
337             key = pbkdf2_hmac('sha256', k, entry_salt, iteration_count, dklen=key_length)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/browsers/opera.py line 81
Likely real: Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

80 
81             md5hash1 = hashlib.md5(tmp).digest()
82             md5hash2 = hashlib.md5(md5hash1 + tmp).digest()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/browsers/opera.py line 82
Likely real: Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

81             md5hash1 = hashlib.md5(tmp).digest()
82             md5hash2 = hashlib.md5(md5hash1 + tmp).digest()
83

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/databases/dbvis.py line 35
Likely real: Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

34         for i in range(count):
35             m = hashlib.md5(key)
36             key = m.digest()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/databases/sqldeveloper.py line 39
Likely real: Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

38         for i in range(count):
39             m = hashlib.md5(key)
40             key = m.digest()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/browsers/mozilla.py line 315
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

314             # See http://www.drh-consultancy.demon.co.uk/key3.html
315             hp = sha1(global_salt + master_password).digest()
316             pes = entry_salt + convert_to_byte('\x00') * (20 - len(entry_salt))

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/browsers/mozilla.py line 317
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

316             pes = entry_salt + convert_to_byte('\x00') * (20 - len(entry_salt))
317             chp = sha1(hp + entry_salt).digest()
318             k1 = hmac.new(chp, pes + entry_salt, sha1).digest()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/browsers/mozilla.py line 338
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

337 
338             k = sha1(global_salt + master_password).digest()
339             key = pbkdf2_hmac('sha256', k, entry_salt, iteration_count, dklen=key_length)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/DPAPI/crypto.py line 146
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

145     if len(masterkey) > 20:
146         masterkey = hashlib.sha1(masterkey).digest()
147

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/DPAPI/crypto.py line 161
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

160     if strongPassword is not None:
161         strongPassword = hashlib.sha1(strongPassword.rstrip("\x00").encode("UTF-16LE")).digest()
162         digest.update(strongPassword)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/chats/skype.py line 64
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

63         # retrieve the salt
64         salt = hashlib.sha1('\x00\x00\x00\x00' + key).digest() + hashlib.sha1('\x00\x00\x00\x01' + key).digest()
65

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/databases/sqldeveloper.py line 38
Likely real: Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

37         for i in range(count):
38             m = hashlib.md5(key)
39             key = m.digest()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/databases/dbvis.py line 33
Likely real: Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

32         for i in range(count):
33             m = hashlib.md5(key)
34             key = m.digest()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/chats/skype.py line 85
Likely real: Uncertain, 49% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

84         for word in wordlist:
85             hash_ = hashlib.md5('%s\nskyper\n%s' % (login, word)).hexdigest()
86             if hash_ == md5:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/chats/skype.py line 64
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

63         # retrieve the salt
64         salt = hashlib.sha1('\x00\x00\x00\x00' + key).digest() + hashlib.sha1('\x00\x00\x00\x01' + key).digest()
65

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/DPAPI/crypto.py line 184
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

183     if len(masterkey) > 20:
184         masterkey = hashlib.sha1(masterkey).digest()
185

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/mozilla.py line 326
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

325 
326             k = sha1(global_salt + master_password).digest()
327             key = pbkdf2_hmac('sha256', k, entry_salt, iteration_count, dklen=key_length)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/mozilla.py line 305
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

304             pes = entry_salt + convert_to_byte('\x00') * (20 - len(entry_salt))
305             chp = sha1(hp + entry_salt).digest()
306             k1 = hmac.new(chp, pes + entry_salt, sha1).digest()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/mozilla.py line 303
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

302             # See http://www.drh-consultancy.demon.co.uk/key3.html
303             hp = sha1(global_salt + master_password).digest()
304             pes = entry_salt + convert_to_byte('\x00') * (20 - len(entry_salt))

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/ie.py line 36
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

35                 h = (urls[u] + '\0').encode('UTF-16LE')
36                 hash_tables.append([h, hashlib.sha1(h).hexdigest().lower()])
37             except Exception:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/DPAPI/masterkey.py line 103
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

102         if self.decrypted:
103             self.key_hash = hashlib.sha1(self.key).digest()
104

