gitsafehub
github.com/bterlson/tss.msr ↗

bterlson/tss.msr

scanned 2026-08-10 · git 4979534
3 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets6Vulnerable dependencies13Known OSS vulnerabilities34Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ 6 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    TSS.JS/test/Test_Azure_IoT_Provisioning.ts:244
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    TSS.JS/test/Test_Azure_IoT_Provisioning.ts:245
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    TSS.JS/test/Test_Azure_IoT_Provisioning.ts:246
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    TSS.NET/TSS.Net/Tpm2.cs:167
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    TSS.NET/TSS.Net/Tpm2.cs:1772
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    TSS.NET/Src/X_TpmDefs.cs:8949
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 13 found · 1 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2018-1000613 bouncycastle: lack of class checking in deserialization of XMSS/XMSS^MT private keys with BDS state information
    TSS.Java/pom.xml
    A package you depend on has a known security hole (CVE-2018-1000613). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-0820 dotnet: timeouts for regular expressions are not enforced
    NuGet/1.1.0/lib/netstandard2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0820). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-0820 dotnet: timeouts for regular expressions are not enforced
    NuGet/1.1.0/lib/uap10.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0820). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-0820 dotnet: timeouts for regular expressions are not enforced
    NuGet/1.1.0/runtimes/linux-x64/lib/netcoreapp2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0820). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-0820 dotnet: timeouts for regular expressions are not enforced
    NuGet/2.0.0/lib/uap10.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0820). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-0820 dotnet: timeouts for regular expressions are not enforced
    NuGet/2.0.0/runtimes/linux-x64/lib/netstandard2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0820). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-0820 dotnet: timeouts for regular expressions are not enforced
    NuGet/2.0.1/lib/uap10.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0820). Fix: Update that package to its patched version.
  • Worth fixing CVE-2018-1000180 bouncycastle: flaw in the low-level interface to RSA key pair generator
    TSS.Java/pom.xml
    A package you depend on has a known security hole (CVE-2018-1000180). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-15522 bouncycastle: Timing issue within the EC math library
    TSS.Java/pom.xml
    A package you depend on has a known security hole (CVE-2020-15522). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-26939 In Legion of the Bouncy Castle BC before 1.61 and BC-FJA before 1.0.1. ...
    TSS.Java/pom.xml
    A package you depend on has a known security hole (CVE-2020-26939). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-33202 bc-java: Out of memory while parsing ASN.1 crafted data in org.bouncycastle.openssl.PEMParser class
    TSS.Java/pom.xml
    A package you depend on has a known security hole (CVE-2023-33202). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-29857 org.bouncycastle: Importing an EC certificate with crafted F2m parameters may lead to Denial of Service
    TSS.Java/pom.xml
    A package you depend on has a known security hole (CVE-2024-29857). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-30171 bc-java: BouncyCastle vulnerable to a timing variant of Bleichenbacher (Marvin Attack)
    TSS.Java/pom.xml
    A package you depend on has a known security hole (CVE-2024-30171). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 34 found · 1 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-4446-656p-f54g Deserialization of Untrusted Data in Bouncy castle
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/TSS.Java/pom.xml
    A package you depend on has a known security hole (CVE-2018-1000613). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7jgj-8wvc-jh57 .NET Core Information Disclosure
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.0.6/lib/netstandard1.3/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2018-8292). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7mfr-774f-w5r9 Improper Certificate Validation
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.0.6/lib/netstandard1.3/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2017-11770). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7jgj-8wvc-jh57 .NET Core Information Disclosure
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.0.6/lib/uap10.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2018-8292). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7mfr-774f-w5r9 Improper Certificate Validation
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.0.6/lib/uap10.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2017-11770). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7jgj-8wvc-jh57 .NET Core Information Disclosure
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.1.0/lib/netstandard1.3/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2018-8292). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7mfr-774f-w5r9 Improper Certificate Validation
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.1.0/lib/netstandard1.3/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2017-11770). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7jgj-8wvc-jh57 .NET Core Information Disclosure
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.1.0/lib/netstandard2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2018-8292). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7mfr-774f-w5r9 Improper Certificate Validation
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.1.0/lib/netstandard2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2017-11770). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cmhx-cq75-c4mj Regular Expression Denial of Service in System.Text.RegularExpressions
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.1.0/lib/netstandard2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0820). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7jgj-8wvc-jh57 .NET Core Information Disclosure
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.1.0/lib/uap10.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2018-8292). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7mfr-774f-w5r9 Improper Certificate Validation
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.1.0/lib/uap10.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2017-11770). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cmhx-cq75-c4mj Regular Expression Denial of Service in System.Text.RegularExpressions
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.1.0/lib/uap10.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0820). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5f2m-466j-3848 Denial of service in ASP.NET Core
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.1.0/runtimes/linux-x64/lib/netcoreapp2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0981). Fix: Update that package to its patched version.
  • Worth fixing GHSA-x5qj-9vmx-7g6g Improper Input Validation in .Net Framework API's
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.1.0/runtimes/linux-x64/lib/netcoreapp2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0657). Fix: Update that package to its patched version.
  • Worth fixing GHSA-xhfc-gr8f-ffwc Denial of service in ASP.NET Core
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.1.0/runtimes/linux-x64/lib/netcoreapp2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0980). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cmhx-cq75-c4mj Regular Expression Denial of Service in System.Text.RegularExpressions
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/1.1.0/runtimes/linux-x64/lib/netcoreapp2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0820). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7jgj-8wvc-jh57 .NET Core Information Disclosure
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/2.0.0/lib/uap10.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2018-8292). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7mfr-774f-w5r9 Improper Certificate Validation
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/2.0.0/lib/uap10.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2017-11770). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cmhx-cq75-c4mj Regular Expression Denial of Service in System.Text.RegularExpressions
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/2.0.0/lib/uap10.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0820). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5f2m-466j-3848 Denial of service in ASP.NET Core
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/2.0.0/runtimes/linux-x64/lib/netstandard2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0981). Fix: Update that package to its patched version.
  • Worth fixing GHSA-x5qj-9vmx-7g6g Improper Input Validation in .Net Framework API's
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/2.0.0/runtimes/linux-x64/lib/netstandard2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0657). Fix: Update that package to its patched version.
  • Worth fixing GHSA-xhfc-gr8f-ffwc Denial of service in ASP.NET Core
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/2.0.0/runtimes/linux-x64/lib/netstandard2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0980). Fix: Update that package to its patched version.
  • Worth fixing GHSA-cmhx-cq75-c4mj Regular Expression Denial of Service in System.Text.RegularExpressions
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/2.0.0/runtimes/linux-x64/lib/netstandard2.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2019-0820). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7jgj-8wvc-jh57 .NET Core Information Disclosure
    /workdirs/scan-fea9d161-d5d6-4cf3-8083-6298b489e272/NuGet/2.0.1/lib/uap10.0/TSS.Net.deps.json
    A package you depend on has a known security hole (CVE-2018-8292). Fix: Update that package to its patched version.
… 9 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.