Jeremy Long Claim this profile

The dependency-check repository has moved:

Java library for working with available vulnerability data sources (GitHub Security Advisories, NVD, EPSS, CISA Known Exploited Vulnerabilities, etc.)

A cli that can be used to query various online vulnerability sources such as the NVD or GHSA. The CLI and docker images can be used to mirror the NVD.

Demonstrates how a malicious dependency could negatively impact the build output.

Copy of information on the Northpaw from https://sensebridge.net/projects/northpaw/instructions/

Java program to retrieve server certificate that can be added to local keystore

Cloud native secrets management for developers - never leave your command line for secrets.

No description.

A simple Java command-line utility to mirror the CVE XML and JSON data from NIST.

A journey through the insecure defaults in GitHub Actions - wait who committed code to my repo?

Mono/.NET Project to get information about an assembly. Primarily for OWASP Dependency Check

Indexer for Maven Repositories

Burp/ZAP/Maven extension that integrate Retire.js repository to find vulnerable Javascript libraries.

scanner detecting the use of JavaScript libraries with known vulnerabilities

A leiningen plugin for detecting vulnerable project dependencies

Evaluate source control (GitHub) security posture

Open Source Software Insights - Analysis, Comparison, Trends, Rankings of Open Source Software. Follow us on Twitter: https://twitter.com/ossinsight

Phosphor: Dynamic Taint Tracking for the JVM

Java library for parsing report files from static code analysis.

A utility for validating and parsing Common Platform Enumeration (CPE) v2.2 and v2.3 as originally defined by MITRE and maintained by NIST

No description.

No description.

Jenkins plugin for OWASP Dependency-Check. Inspects project components for known vulnerabilities (e.g. CVEs).

Checkmarx Scan Github Action

Inspect your builds to look for changes in filesystem, network traffic and running processes.

Official Black Hat Arsenal Security Tools Repository

Creates CycloneDX Software Bill of Materials (SBOM) from Gradle projects

Detect and validate 500+ types of hardcoded secrets with advanced checks. Use it as a pre-commit hook, GitHub Action, or CLI for proactive secret detection and security.

CycloneDX SBOM Model and Utils for Creating and Validating BOMs

Open-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs. Discord https://discord.gg/vv4MH284Hc

Maven Resource Filter to remove whitespace from Velocity Templates.

Sonatype OSS Index - Public

A Java library for calculating CVSSv2 and CVSSv3 scores and vectors

Gradle Plugin for Extracting Dependency Information to send to GitHub

No description.

software asset scanning orchestration system

🍻 Default formulae for the missing package manager for macOS

Generate CycloneDX Software Bill of Materials (SBOM) from webpack bundles at compile time.

Core functionality of OWASP CycloneDX for JavaScript (Node.js or WebBrowser) written in TypeScript.

Creates CycloneDX Software Bill-of-Materials (SBOM) from Objective-C and Swift projects that use CocoaPods.

A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby

No description.

Cheap 16 bit DAC AD5662 for the Arduino

DEPRECATED: consider using org.codehaus.mojo:extra-enforcer-rules.

throw away project to test dependency-check false positives

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages

Proof-of-concept for decoupling responsibilities from Dependency-Track's monolithic API server into separate, scalable services, based on Apache Kafka.

An Open Letter to the OWASP Board

Semantic versioning for Java apps.

Log adapter for use with JCS3 to bind to slf4j.

Gradle plugin that adds a 'taskTree' task that prints task dependency tree

No description.

An action to delete workflow runs in a repository.

No description.

Maven plugin for creating GitHub releases

Apache Commons JCS

SBT Plugin for OWASP DependencyCheck. Monitor your dependencies and report if there are any publicly known vulnerabilities (e.g. CVEs).

No description.

Checkmarx Scan and Result Orchestration

An extremely easy way to perform background processing in Java. Backed by persistent storage. Open and free for commercial use.

A tool for analyzing the attack surface of an application

Library for commenting things with violations from static code analysis.

Simple library to speed up or slow down speech

Python library for audio and music analysis

AudioFreeze for new PCB layout

Presentation and code from OWASP AppSec DC 2019 - "Testing With Your Left Foot Forward"

Teensy based audio looper

Teensy Audio Library

No description.

Java/JVM implementation of the package url spec

Versions Maven Plugin

Content-Security-Policy report aggregator/analyzer

ThreadFix is a software vulnerability aggregation and management system that helps organizations aggregate vulnerability data, generate virtual patches, and interact with software defect tracking systems.