Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/35968?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/35968?format=api", "purl": "pkg:pypi/mobsf@3.5.0", "type": "pypi", "namespace": "", "name": "mobsf", "version": "3.5.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": null, "latest_non_vulnerable_version": null, "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37033?format=api", "vulnerability_id": "VCID-7uxm-9rw7-gkca", "summary": "Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The mitigation for CVE-2024-29190 in valid_host() uses socket.gethostbyname(), which is vulnerable to SSRF abuse using DNS rebinding technique. This vulnerability is fixed in 4.3.2.", "references": [ { "reference_url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/4b8bab5a9858c69fe13be4631b82d82186e0d3bd", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/4b8bab5a9858c69fe13be4631b82d82186e0d3bd" }, { "reference_url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-fcfq-m8p6-gw56", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-fcfq-m8p6-gw56" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/44733?format=api", "purl": "pkg:pypi/mobsf@4.3.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/mobsf@4.3.2" } ], "aliases": [ "CVE-2025-31116", "PYSEC-2025-48" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7uxm-9rw7-gkca" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36552?format=api", "vulnerability_id": "VCID-dh45-7mwj-vkhp", "summary": "Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NOTE: the vendor's position is that authentication is intentionally not implemented because the product is not intended for an untrusted network environment. Use cases requiring authentication could, for example, use a reverse proxy server.", "references": [ { "reference_url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF" }, { "reference_url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/abb47659a19ac772765934f184c65fe16cb3bee7/docker-compose.yml#L30-L31", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/blob/abb47659a19ac772765934f184c65fe16cb3bee7/docker-compose.yml#L30-L31" }, { "reference_url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/1211", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/1211" }, { "reference_url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/748", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/issues/748" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/mobsf/PYSEC-2023-310.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mobsf/PYSEC-2023-310.yaml" }, { "reference_url": "https://github.com/woshinibaba222/hack16/blob/main/Unauthorized%20Access%20to%20MobSF.md", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://github.com/woshinibaba222/hack16/blob/main/Unauthorized%20Access%20to%20MobSF.md" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42261", "reference_id": "CVE-2023-42261", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42261" }, { "reference_url": "https://github.com/advisories/GHSA-cc8j-6phr-jv9x", "reference_id": "GHSA-cc8j-6phr-jv9x", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-cc8j-6phr-jv9x" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35972?format=api", "purl": "pkg:pypi/mobsf@3.9.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7uxm-9rw7-gkca" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/mobsf@3.9.7" } ], "aliases": [ "CVE-2023-42261", "GHSA-cc8j-6phr-jv9x", "PYSEC-2023-310" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-dh45-7mwj-vkhp" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36757?format=api", "vulnerability_id": "VCID-rgjm-y7h9-sbe8", "summary": "Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In version 3.9.5 Beta and prior, MobSF does not perform any input validation when extracting the hostnames in `android:host`, so requests can also be sent to local hostnames. This can lead to server-side request forgery. An attacker can cause the server to make a connection to internal-only services within the organization's infrastructure. Commit 5a8eeee73c5f504a6c3abdf2a139a13804efdb77 has a hotfix for this issue.", "references": [ { "reference_url": "https://drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://drive.google.com/file/d/1nbKMd2sKosbJef5Mh4DxjcHcQ8Hw0BNR/view?usp=share_link" }, { "reference_url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF" }, { "reference_url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/5a8eeee73c5f504a6c3abdf2a139a13804efdb77", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/5a8eeee73c5f504a6c3abdf2a139a13804efdb77" }, { "reference_url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-wfgj-wrgh-h3r3" }, { "reference_url": "https://github.com/MobSF/mobsfscan/commit/61fd40b477bbf9d204eb8c5a83a86c396d839798", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/MobSF/mobsfscan/commit/61fd40b477bbf9d204eb8c5a83a86c396d839798" }, { "reference_url": "https://github.com/MobSF/mobsfscan/commit/cd01b71770a6e56c1c71b0e5f454e7b6c9c64ef4", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/MobSF/mobsfscan/commit/cd01b71770a6e56c1c71b0e5f454e7b6c9c64ef4" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/mobsf/PYSEC-2024-257.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/mobsf/PYSEC-2024-257.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29190", "reference_id": "CVE-2024-29190", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29190" }, { "reference_url": "https://github.com/advisories/GHSA-wfgj-wrgh-h3r3", "reference_id": "GHSA-wfgj-wrgh-h3r3", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-wfgj-wrgh-h3r3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35972?format=api", "purl": "pkg:pypi/mobsf@3.9.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7uxm-9rw7-gkca" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/mobsf@3.9.7" } ], "aliases": [ "CVE-2024-29190", "GHSA-wfgj-wrgh-h3r3", "PYSEC-2024-257" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-rgjm-y7h9-sbe8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36946?format=api", "vulnerability_id": "VCID-yqnd-87jt-cyfk", "summary": "Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get() request in the _check_url method is specified as allow_redirects=True, which allows a server-side request forgery when a request to .well-known/assetlinks.json\" returns a 302 redirect. This is a bypass of the fix for CVE-2024-29190 and is fixed in 3.9.7.", "references": [ { "reference_url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/f22c584aa7d43527970c9da61eb678953cfc0a8e", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/f22c584aa7d43527970c9da61eb678953cfc0a8e" }, { "reference_url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-m435-9v6r-v5f6", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-m435-9v6r-v5f6" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/35972?format=api", "purl": "pkg:pypi/mobsf@3.9.7", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7uxm-9rw7-gkca" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/mobsf@3.9.7" } ], "aliases": [ "CVE-2024-54000", "GHSA-m435-9v6r-v5f6", "PYSEC-2024-256" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-yqnd-87jt-cyfk" } ], "fixing_vulnerabilities": [], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/mobsf@3.5.0" }