Supported Sast rules :: Xygeni Documentation

XyDocs






  
    XyDocs
    Code Security - Vulnerabilities
  


  

  


Supported Sast rules



The rules for Code Vulnerabilities listed below are classified by language according to their kind.




C


Access Control



Null ACL in SetSecurityDescriptorDacl may allow all access


Too-permissive umask values





Buffer Overflow



Direct write into stack buffer may cause stack-based buffer overflow


Incorrect use of sizeof() on a malloc’ed pointer type


Incorrect use of strncat() may lead to buffer overflow


Incorrect use of strncpy/stpncpy/strlcpy with wrong buffer size


Missing null termination after strncpy/stpncpy


Off-by-one error in buffer size calculation


Pointer subtraction between unrelated memory objects


Unsafe use of snprintf/vsnprintf return value may cause buffer overflow


Unsafe use of strlcpy/strlcat return value may cause buffer overflow


Use of insecure gets() function with no bounds checking


Use of insecure scanf-family functions prone to buffer overflow


Use of insecure sprintf/vsprintf functions prone to buffer overflow


Use of insecure unbounded string copy/concatenation functions





Command Injection



Command injection via exec functions


Possible executable path hijacking





Cryptography



Insecure cipher algorithm


Insecure hashing algorithm


Usage of insufficient random number generator


Use of insecure rand/srand PRNG not suitable for security contexts


Use of weak or non-cryptographic hash algorithm in security context





Denial Of Service



Regular expression with inefficient worst-case complexity (ReDoS)





Format String



Format string vulnerability from externally controlled format argument





Integer Overflow



Integer overflow from unsafe use of strlen() in arithmetic


Integer overflow or wraparound in arithmetic calculation


Integer truncation from casting to a smaller primitive type


Meaningless comparison of unsigned variable against negative value


Unsafe signed-to-unsigned or unsigned-to-signed integer conversion





Memory Management



Calling free() on memory not allocated by malloc/calloc/realloc


Double free of previously deallocated memory


Exposure of memory addresses that may defeat ASLR


Function returns the address of a stack-allocated variable


Mismatched C++ memory allocation and deallocation functions


Mismatched memory allocation and deallocation functions


Unchecked return value of malloc/calloc/realloc


Use of insecure alloca() with no guarantee of valid memory allocation


Use of previously freed memory


Use of putenv() with a pointer to a stack variable





Miscellaneous



Access to attacker-controlled command-line arguments or environment variables


Assert used as the only validation for untrusted input


Call to a potentially insecure function that should be reviewed


Common typo patterns that change application logic


High-entropy string assignment that may contain a hardcoded secret


Incorrect argument order in memset() call


Missing break statement in switch case causing fall-through


Missing default case in switch statement


Missing return statement in non-void function


Overlapping source and destination in sprintf/snprintf


Unchecked return value of scanf-family functions


Uncontrolled search path element


Usage of deprecated function (getlogin)


Use of atoi/atol/atof with no error handling or overflow checking


Use of obsolete function (getpass)





Privilege Management



Incorrect order of setuid/setgid calls may allow privilege escalation


Return values not checked when attempting to drop privileges


Unchecked return value of setuid/seteuid may leave elevated privileges





Race Condition



Incorrect order of setuid/setgid calls may allow privilege escalation


Insecure use of vfork function


Time-of-check time-of-use (TOCTOU) race condition in file operations


Unchecked return value of setuid/seteuid may leave elevated privileges


Use of deprecated signal() API instead of sigaction()





Resource Availability



Missing error check on read() susceptible to file descriptor exhaustion





Temp File



Insecure temporary file creation







Csharp


Access Control



.Net access restriction subverted (Reflection)


Anonymous LDAP Bind


User Controlled Ownership Field





Api



Dangerous API





Authentication



Cookies In Security Decision


Cross Site Request Forgery ('CSRF')


Insufficient Session Expiration


JWT Missing Claim Validation





Channel



Server Side Request Forgery ('SSRF')





Cryptography



Crypto Agility (Hardcoded Algorithm Selection)


JWT Signature Verification Bypass


PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)


PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)


Unverified Webhook Signature


Use of a weak cryptographic initialization vector


Weak Encryption Algorithm


Weak Encryption Mode of Operation


Weak Hash Algorithm


Weak Password Hash





Information Leak



Hardcoded Credentials


Information Exposure Through Error Message


Information Exposure Through Query String


Insecure Transport


Observable Timing Discrepancy


Password In Redirect


Plaintext Storage In Cookie


Trust Boundary Violation





Injection



Code Injection During Deserialization


Cookie Poisoning


Cross Site Scripting ('XSS')