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/DPAPI/masterkey.py line 72
Likely real: Uncertain, 49% confidence

Use of weak SHA1 hash for security. Consider usedforsecurity=False

71         # sha1 
72         self.decrypt_with_hash(sid=sid, pwdhash=hashlib.new("sha1", pwd).digest())
73         if self.decrypted:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Linux/lazagne/config/soft_import_module.py line 13
Likely real: Uncertain, 49% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

module = import_module(package_name)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Mac/lazagne/config/soft_import_module.py line 13
Likely real: Uncertain, 49% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

module = import_module(package_name)

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/config/soft_import_module.py line 13
Likely real: Uncertain, 49% confidence

Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.

module = import_module(package_name)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/windows/creddump7/win32/lsasecrets.py line 55
Likely real: Uncertain, 48% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

54     if not vista:
55         md5 = hashlib.md5()
56         md5.update(bootkey)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/DPAPI/crypto.py line 219
Likely real: Uncertain, 48% confidence

Use of weak MD5 hash for security. Consider usedforsecurity=False

218     """
219     dg = hashlib.md5()
220     dg.update(syskey)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/config/lib/memorpy/WinProcess.py line 151
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

150         elif len(processes)>1:
151             raise ValueError("There is multiple processes with name %s. Please select a process from its pid instead"%processName)
152         if debug:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/lib/memorpy/WinProcess.py line 151
Likely real: Uncertain, 46% confidence

Possible SQL injection vector through string-based query construction.

150         elif len(processes)>1:
151             raise ValueError("There is multiple processes with name %s. Please select a process from its pid instead"%processName)
152         if debug:

Engine: Semgrep · Pattern-based code analysis
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/windows/creddump7/newobj.py line 59
Likely real: Uncertain, 45% confidence

Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.

return globals()[name](name, address, space)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/browsers/chromium_based.py line 141
Likely real: Probably noise, 25% confidence

Probable insecure usage of temp file/directory.

140         for path in self.get_paths():
141             tmp = u'/tmp/chrome.db'
142             shutil.copyfile(path, tmp)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/apachedirectorystudio.py line 2
Likely real: Yes, 97% confidence

Using parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace parse with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

1 # -*- coding: utf-8 -*- 
2 from xml.etree.ElementTree import parse
3

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/apachedirectorystudio.py line 2
Likely real: Yes, 97% confidence

Using parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace parse with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

1 # -*- coding: utf-8 -*- 
2 from xml.etree.ElementTree import parse
3

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/iiscentralcertp.py line 9
Likely real: Yes, 97% confidence

Using minidom to parse untrusted XML data is known to be vulnerable to XML attacks. Replace minidom with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

8 from random import *
9 from xml.dom import minidom
10

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/mRemoteNG.py line 20
Likely real: Yes, 97% confidence

Using parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace parse with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

19 from hashlib import pbkdf2_hmac, md5
20 from xml.dom.minidom import parse
21 from Crypto.Cipher import AES

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/keepassconfig.py line 13
Likely real: Yes, 97% confidence

Using parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace parse with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

12 
13 from xml.etree.ElementTree import parse
14

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/keepassconfig.py line 7
Likely real: Yes, 97% confidence

Using parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace parse with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

6 
7 from xml.etree.ElementTree import parse
8

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/ftpnavigator.py line 40
Likely real: Yes, 95% confidence

Possible hardcoded password: 'anonymous'

39                     if values['Login'] == 'anonymous' and 'Password' not in values:
40                         values['Password'] = 'anonymous'
41

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/databases/dbvis.py line 22
Likely real: Yes, 95% confidence

Possible hardcoded password: 'qinda'

21         self._salt = self.get_salt()
22         self._passphrase = 'qinda'
23         self._iteration = 10

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/change_privileges.py line 112
Likely real: Yes, 95% confidence

Possible hardcoded password: 'S-1-5-18'

111 def get_sid_token(token_sid):
112     if token_sid == "S-1-5-18":
113         sids = list_sids()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/mRemoteNG.py line 36
Likely real: Yes, 95% confidence

Possible hardcoded password: 'mR3m'

35         self.files = self.get_configuration_files()
36         self.password = "mR3m"
37         self.success_coutner = 0

