High
Showing all detectors for the JSX language with high severity.
Disabled or incorrectly used protection mechanism can lead to security vulnerabilities.
Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.
Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.
Logging unencrypted AWS credentials can expose them to an attacker.
Unverified origins of messages and identities in cross-origin communications can lead to security vulnerabilities.
The use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database.
Non-literal input to a regular expression might lead to a denial of service attack.
Unchecked failures can lead to data loss.
Insufficient key sizes can lead to brute force attacks.
Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.
Exposure of sensitive information can lead to an unauthorized actor having access to the information.
Writing unsanitized user data to a file is unsafe.
String passed to setInterval
or setTimeout
can cause the JavaScript engine to evaluate, which can lead to a security risk.
Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.
APIs that are not recommended were found.
Passing an unsanitized user argument to a function call makes your code insecure.
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
Weak obfuscation of web requests makes your application vulnerable.
Objects that parse or handle XML can lead to XML external entity (XXE) attacks when they are misconfigured.
Weak file permissions can lead to privilege escalation.
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
Client-side decryption followed by encryption is inefficient and can lead to sensitive data leaks.
Custom polling can be inefficient and prone to error. Consider using AWS waiters instead.
Constructing HTTP response headers from user-controlled data is unsafe.
User input can be vulnerable to injection attacks.
Disabling the HTML autoescape mechanism exposes your web applications to attacks.
User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.
Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.
Deserialization of untrusted objects can lead to security vulnerabilities such as, inadvertently running remote code.
Insecure string comparison can lead to a timing-attack.
LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.
Insecure cookies can lead to unencrypted transmission of sensitive data.
Expanding unverified archive files without controlling the size of the expanded data can lead to zip bomb attacks.
Unverified hostnames lead to security vulnerabilities.
The application incorrectly restricts frame objects or UI layers that belong to another application or domain.
Creating file paths from untrusted input might give a malicious actor access to sensitive files.
The logging of sensitive information can expose the information to potential attackers.
Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
DNS prefetching can cause latency and privacy issues.
The software allows user input to control or influence paths or file names that are used in file system operations.
Lack of validation of a security certificate can lead to host impersonation and sensitive data leaks.