Amazon QDetector Library Sign in to Amazon Q

Amazon Q

Detector Library

Scala detectors (48/48)

Improper Neutralization of Special Elements in Data Query Cookie Without Http Only Flag EL Injection Avoid Persistent Cookies OS command injection Improper Authentication Argument Injection Insecure host name verifier Server-Side Request Forgery Insecure Cryptography Template Injection Expression Language Injection Integer Overflow Log Injection Untrusted data in http session LDAP Injection Insecure LDAP Configuration SMTP injection Insecure connection using unencrypted protocol Deserialization of Untrusted Data HTTP response splitting Insecure servlet handling Incorrect Permission Assignment Improper handling of unicode encoding SQL injection Use of Insufficiently Random Values Insecure cookie Code Injection CRLF Injection Use Of RSA Algorithm Path Traversal URL redirection to untrusted site Improper Validation Of Array Index Hardcoded credentials Insufficient Protected Credentials Insecure jax endpoint usage XML External Entity Insecure CORS policy JS eval External Access to Files or Directories Incorrect Certificate Hostname Verification Externally-Controlled Format String NoSQL injection Improper privilege management Cross Site Request Forgery Cross-site scripting Improper Certificate Validation Disabled HTML autoescape

OS command injection High

Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.

Detector ID

scala/os-command-injection@v1.0

Category

Common Weakness Enumeration (CWE)

Tags

# injection # subprocess # owasp-top10 # top25-cwes