Hanno Böck
drupal update
c46fece @ 2024-11-21 09:24:09
| .github | CI: python 3.13 is no longer -dev | 2024-10-28 08:48:40 |
|---|---|---|
| freewvsdb | drupal update | 2024-11-21 09:24:09 |
| tests | skip pylint too-many-positional-arguments test | 2024-09-29 22:02:30 |
| .gitignore | avoid committing pycache and python objects | 2019-12-12 18:28:04 |
| CONTRIBUTIONS.md | Fix spelling errors and style in markdown files | 2024-03-10 13:20:05 |
| COPYING | remove copyright year | 2023-02-28 10:46:56 |
| ISSUES | fix typos | 2024-04-23 20:50:32 |
| README.md | Fix spelling errors and style in markdown files | 2024-03-10 13:20:05 |
| SECURITY.md | Fix spelling errors and style in markdown files | 2024-03-10 13:20:05 |
| freewvs | sort imports | 2023-12-12 08:59:43 |
| setup.py | Add correct 0BSD classifier | 2024-03-10 19:47:27 |
| update-freewvsdb | add -f/--force parameter to update-freewvsdb | 2024-03-10 12:02:36 |
freewvs
A local web vulnerability scanner.
freewvs is a tool to search webroots for known vulnerable versions of web applications.
install
You can install freewvs via pip:
pip install freewvs
Alternatively, you can run freewvs directly from the git source.
If you install via pip, you need to update the freewvs database first:
update-freewvsdb
usage
Just run freewvs with a path, e.g.:
freewvs /var/www
The output will be something like this:
Joomla 3.9.11 (3.9.14) CVE-2019-19846 /var/www/example.org
nextcloud 14.0.1 (14.0.5) CVE-2019-5449 /var/www/cloud.example.org
MediaWiki 1.31.1 (1.31.6) CVE-2019-19709 /var/www/wiki.example.org
faq
What does freewvs do?
It scans your webroot for known vulnerable versions of popular web applications.
What does the output tell me?
The output looks like this:
Joomla-3 3.9.11 (3.9.13) CVE-2019-18674 /home/joe/websites/joessite/
This says that in /home/joe/websites/joessite/, there's a Joomla installation of version 3.9.11. This version is vulnerable to CVE-2019-18674, and you should update it to version 3.9.13.
CVE-2019-XXXX seems to be very minor, at least it doesn't affect me. Am I safe?
No, as freewvs only checks for the latest vulnerabilities. There may be other vulnerabilities in your version not listed by freewvs. The only way to be sure is to check the upstream changelog.
There is no version inside the brackets. What does that mean?
It means your web application has not released a security update. Often, this means the software is no longer developed.
contributions
See CONTRIBUTIONS.md.
misc
freewvs was developed by schokokeks.org hosting.
It's licensed under the 0BSD license.