Amazon Q
Detector Library
Scala detectors (48/48)
Improper Neutralization of Special Elements in Data QueryCookie Without Http Only FlagEL InjectionAvoid Persistent CookiesOS command injectionImproper AuthenticationArgument InjectionInsecure host name verifierServer-Side Request ForgeryInsecure CryptographyTemplate InjectionExpression Language InjectionInteger OverflowLog InjectionUntrusted data in http sessionLDAP InjectionInsecure LDAP ConfigurationSMTP injectionInsecure connection using unencrypted protocolDeserialization of Untrusted DataHTTP response splittingInsecure servlet handlingIncorrect Permission AssignmentImproper handling of unicode encodingSQL injectionUse of Insufficiently Random ValuesInsecure cookieCode InjectionCRLF InjectionUse Of RSA AlgorithmPath TraversalURL redirection to untrusted siteImproper Validation Of Array IndexHardcoded credentialsInsufficient Protected CredentialsInsecure jax endpoint usageXML External EntityInsecure CORS policyJS evalExternal Access to Files or DirectoriesIncorrect Certificate Hostname VerificationExternally-Controlled Format StringNoSQL injectionImproper privilege managementCross Site Request ForgeryCross-site scriptingImproper Certificate ValidationDisabled HTML autoescape
LDAP Injection High
The software constructs an LDAP query, either partially or entirely, using input from an external source, but it fails to properly sanitize or incorrectly sanitizes special characters or elements that could alter the intended LDAP query when sent to a downstream component.
