Amazon Q
Detector Library
Scala detectors (48/48)
Improper Neutralization of Special Elements in Data QueryCookie Without Http Only FlagEL InjectionAvoid Persistent CookiesOS command injectionImproper AuthenticationArgument InjectionInsecure host name verifierServer-Side Request ForgeryInsecure CryptographyTemplate InjectionExpression Language InjectionInteger OverflowLog InjectionUntrusted data in http sessionLDAP InjectionInsecure LDAP ConfigurationSMTP injectionInsecure connection using unencrypted protocolDeserialization of Untrusted DataHTTP response splittingInsecure servlet handlingIncorrect Permission AssignmentImproper handling of unicode encodingSQL injectionUse of Insufficiently Random ValuesInsecure cookieCode InjectionCRLF InjectionUse Of RSA AlgorithmPath TraversalURL redirection to untrusted siteImproper Validation Of Array IndexHardcoded credentialsInsufficient Protected CredentialsInsecure jax endpoint usageXML External EntityInsecure CORS policyJS evalExternal Access to Files or DirectoriesIncorrect Certificate Hostname VerificationExternally-Controlled Format StringNoSQL injectionImproper privilege managementCross Site Request ForgeryCross-site scriptingImproper Certificate ValidationDisabled HTML autoescape
Scala detectors
Showing all detectors for the Scala language.
Browse all detectors
Improper Neutralization of Special Elements in Data Query
The application constructs a query with inadequate neutralization of special elements, risking query logic manipulation.
Cookie Without Http Only Flag
Sensitive cookie without 'HttpOnly' flag
EL Injection
Potential EL injection vulnerability. User input is directly used in creating or evaluating EL expressions without proper validation or sanitization.
Avoid Persistent Cookies
Persistent cookies are vulnerable to attacks.
OS command injection
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
Improper Authentication
Security issue where software mishandles XML data from unreliable sources.
Argument Injection
Improper Neutralization of Argument Delimiters in a Command .
Insecure host name verifier
The software does not validate or improperly validate host name.
Server-Side Request Forgery
SSRF is a web vulnerability wherein an attacker manipulates a server to perform unintended requests.
Insecure Cryptography
Use of insecure cryptography
Template Injection
User input is directly used in rendering or evaluating templates without proper validation or sanitization.
Expression Language Injection
This vulnerability occurs when user inputs are not properly sanitized, allowing for injection attacks within expression language statements.
Integer Overflow
An integer overflow might cause security issues when it is used for resource management or execution control.
Log Injection
Untrusted input written to logs without proper sanitization, allowing attackers to forge or manipulate log entries
Untrusted data in http session
User input in
setAttribute could lead to trust boundary violation.LDAP Injection
The product improperly handles external input when constructing LDAP queries, failing to neutralize special elements that could modify the intended query.
Insecure LDAP Configuration
Insecure LDAP configuration detected.
SMTP injection
User input should be properly sanitized or encoded before using it in SMTP headers or message content.
Insecure connection using unencrypted protocol
Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.
Deserialization of Untrusted Data
Deserializing of data from untrusted sources.
HTTP response splitting
Passing data from an untrusted source into a cookie or web response might expose the user to HTTP response splitting attacks.
Insecure servlet handling
The Servlet can read GET and POST parameters from various methods. The value obtained should be considered unsafe.
Incorrect Permission Assignment
Incorrect Permission Assignment for Critical Resource.
Improper handling of unicode encoding
Improper handling of Unicode encoding when processing strings, leading to potential security vulnerabilities.
SQL injection
Use of untrusted inputs in SQL database query can enable attackers to read, modify, or delete sensitive data in the database
Use of Insufficiently Random Values
The product relies on random numbers or values that aren't random enough for security purposes, especially in situations where unpredictability is crucial.
Insecure cookie
Insecure cookies can lead to unencrypted transmission of sensitive data.
Code Injection
Code Injection occurs when an application executes untrusted code from an attacker.
CRLF Injection
Improper Neutralization of CRLF Sequences.
Use Of RSA Algorithm
RSA algorithm does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.
Path Traversal
Improper input validation, sanitization, and access controls are can lead to path traversal vulnerabilities.
URL redirection to untrusted site
User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.
Improper Validation Of Array Index
Array Index Validation Failure enables attackers to execute code or cause a denial of service by manipulating array index values.
Hardcoded credentials
Hardcoded credentials can be intercepted by malicious actors.
Insufficient Protected Credentials
The credentials provided are not adequately protected against security threats.
Insecure jax endpoint usage
Insecure usage of web service methods can enable attacks and lead to unwanted behavior.
XML External Entity
Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.
Insecure CORS policy
Cross-origin resource sharing policies that are too permissive could lead to security vulnerabilities.
JS eval
Avoid using eval() in JavaScript whenever possible, as it can execute arbitrary code, posing a significant security risk.
External Access to Files or Directories
External parties gain unauthorized access to files or directories via the product.
Incorrect Certificate Hostname Verification
Improper Validation of Certificate with Host Mismatch.
Externally-Controlled Format String
Use of Externally-Controlled Format String
NoSQL injection
Use of untrusted inputs in NoSQL database query can enable attackers to read, modify, or delete sensitive data in the database
Improper privilege management
Granting unsafe permissions can lead to security vulnerabilities.
Cross Site Request Forgery
CSRF happens when a hacker manipulates an authenticated user to unknowingly perform actions on a web app.
Cross-site scripting
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
Improper Certificate Validation
Improper certificate validation might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client.
Disabled HTML autoescape
Disabling the HTML autoescape mechanism exposes your web applications to attacks.