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/databases/dbvis.py line 20
Likely real: Yes, 95% confidence

Possible hardcoded password: 'qinda'

19         self._salt = self.get_salt()
20         self._passphrase = 'qinda'
21         self._iteration = 10

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/multimedia/eyecon.py line 61
Likely real: Yes, 95% confidence

Possible hardcoded password: 'connection'

60                 'reg_path': 'SOFTWARE\\eyevis\\eyetool\\Default',
61                 'user_key': 'registered', 'password_key': 'connection'
62             },
63         )
64 
65         for path in password_path:
66             values = {}

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/multimedia/eyecon.py line 56
Likely real: Yes, 95% confidence

Possible hardcoded password: 'connection'

55                 'reg_path': 'SOFTWARE\\WOW6432Node\\eyevis\\eyetool\\Default',
56                 'user_key': 'registered', 'password_key': 'connection'
57             },
58             {
59                 'app': 'EyeCON', 'reg_root': HKEY_LOCAL_MACHINE,
60                 'reg_path': 'SOFTWARE\\eyevis\\eyetool\\Default',
61                 'user_key': 'registered', 'password_key': 'connection'

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/memory/onepassword.py line 39
Likely real: Yes, 94% confidence

Possible hardcoded password: '{"name":"master-password","value":"(.*)","type":"P","designation":"password"}'

38                 # Search for Master Password
39                 master_password = '{"name":"master-password","value":"(.*)","type":"P","designation":"password"}'
40                 junk = '","type":"P","designation":"password"}'

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/databases/dbvis.py line 56
Likely real: Yes, 93% confidence

Possible hardcoded password: 'Password'

55 
56                 elements = {'Alias': 'Name', 'Userid': 'Login', 'Password': 'Password',
57                             'UrlVariables//Driver': 'Driver'}
58

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/databases/dbvis.py line 50
Likely real: Yes, 93% confidence

Possible hardcoded password: 'Password'

49             pwd_found = []
50             elements = {'Alias': 'Name', 'Userid': 'Login', 'Password': 'Password', 'UrlVariables//Driver': 'Driver'}
51

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/databases/squirrel.py line 18
Likely real: Yes, 93% confidence

Possible hardcoded password: 'Password'

17             pwd_found = []
18             elements = {'name': 'Name', 'url': 'URL', 'userName': 'Login', 'password': 'Password'}
19             for elem in tree.iter('Bean'):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/winscp.py line 64
Likely real: Yes, 93% confidence

Possible hardcoded password: 'Password'

63             values = {}
64             elements = {'HostName': 'URL', 'UserName': 'Login', 'PortNumber': 'Port', 'Password': 'Password'}
65             for nn in range(num):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/databases/squirrel.py line 23
Likely real: Yes, 93% confidence

Possible hardcoded password: 'Password'

22             tree = ElementTree(file=path)
23             elements = {'name': 'Name', 'url': 'URL', 'userName': 'Login', 'password': 'Password'}
24             for elem in tree.iter('Bean'):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/ftpnavigator.py line 22
Likely real: Yes, 93% confidence

Possible hardcoded password: 'Password'

21         path = os.path.join(constant.profile['HOMEDRIVE'], u'\\FTP Navigator', u'Ftplist.txt')
22         elements = {'Name': 'Name', 'Server': 'Host', 'Port': 'Port', 'User': 'Login', 'Password': 'Password'}
23         if os.path.exists(path):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/databases/sqldeveloper.py line 126
Likely real: Yes, 93% confidence

Possible hardcoded password: 'Password'

125                         renamed_value = {'sid': 'SID', 'port': 'Port', 'hostname': 'Host', 'user': 'Login',
126                                          'password': 'Password', 'ConnName': 'Name', 'customUrl': 'URL',
127                                          'SavePassword': 'SavePassword', 'driver': 'Driver'}
128                         tree = ElementTree(file=xml_file)
129

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/databases/sqldeveloper.py line 122
Likely real: Yes, 93% confidence

Possible hardcoded password: 'Password'

