This Tinyscript-based tool allows to decompres a STIX XML file and to output it as a PDF using pdfkit.
This can be installed using:
$ pip install bs4 pdfkit tinyscript
$ tsm install stix-reports-to-pdf
Alex dhondta
This Tinyscript-based tool aims to generate preview images of an input PDF (e.g. a book).
This can be installed using:
$ pip install pdf2image tinyscript
$ tsm install pdf-preview-generator
This Tinyscript-based allows to load an email and to parse the receivers, indicating where the found IP addesses originate from.
This can be installed using:
$ pip install ipaddress mail_parser maxminddb-geolite2 tinyscript
$ tsm install get-email-origin
This Tinyscript-based allows to generate a string with a given alphabet that has a given hash matching the format used for type juggling with PHP, that is when a loose comparison of the type ("0e12345" == ...) is used.
This can be installed using:
$ pip install tinyscript
$ tsm install loose-comparison-input-generator
CVE-2019-12760 - ACE in Python's parso Module
** DISPUTED ** A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution. NOTE: This is disputed because "the cache directory is not under control of the attacker in any common configuration."
While loading a configuration file, logging/config.py's handler parsing function calls eval() twice on unsanitized variables coming from the configuration file, therefore allowing an attacker to execute arbitrary code.
CVE-2019-12761 - Code Injection in Python's xdg Module
A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.
NewerOlder