sml2h3/baota

API keys, passwords or tokens committed into the repo.

• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  data/tempToken.json:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  data/userInfo.json:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  data/userInfo.json:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  data/user.json:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  data/user.json:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  data/user.json:1
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  api-demo-python.py:15
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  demo.py:15
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  plugin/coll/inc/coll_upload.py:22
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3717
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3720
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3725
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3728
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3733
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3736
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3741
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3744
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3750
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3753
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3757
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3760
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3764
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3768
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3773
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
• Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
  BTPanel/static/build/xterm.js:3774
  A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Packages you depend on that have known security holes (CVEs).

• Serious CVE-2020-11538 python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-11538). Fix: Update that package to its patched version.
• Serious CVE-2020-5310 python-pillow: Integer overflow leading to buffer overflow in ImagingLibTiffDecode
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-5310). Fix: Update that package to its patched version.
• Serious CVE-2020-5311 python-pillow: out-of-bounds write in expandrow in libImaging/SgiRleDecode.c
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-5311). Fix: Update that package to its patched version.
• Serious CVE-2020-5312 python-pillow: improperly restricted operations on memory buffer in libImaging/PcxDecode.c
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-5312). Fix: Update that package to its patched version.
• Serious CVE-2021-25289 python-pillow: insufficent fix for CVE-2020-35654 due to incorrect error checking in TiffDecode.c
  requirements.txt
  A package you depend on has a known security hole (CVE-2021-25289). Fix: Update that package to its patched version.
• Serious CVE-2021-34552 python-pillow: Buffer overflow in image convert function
  requirements.txt
  A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
• Serious CVE-2022-22817 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions
  requirements.txt
  A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
• Serious CVE-2023-50447 pillow: Arbitrary Code Execution via the environment parameter
  requirements.txt
  A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
• Worth fixing CVE-2019-16865 python-pillow: reading specially crafted image files leads to allocation of large amounts of memory and denial of service
  requirements.txt
  A package you depend on has a known security hole (CVE-2019-16865). Fix: Update that package to its patched version.
• Worth fixing CVE-2019-19911 python-pillow: uncontrolled resource consumption in FpxImagePlugin.py
  requirements.txt
  A package you depend on has a known security hole (CVE-2019-19911). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-10177 python-pillow: multiple out-of-bounds reads in libImaging/FliDecode.c
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-10177). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-10378 python-pillow: an out-of-bounds read in libImaging/PcxDecode.c can occur when reading PCX files
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-10378). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-10379 python-pillow: two buffer overflows in libImaging/TiffDecode.c due to small buffers allocated in ImagingLibTiffDecode()
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-10379). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-10994 python-pillow: multiple out-of-bounds reads via a crafted JP2 file
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-10994). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-35653 python-pillow: Buffer over-read in PCX image reader
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-35653). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-35654 python-pillow: decoding crafted YCbCr files could result in heap-based buffer overflow
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-35654). Fix: Update that package to its patched version.
• Worth fixing CVE-2020-5313 python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images
  requirements.txt
  A package you depend on has a known security hole (CVE-2020-5313). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-23437 python-pillow: possible ReDoS via the getrgb function
  requirements.txt
  A package you depend on has a known security hole (CVE-2021-23437). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-25287 python-pillow: Out-of-bounds read in J2K image reader
  requirements.txt
  A package you depend on has a known security hole (CVE-2021-25287). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-25288 python-pillow: Out-of-bounds read in J2K image reader
  requirements.txt
  A package you depend on has a known security hole (CVE-2021-25288). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-25290 python-pillow: Negative-offset memcpy in TIFF image reader
  requirements.txt
  A package you depend on has a known security hole (CVE-2021-25290). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-25291 python-pillow: out-of-bounds read in TiffReadRGBATile in TiffDecode.c
  requirements.txt
  A package you depend on has a known security hole (CVE-2021-25291). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-25293 python-pillow: Out-of-bounds read in SGI RLE image reader
  requirements.txt
  A package you depend on has a known security hole (CVE-2021-25293). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-27921 python-pillow: Excessive memory allocation in BLP image reader
  requirements.txt
  A package you depend on has a known security hole (CVE-2021-27921). Fix: Update that package to its patched version.
• Worth fixing CVE-2021-27922 python-pillow: Excessive memory allocation in ICNS image reader
  requirements.txt
  A package you depend on has a known security hole (CVE-2021-27922). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Your dependencies cross-checked against the OSV vulnerability database.

• Serious PYSEC-2020-80 In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2020-11538). Fix: Update that package to its patched version.
• Serious PYSEC-2020-81 libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2020-5310). Fix: Update that package to its patched version.
• Serious PYSEC-2020-82 libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2020-5311). Fix: Update that package to its patched version.
• Serious PYSEC-2020-83 libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2020-5312). Fix: Update that package to its patched version.
• Serious PYSEC-2021-137 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2021-25287). Fix: Update that package to its patched version.
• Serious PYSEC-2021-138 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2021-25288). Fix: Update that package to its patched version.
• Serious PYSEC-2021-331 Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
• Serious PYSEC-2021-35 An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOT
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2021-25289). Fix: Update that package to its patched version.
• Serious PYSEC-2022-10 PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
• Serious PYSEC-2022-168 Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2022-24303). Fix: Update that package to its patched version.
• Serious PYSEC-2026-457 Arbitrary Code Execution in Pillow
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
• Serious PYSEC-2020-80 In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2020-11538). Fix: Update that package to its patched version.
• Serious PYSEC-2020-81 libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2020-5310). Fix: Update that package to its patched version.
• Serious PYSEC-2020-82 libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2020-5311). Fix: Update that package to its patched version.
• Serious PYSEC-2020-83 libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2020-5312). Fix: Update that package to its patched version.
• Serious PYSEC-2021-137 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2021-25287). Fix: Update that package to its patched version.
• Serious PYSEC-2021-138 An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2021-25288). Fix: Update that package to its patched version.
• Serious PYSEC-2021-331 Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2021-34552). Fix: Update that package to its patched version.
• Serious PYSEC-2021-35 An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOT
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2021-25289). Fix: Update that package to its patched version.
• Serious PYSEC-2022-10 PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2022-22817). Fix: Update that package to its patched version.
• Serious PYSEC-2022-168 Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2022-24303). Fix: Update that package to its patched version.
• Serious PYSEC-2026-457 Arbitrary Code Execution in Pillow
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2023-50447). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2023-62 Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2023-30861). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2026-2151 Flask is a web server gateway interface (WSGI) web application framework. In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Us
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2026-27205). Fix: Update that package to its patched version.
• Worth fixing PYSEC-2019-110 An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of tim
  /workdirs/scan-648b4d7e-bbc6-475e-bc37-9d3a850eceb3/requirements.txt
  A package you depend on has a known security hole (CVE-2019-16865). Fix: Update that package to its patched version.

via OSV-Scanner v1.9.2 · Apache-2.0

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Packages that look intentionally malicious: typosquats, sneaky install scripts.

• Serious guarddog-pypi-code-execution code-execution match in psutil 7.2.2
  psutil
  A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.
• Serious guarddog-pypi-code-execution code-execution match in Werkzeug 3.1.8
  Werkzeug
  A dependency shows signs of being intentionally malicious (typosquat, hidden install script, etc.). Fix: Don’t install it until you’ve verified the package. Consider removing it.

via Guarddog v2.10.0 · Apache-2.0