121                     renamed_value = {'sid': 'SID', 'port': 'Port', 'hostname': 'Host', 'user': 'Login',
122                                      'password': 'Password', 'ConnName': 'Name', 'customUrl': 'URL',
123                                      'SavePassword': 'SavePassword', 'driver': 'Driver'}
124                     tree = ElementTree(file=xml_file)
125

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /Linux/lazagne/config/write_output.py line 68
Likely real: Yes, 93% confidence

Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]

date=str(time),
            username=getpass.getuser(),
            hostname=socket.gethostname()
        )

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /Linux/lazagne/config/write_output.py line 69
Likely real: Yes, 93% confidence

Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info]

username=getpass.getuser(),
            hostname=socket.gethostname()
        )
        open(os.path.join(constant.folder_name, '{filename}.txt'.format(filename=constant.file_name_results)),

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /Linux/lazagne/config/lib/memorpy/WinProcess.py line 238
Likely real: Yes, 92% confidence

Detects memory scraping and credential dumping from process memory [threat-process-memory]

else:
            RpM = ReadProcessMemory

        address = int(address)

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /Linux/lazagne/config/lib/memorpy/WinProcess.py line 258
Likely real: Yes, 92% confidence

Detects memory scraping and credential dumping from process memory [threat-process-memory]

else:
                if GetLastError()==299: #only part of ReadProcessMemory has been done, let's return it
                    data += buffer.raw[:bytesread.value]
                    return data

Engine: GuardDog · Supply-chain attack heuristics
Counts towards: Malicious pattern
File: /Linux/lazagne/config/lib/memorpy/WinProcess.py line 252
Likely real: Yes, 92% confidence

Detects memory scraping and credential dumping from process memory [threat-process-memory]

if not len(data):
                    raise ProcessException('Error %s in ReadProcessMemory(%08x, %d, read=%d)' % (GetLastError(),
                     address,
                     length,

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/memory/onepassword.py line 31
Likely real: Yes, 91% confidence

Possible hardcoded password: '{"name":"account-key","value":"(.{2}-.{6}-.{6}-.{5}-.{5}-.{5}-.{5})","type":"T"}'

30                 # Search for Secret Key
31                 secret_key = '{"name":"account-key","value":"(.{2}-.{6}-.{6}-.{5}-.{5}-.{5}-.{5})","type":"T"}'
32                 for _, v in mw.mem_search(secret_key, ftype='groups'):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/chats/pidgin.py line 8
Likely real: Yes, 85% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

7 from lazagne.config.module_info import ModuleInfo
8 from xml.etree.cElementTree import ElementTree
9 from lazagne.config import homes

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/chats/psi.py line 3
Likely real: Yes, 85% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

2 import os
3 from xml.etree.cElementTree import ElementTree
4 from itertools import cycle

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/wifi/wifi.py line 6
Likely real: Yes, 85% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

5 
6 from xml.etree.cElementTree import ElementTree
7 from subprocess import Popen, PIPE

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/databases/sqldeveloper.py line 13
Likely real: Yes, 85% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

12 import re
13 from xml.etree.cElementTree import ElementTree
14 from Crypto.Cipher import AES

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/chats/psi.py line 3
Likely real: Yes, 85% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

2 import os
3 from xml.etree.cElementTree import ElementTree
4 from glob import glob

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/databases/sqldeveloper.py line 15
Likely real: Yes, 85% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

14 
15 from xml.etree.cElementTree import ElementTree
16 from Crypto.Cipher import AES

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/games/roguestale.py line 4
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

3 import re
4 from xml.etree.cElementTree import ElementTree
5

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/filezillaserver.py line 2
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

1 # -*- coding: utf-8 -*-
2 from xml.etree.cElementTree import ElementTree
3

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/databases/dbvis.py line 11
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

10 
11 from xml.etree.cElementTree import ElementTree
12

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/chats/pidgin.py line 3
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

2 import os
3 from xml.etree.cElementTree import ElementTree
4

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/chats/skype.py line 6
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

5 import struct
6 from xml.etree.cElementTree import ElementTree
7

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/databases/dbvis.py line 8
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

7 import re
8 from xml.etree.cElementTree import ElementTree
9

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/databases/squirrel.py line 3
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

