Q
Detector Library
Python detectors (131/131)
Improper privilege managementSpawning a process without main moduleInteger overflowCatch and swallow exceptionInsufficient Logging CDKUnauthenticated LDAP requestsPath traversalLoose file permissionsExposure of Sensitive Information CDKFile injectionIncorrect use of Process.terminate APIXML External EntityPytorch use nondeterministic algoritmSet SNS Return Subscription ARNTensorflow enable ops determinismOutdated subprocess module APIImproper input validationImproper authenticationMissing paginationSemaphore overflow preventionInsecure cookieUsage of an API that is not recommended - Low SeveritySocket connection timeoutAWS client not reused in a Lambda functionPytorch assign in place modLeaky subprocess timeoutPytorch disable gradient calculationRisky use of dict get methodXPath injectionMissing authorizationMultidimensional list initialization using replication is error proneSQL injectionPytorch miss call to evalAWS AppConfigImproper certificate validationURL redirection to untrusted siteMutually exclusive callNotebook best practice violationStack trace exposureUse of a deprecated methodAWS api logging disabled cdkOS command injectionAWS credentials loggedMissing Authorization CDKZip bomb attackSensitive data stored unencrypted due to partial encryptionSynchronous publication of AWS Lambda metricsUnrestricted upload of dangerous file typePytorch redundant softmaxInsecure connection using unencrypted protocolUnauthenticated Amazon SNS unsubscribe requests might succeedInsecure Socket BindInsecure CORS policyCross-site request forgeryGarbage collection prevention in multiprocessingCatch and rethrow exceptionWeak algorithm used for Password HashingMissing none check on response metadataSensitive information leakClient-side KMS reencryptionOverride of reserved variable names in a Lambda functionDocker arbitrary container runDirect dict object modificationCatastrophic backtracking regexResource management errors cdkResource leakTensorflow redundant softmaxAWS insecure transmission CDKPublic method parameter validationImproper error handlingTime zone aware datetimesPytorch control sources of randomnessDeadlocks caused by improper multiprocessing API usageLow maintainability with low class cohesionUntrusted AMI imagesNotebook invalid execution orderConfusion between equality and identity in conditional expressionPytorch sigmoid before bcelossPytorch data loader with multiple workersPytorch avoid softmax with nlllossPytorch miss call to zero gradError prone sequence modificationAWS missing encryption of sensitive data cdkBad exception handlingUse of Default Credentials CDKNotebook variable redefinitionDo not pass generic exception ruleUsage of an API that is not recommended - High SeverityInsecure cryptographyS3 partial encrypt CDKCross-site scriptingMutable objects as default arguments of functionsImproper Access Control CDKViolation of PEP8 programming recommendationsInsecure temporary file or directoryComplex code hard to maintainaws kmskey encryption cdkUsage of an API that is not recommendedEnabling and overriding debug featureDeserialization of untrusted objectUse of an inefficient or incorrect APIAvoid using nondeterministic Tensorflow APIInefficient string concatenation inside loopImproper sanitization of wildcards or matching symbolsInsecure hashingUsing AutoAddPolicy or WarningPolicyLog injectionWeak obfuscation of web requestSocket close platform compatibilityUnsanitized input is run as codeBatch request with unchecked failuresInefficient polling of AWS resourceHardcoded interface bindingHardcoded IP addressHardcoded credentialsServer-side request forgeryModule injectionUnnecessary iterationTensorflow control sources of randomnessMissing Authentication for Critical Function CDKUsage of an API that is not recommended - Medium SeverityUnsafe Cloudpickle LoadIncorrect binding of SNS publish operationsPyTorch create tensors directly on deviceInefficient new method from hashlibDangerous global variablesMultiple values in return statement is prone to errorLDAP injectionClear text credentialsMissing S3 bucket owner conditionAWS missing encryption CDK
High
Showing all detectors for the Python language with high severity.
Improper privilege management
Privilege escalation happens when a malicious user gains elevated access to resources that should be unavailable to them.
Insufficient Logging CDK
In the case of a security-critical event, the product fails to either log the event or misses crucial details in the logged information.
Unauthenticated LDAP requests
Unauthenticated LDAP requests can allow untrusted access to LDAP servers.
