securitylab

This is the CodeQL database for the Security lab CTF - "Go and don't return"

This is the CodeQL database for the Security lab Eko2020 CodeQL CTF: Use After Free

This is the CodeQL database for the GitHub Security Lab CTF 4: CodeQL and Chill - The Java Edition

This is the white paper behind 'CVE-2020-5398 Reflected File Download in Spring MVC/WebFlux'

This CodeQL database captures a vulnerable version of the Etherpad codebase due to the implementation of an ineffective patch, specifically, a new sanitizer. You can learn more from this blog post.

This CodeQL database captures a patched version of the previously vulnerable database. You can learn more from this blog post.

This CodeQL database captures a vulnerable snapshot of the Etherpad 1.6.2 codebase where there exists CVE-2018-6835. You can learn more on this blog post.

This CodeQL database captures a vulnerable version of the Apache Struts codebase where there exists CVE-2017-11776. You can learn more on this blog post.

This CodeQL database captures a vulnerable snapshot of the Apache Struts codebase, where there exists CVE-2017-9805. You can learn more in this blog post.

This CodeQL database captures a vulnerable version of the Powershell codebase. The "Zip Slip" vulnerability was announced on June 5th 2018, by Snyk.

This CodeQL database captures a snapshot of the vulnerable XNU codebase in macOS 10.13.3, as analysed in this blog post.

This CodeQL database captures a snapshot of the vulnerable XNU codebase in macOS 10.13.6 for CVE-2018-4407, as analysed in this blog post.

This CodeQL database captures a snapshot of the vulnerable XNU codebase from 13 June 2017 in macOS 10.13, as analysed in this blog post.

This CodeQL database captures a vulnerable snapshot of the rsyslog database from 27 April 2018, as part of this blog post.

This CodeQL database captures a vulnerable snapshot of the Qualcomm MSM codebase from 7 May 2017 for the purpose of this blog post.

This CodeQL database captures a vulnerable snapshot of libssh2 where CVE-2019-13115 is presented. You can learn more in this blog post.

This is a CodeQL database that captures the fixed version of libjpeg-turbo, following this vulnerable version published in this release and the patched version for variant analysis published in this release. The first three results from this snapshot are actually true positives, which we reported.

Context:
The database was used as an example of variant analysis for a recent bugfix in libjpeg-turbo, an open-source image processing library.

This is a CodeQL database that captures the fixed version of libjpeg-turbo, following this vulnerable version published in this release.

Context:
The database was used as an example of variant analysis for a recent bugfix in libjpeg-turbo, an open-source image processing library.

This is a CodeQL database that captures a vulnerable snapshot of libjpeg-turbo.

Context:
The database was used as an example of variant analysis for a recent bugfix in libjpeg-turbo, an open-source image processing library.

This CodeQL database captures a vulnerable snapshot of the Facebook Fizz integer overflow vulnerability (CVE-2019-3560). Fizz contained a remotely triggerable infinite loop. For more details about the bug, see this blog post. A proof-of-concept exploit is available here.