Insecure parsing risks forgery, unauthorized access, and data leaks. Ensure signature validation, use strong algorithms, avoid hardcoded keys, and audit regularly.

Weak Password Encoder

Your code uses a weak password encoder. Use secure encoders like BCrypt, Pbkdf2, Argon2, or SCrypt.

Cookie Without Http Only Flag

Sensitive cookie without 'HttpOnly' flag

Generation of Predictable IV

Using a predictable IV weakens your encryption. Use java.security.SecureRandom to create secure IVs.

Improper Certificate Validation

Improper Certificate Validation refers to the failure to adequately verify the authenticity and integrity of certificates, exposing systems to potential security vulnerabilities.

Integer Overflow

An integer overflow might might cause security issues when it is used for resource management or execution control.

Insecure Tls Version

Use of deprecated or vulnerable TLS/SSL versions like SSLv3, TLSv1.0, and TLSv1.1. Prefer modern and secure protocols such as TLSv1.2 or TLSv1.3.

Improper Authentication

Improper authentication from insufficient identity verification.

Cryptographic key generator

Insufficient key sizes can lead to brute force attacks.

Weak pseudorandom number generation

Insufficiently random generators (or hardcoded seeds) can make pseudorandom sequences predictable.

Misconfigured Concurrency

Misconfigured CompletableFuture.get or Future.get.

LDAP injection

LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.

Path traversal

Creating file paths from untrusted input might give a malicious actor access to sensitive files.

Cross-site scripting

Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.

Reusing Nonce and key in encryption

GCM Cipher with reused initialization vector is detected.

XML External Entity

Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.

Code Injection

Code injection occurs when an application executes untrusted code from an attacker.

Improper export of android app components

Access to broadcasting intents should be limited because they are security-sensitive.

Resource leak

Allocated resources are not released properly.

Untrusted Deserialization

Unsafe YAML and Jackson deserialization may result in code execution. Employ SafeConstructor for YAML and deactivate default typing in Jackson.

Server-side request forgery

Server-side request forgery (SSRF) is a vulnerability that allows an attacker to manipulate a web application to make unintended requests from the server.

Cross-site request forgery

Insecure configuration can lead to a cross-site request forgery (CSRF) vulnerability.

NoSQL injection

Use of untrusted inputs in NoSQL database query can enable attackers to read, modify, or delete sensitive data in the database

Log injection

Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.

Hardcoded credentials

Hardcoded credentials can be intercepted by malicious actors.

Missing Release Of Memory

Consider using class-level instantiation to prevent premature memory deallocation.

Insecure Socket

Use of insecure sockets.

Enabling and overriding debug feature

The Debug feature should not be enabled or overridden.

Null Pointer Dereference

Dereferencing a null pointer can lead to unexpected null pointer exceptions.

Insecure hashing

Obsolete, broken, or weak hashing algorithms can lead to security vulnerabilities.

Missing encryption of sensitive data

The product does not encrypt sensitive or critical information before storage or transmission.

Improper verification of Intent

Intent receiver method is registered without specifying any broadcast permission.

Insecure connection using unencrypted protocol

Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.

OS Command Injection

Possible unintended system commands could be executed through user input.

Sensitive information leak

Sensitive information should not be exposed through log files or stack traces.

Insecure Bean Validation

Passing user-controlled input directly to bean validation APIs can lead to code injection attacks.

Cleartext Storage of Sensitive Information

Storing confidential data in plaintext within a resource that could be accessed by someone with access to another control sphere.

Unsafe File Extension

Unsafe file extensions like .exe or .vbs can execute code without consent.

SQL injection

Use of untrusted inputs in SQL database query can enable attackers to read, modify, or delete sensitive data in the database

Incorrect Type Conversion

Failure to properly transform an object, resource, or structure from one type to a safer one.

Missing authentication

Lack of authentication for critical functions leads to unauthorized users performing critical operations or accessing confidential information.