2 import os
3 from xml.etree.cElementTree import ElementTree
4

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/filezilla.py line 7
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

6 
7 from xml.etree.cElementTree import ElementTree
8

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/unattended.py line 5
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

4 
5 from xml.etree.cElementTree import ElementTree
6

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/rdpmanager.py line 4
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

3 
4 from xml.etree.cElementTree import ElementTree
5

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/puttycm.py line 7
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

6 
7 from xml.etree.cElementTree import ElementTree
8

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/filezilla.py line 4
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

3 
4 from xml.etree.cElementTree import ElementTree
5

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/cyberduck.py line 4
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

3 
4 from xml.etree.cElementTree import ElementTree
5

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/memory/libkeepass/common.py line 6
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

5 import struct
6 from xml.etree import ElementTree
7

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/databases/squirrel.py line 6
Likely real: Yes, 84% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

5 
6 from xml.etree.cElementTree import ElementTree
7

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/system/hashdump.py line 19
Likely real: Yes, 83% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

18 
19 from xml.etree import ElementTree
20

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/maven/mavenrepositories.py line 3
Likely real: Yes, 83% confidence

Using ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

2 import os
3 from xml.etree import ElementTree
4

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/mails/clawsmail.py line 134
Likely real: Yes, 65% confidence

Possible hardcoded password: '0'

133 
134                 if self.use_master_passphrase != '0':
135                     self.info('Master password used ! ')

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/rdpmanager.py line 101
Likely real: Yes, 52% confidence

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

100     def parse_xml(self, xml_file):
101             import xml.etree.ElementTree as ET
102             tree = ET.parse(xml_file)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/memory/libkeepass/kdb4.py line 5
Likely real: Yes, 51% confidence

Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.

4 import io
5 import xml.etree.ElementTree as ElementTree
6 import zlib

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/iisapppool.py line 68
Likely real: Uncertain, 45% confidence

Possible hardcoded password: ''

67 
68             if password != '' : 
69                 values['AppPool.Name'] = app

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/gftp.py line 23
Likely real: Uncertain, 45% confidence

Possible hardcoded password: ''

22         """
23         decoded_pass = ""
24         #removing the first char ($)

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/gftp.py line 81
Likely real: Uncertain, 45% confidence

Possible hardcoded password: ''

80                     ftp_proxy_account = self.get_parameter("ftp_proxy_account", preferences)
81                     if ftp_proxy_username != "" and ftp_proxy_password != "":
82                         pwd_found.append({

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/gftp.py line 99
Likely real: Uncertain, 45% confidence

Possible hardcoded password: ''

98                     http_proxy_account = self.get_parameter("http_proxy_account", preferences)
99                     if http_proxy_username != "" and http_proxy_password != "":
100                         pwd_found.append({

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/system/chainbreaker_module/chainbreaker.py line 741
Likely real: Uncertain, 45% confidence

Possible hardcoded password: ''

740             passwd = keychain.KeyblobDecryption(ciphertext, iv, dbkey)
741             if passwd != '':
742                 key_list[keyblob] = passwd

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/DPAPI/masterkey.py line 244
Likely real: Uncertain, 45% confidence

Possible hardcoded password: 'None'

243             lambda: {
244                 'password': None,  # contains cleartext password
245                 'mkf': [],  # contains the masterkey file object
246             }
247         )
248         self.mkfiles = []

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/ftpnavigator.py line 15
Likely real: Uncertain, 45% confidence

Possible hardcoded password: ''

14     def decode(self, encode_password):
15         password = ''
16         for p in encode_password:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/vnc.py line 131
Likely real: Uncertain, 45% confidence

Possible hardcoded password: ''

130             string_to_match = vnc[2] + '='
131             enc_pwd = ''
132             try:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/iisapppool.py line 57
Likely real: Uncertain, 44% confidence

Possible hardcoded password: ''

56             username = ''
57             password = ''
58

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/system/chainbreaker_module/chainbreaker.py line 758
Likely real: Uncertain, 44% confidence

Possible hardcoded password: ''

757             except KeyError:
758                 passwd = ''
759

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/system/chainbreaker_module/chainbreaker.py line 788
Likely real: Uncertain, 44% confidence