Path traversal
Constructing path names with unsanitized user input can lead to path traversal attacks (for example,
../../..) that allow an attacker access to file system resources.Loose file permissions
Weak file permissions can lead to privilege escalation.
Exposure of Sensitive Information CDK
The product unintentionally grants unauthorized actors access to a resource by placing it in the wrong control sphere.
File injection
Writing unsanitized user data to a file is unsafe.
XML External Entity
Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.
Outdated subprocess module API
Using outdated multiprocessing API calls and parameters is not recommended.
Improper authentication
Your code doesn't sufficiently authenticate identities provided by its users.
Insecure cookie
Insecure cookies can lead to unencrypted transmission of sensitive data.
XPath injection
Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.
Missing authorization
Missing authorization checks can lead to unauthorized access to a resource or performance of an action.
SQL injection
Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database
Improper certificate validation
Lack of validation of a security certificate can lead to host impersonation and sensitive data leaks.
URL redirection to untrusted site
User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.
Mutually exclusive call
Calls to mutually exclusive methods were found in the code.
AWS api logging disabled cdk
Api Logging Disabled may lead to unable to access log and does not record the event.
OS command injection
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
AWS credentials logged
Logging unencrypted AWS credentials can expose them to an attacker.
Missing Authorization CDK
Improper Access Control.
Zip bomb attack
Expanding unsanitized archive files taken as input can lead to zip bomb attacks.
Synchronous publication of AWS Lambda metrics
Synchronous publication of AWS Lambda metrics is inefficient.
Unrestricted upload of dangerous file type
Insufficiently restrictive file uploads can lead to inadvertently running malicious code.
Insecure connection using unencrypted protocol
Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.
Unauthenticated Amazon SNS unsubscribe requests might succeed
Failing to set the
AuthenticateOnUnsubscribe flag to True when confirming an SNS subscription can lead to unauthenticated cancellations.Cross-site request forgery
Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.
Weak algorithm used for Password Hashing
Weak algorithm used for Password Hashing. Consider using stronger algorithms, such as Argon2, PBKDF2, or scrypt.
Sensitive information leak
Exposure of sensitive information can lead to an unauthorized actor having access to the information.
Client-side KMS reencryption
Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.
Override of reserved variable names in a Lambda function
Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.
Resource management errors cdk
Software system fails to properly track or release resources during its operation. This can lead to resource leaks.
AWS insecure transmission CDK
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
AWS missing encryption of sensitive data cdk
Sensitive or critical information is not encrypted before storage or transmission in the product.
Use of Default Credentials CDK
The product relies on default credentials(including passwords and cryptographic keys) for potentially vital functions.
Do not pass generic exception rule
Do not pass generic exception.
Usage of an API that is not recommended - High Severity
APIs that are not recommended were found - High Severity.
S3 partial encrypt CDK
An unencrypted bucket could lead to sensitive data exposure.
Cross-site scripting
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
Improper Access Control CDK
The software does not restrict or incorrectly restrict access to a resource from an unauthorized actor.
aws kmskey encryption cdk
Using an AWS KMS key helps follow the standard security advice of granting least privilege to objects generated by the project.
Usage of an API that is not recommended
APIs that are not recommended were found.
Deserialization of untrusted object
Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.
Improper sanitization of wildcards or matching symbols
Unsanitized wildcards or special matching symbols in user-provided strings can enable attacks and lead to unwanted behavior.
Using AutoAddPolicy or WarningPolicy
Using
AutoAddPolicy or WarningPolicy can allow a malicious server to impersonate a trusted server.Log injection
Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.
Weak obfuscation of web request
Weak obfuscation while configuring a web request.
Socket close platform compatibility
The
os.close() does not work on some platforms.Server-side request forgery
Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.
Module injection
Untrusted user imports in the
importlib.import_module() function allow attacks.Missing Authentication for Critical Function CDK
Missing authentication checks can lead to unauthorized access to a resource or performance of an action.
Unsafe Cloudpickle Load
Pickling issues on Cloudpickle Load.
Inefficient new method from hashlib
The constructors for the
hashlib module are faster than new()LDAP injection
LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.
Clear text credentials
Credentials that are stored in clear text can be intercepted by a malicious actor.
AWS missing encryption CDK
The AWS resource is missing appropriate encryption.