Possible hardcoded password: ''

787             except KeyError:
788                 passwd = ''
789

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/mRemoteNG.py line 155
Likely real: Uncertain, 44% confidence

Possible hardcoded password: ''

154             else:
155                 password = ""
156

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/laZagne.py line 212
Likely real: Uncertain, 44% confidence

Possible hardcoded password: 'None'

211             'quiet': False, 
212             'password': None, 
213             'write_normal': None, 
214             'write_json': None, 
215             'write_all': None, 
216             'output': '.', 
217             'auditType': 'all'
218         }
219     else:
220         args = dict(parser.parse_args()._get_kwargs())
221         # arguments = parser.parse_args()
222

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/laZagne.py line 192
Likely real: Uncertain, 44% confidence

Possible hardcoded password: 'None'

191             'quiet': False, 
192             'password': None, 
193             'write_normal': None, 
194             'write_json': None, 
195             'write_all': None, 
196             'output': '.', 
197             'auditType': 'all'
198         }
199     else:
200         args = dict(parser.parse_args()._get_kwargs())
201         # arguments = parser.parse_args()
202

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/browsers/mozilla.py line 193
Likely real: Uncertain, 44% confidence

Possible hardcoded password: ''

192                 # Check masterpassword
193                 (global_salt, master_password, entry_salt) = self.manage_masterpassword(master_password=u'',
194                                                                                         key_data=key_data,
195                                                                                         new_version=False)
196                 if global_salt:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/browsers/mozilla.py line 195
Likely real: Uncertain, 44% confidence

Possible hardcoded password: ''

194                 # Check masterpassword
195                 (global_salt, master_password, entry_salt) = self.manage_masterpassword(master_password=u'',
196                                                                                         key_data=key_data,
197                                                                                         new_version=False)
198                 if global_salt:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/mozilla.py line 183
Likely real: Uncertain, 44% confidence

Possible hardcoded password: ''

182                 # Check masterpassword
183                 (global_salt, master_password, entry_salt) = self.manage_masterpassword(master_password=u'',
184                                                                                         key_data=key_data,
185                                                                                         new_version=False)
186                 if global_salt:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/windows/creddump7/win32/lsasecrets.py line 85
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

84             decrypted_data += crypter.decrypt(enc_block)
85         except Exception:
86             continue
87

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/openvpn.py line 111
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

110                 parameter, value = line.split(maxsplit=1)
111             except Exception:
112                 continue
113

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/chromium_based.py line 76
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

75                         db_files = os.listdir(os.path.join(path, profile))
76                     except Exception:
77                         continue
78                     for db in db_files:

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/lib/memorpy/LinProcess.py line 177
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

176                 int(pid)
177             except:
178                 continue
179             pname=""

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/env_variable.py line 79
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

78                         parsed = urlparse.urlparse(proxy)
79                     except Exception:
80                         continue
81

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/env_variable.py line 67
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

66                     environ = process.environ()
67                 except Exception:
68                     continue
69

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/cli.py line 85
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

84                 parser.read(histfile)
85             except Exception:
86                 continue
87

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/cli.py line 46
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

45                         home = pwd.getpwuid(process.uids().effective).pw_dir
46                     except Exception:
47                         continue
48

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/aws.py line 34
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

33                 yield section, key, secret
34             except Exception:
35                 continue
36

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/git/gitforlinux.py line 60
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

59                 environ = process.environ()
60             except Exception:
61                 continue
62

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/chats/psi.py line 20
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

19                 subdirs = os.listdir(profile_dir)
20             except Exception:
21                 continue
22

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/browsers/chromium_based.py line 36
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

35                 subdirs = os.listdir(profile_dir)
36             except Exception:
37                 continue
38

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/config/lib/memorpy/LinProcess.py line 177
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

176                 int(pid)
177             except:
178                 continue
179             pname=""

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/config/homes.py line 114
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

113                             os.seteuid(uid)
114                         except Exception:
115                             continue
116

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/config/homes.py line 96
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

95                     environ = get_linux_env(process.pid)
96             except Exception:
97                 continue
98

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/softwares/sysadmin/cli.py line 32
Likely real: Probably noise, 28% confidence

Try, Except, Continue detected.

31                     user = process.username()
32                 except Exception:
33                     continue
34

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/lib/memorpy/OSXProcess.py line 87
Likely real: Probably noise, 25% confidence

subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell

86         processes=[]
87         res=subprocess.check_output("ps A", shell=True)
88         for line in res.split('\n'):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/config/lib/memorpy/OSXProcess.py line 87
Likely real: Probably noise, 25% confidence

subprocess call with shell=True seems safe, but may be changed in the future, consider rewriting without shell

86         processes=[]
87         res=subprocess.check_output("ps A", shell=True)
88         for line in res.split('\n'):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/wifi/wifi.py line 7
Likely real: Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.

6 from xml.etree.cElementTree import ElementTree
7 from subprocess import Popen, PIPE
8

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/config/run.py line 3
Likely real: Probably noise, 14% confidence

Consider possible security implications associated with the subprocess module.

2 # !/usr/bin/python
3 import subprocess
4 import traceback

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/ie.py line 2
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

1 import hashlib
2 import subprocess
3 import traceback

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/config/lib/memorpy/OSXProcess.py line 29
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

28 import logging
29 import subprocess
30

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/browsers/chrome.py line 7
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

6 
7 import subprocess
8 import itertools

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/system/chainbreaker.py line 7
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

6 
7 import subprocess
8 import binascii

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Mac/lazagne/softwares/system/hashdump.py line 11
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

10 
11 import subprocess
12 import traceback

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/execute_cmd.py line 5
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

4 import os
5 import subprocess
6 import re

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/lib/memorpy/OSXProcess.py line 29
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

28 import logging
29 import subprocess
30

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/iisapppool.py line 3
Likely real: Probably noise, 13% confidence

Consider possible security implications associated with the subprocess module.

2 import os
3 import subprocess
4 import re

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Linux/lazagne/config/lib/memorpy/OSXProcess.py line 87
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

86         processes=[]
87         res=subprocess.check_output("ps A", shell=True)
88         for line in res.split('\n'):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/lib/memorpy/OSXProcess.py line 87
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

86         processes=[]
87         res=subprocess.check_output("ps A", shell=True)
88         for line in res.split('\n'):

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/wifi/wifi.py line 44
Likely real: Probably noise, 12% confidence

Starting a process with a partial executable path

43         self.debug(u'Trying using netsh method')
44         process = Popen(['netsh.exe', 'wlan', 'show', 'profile', '{SSID}'.format(SSID=ssid), 'key=clear'],
45                         stdin=PIPE,
46                         stdout=PIPE,
47                         stderr=PIPE)
48         stdout, stderr = process.communicate()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/config/execute_cmd.py line 79
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

78                 info.wShowWindow = SW_HIDE
79                 p = subprocess.Popen(command, startupinfo=info, stdin=subprocess.PIPE, stderr=subprocess.STDOUT,
80                                      stdout=subprocess.PIPE, universal_newlines=True)
81                 results, _ = p.communicate()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/browsers/ie.py line 91
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

90         info.wShowWindow = SW_HIDE
91         p = subprocess.Popen(command, startupinfo=info, stderr=subprocess.STDOUT, stdout=subprocess.PIPE,
92                              stdin=subprocess.PIPE, universal_newlines=True)
93         results, _ = p.communicate()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/sysadmin/iisapppool.py line 27
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

26         try:
27             proc = subprocess.Popen(exe_file + " " + arguments, shell=False, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
28

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/wifi/wifi.py line 44
Likely real: Probably noise, 3% confidence

subprocess call - check for execution of untrusted input.

43         self.debug(u'Trying using netsh method')
44         process = Popen(['netsh.exe', 'wlan', 'show', 'profile', '{SSID}'.format(SSID=ssid), 'key=clear'],
45                         stdin=PIPE,
46                         stdout=PIPE,
47                         stderr=PIPE)
48         stdout, stderr = process.communicate()

Engine: Bandit · Python security linter
Counts towards: Vulnerability
File: /Windows/lazagne/softwares/memory/libkeepass/pureSalsa20.py line 216
Likely real: Probably noise, 0% confidence