Dynamic code injection in scripting API


HTTP Parameter Pollution


HTTP Splitting


Improper neutralization of data within XPath expressions ('XPath Injection')


Improper neutralization of special elements used in a command ('Command Injection')


LDAP Injection


Log Forging


Mail Command Injection


NoSQL Injection


Open Redirect


Process Control


Regex Injection


SQL Injection ('SQLi')


Unsafe Reflection


XAML Injection


XML Entity Injection


XML Injection





Memory Access



Buffer Overflow





Misconfiguration



ASP.Net Custom Errors Disabled


ASP.Net Unsafe Authentication Forms


ASP.Net Unsafe Cookies Configuration


Cross-site scripting protection disabled


Debug Features Enabled


Deserialization with a formatter that reconstructs the type it names


Insecure SSL


Request Validation Disabled


SameSite None Without Secure


Too-broad CORS Policy


Unsafe Cookie


User Controlled Primary Key


ViewState MAC Disabled


XML reader configured to fetch external resources





Path Resolution



Dangerous File Upload


Path Traversal


Zip Slip





Predictability



Hardcoded Cryptographic Key


Hardcoded Cryptographic Salt


Inadequate Padding


Insecure Randomness


Insufficient Key Size


Non Random IV With CBC Mode





Privilege



P/Invoke declarations should not be safe critical





Resource Management



Connection String Parameter Pollution


Regular expression Denial of Service ('ReDoS')





Risky Values



Dangerous Hostname Check





Synchronization



Shared Mutable State





UI



Clickjacking Protection Weakened







Dart


Auth



Hardcoded credential / secret in Dart source


JWT decoded without signature verification


LocalAuthentication.authenticate called without biometricOnly enforcement





Code



Command injection — Process.run / Process.start invoked with a shell or interpolated command


Cross-site scripting via dart:html innerHtml / setInnerHtml from non-literal source


Dart code loaded from a remote URI or reflected over via dart:mirrors


Path traversal — File/Directory constructed with an interpolated, unvalidated path


SQL injection via string-interpolated SQL passed to sqflite raw* / execute





Config



.env file bundled into the Flutter app as an asset


Android network configuration permits cleartext (HTTP) traffic


Debug / developer / admin artifact reachable from a release build


Insecure Flutter package dependency declared in pubspec.yaml





Cryptography



Hardcoded cryptographic key


Hardcoded cryptographic salt


Inadequate encryption strength due to inadequate padding


Inadequate encryption strength due to insufficient key size


Use of a broken or risky cryptographic encryption algorithm


Use of a broken or risky cryptographic mode of operation (ECB)


Use of a non-random IV or nonce in a block cipher mode


Use of a weak or non-cryptographic hash algorithm


Use of cryptographically weak pseudo-random number generator (PRNG)


Use of weak password hashing





Network



Cleartext transmission of sensitive information ("Insecure Transport")


Dangerous (overly permissive) hostname check in certificate validation


Insecure SSL/TLS configuration (certificate validation disabled)


Missing TLS certificate pinning in a Flutter HTTP client





Platform



Deeplink / URI query parameter consumed without validation (forced unwrap)


State-changing action invoked with an auto-execute / bypass-confirmation flag


Use of dart:ffi (memory-unsafe native FFI surface)


WebView JavaScript execution unrestricted


WebView executes JavaScript from a non-literal (potentially attacker-controlled) source


WebView file access enabled (file:// URLs can read local files)


WebView loads HTML or URL from a non-literal (potentially attacker-controlled) source





Privacy



Personally identifiable information (PII) sent to Firebase Analytics


Sensitive information logged via print / debugPrint / log


Sensitive value copied to the system clipboard





Storage



Hive box opened without encryption (encryptionCipher missing)


Sensitive value stored in cleartext SharedPreferences


Sensitive value written to an unprotected plaintext file


sqflite database opened without SQLCipher / page-level encryption







Go


Access Control



Anonymous LDAP Bind


Insecure File Permissions


Socket Binding To All Interfaces


User Controlled Ownership Field





Api



Avoid Native Calls


Dangerous API


Insecure Temporary File





Authentication



Cookies In Security Decision


Cross Site Request Forgery (CSRF)





Channel



Server Side Request Forgery ('SSRF')





Cryptography



Crypto Agility (Hardcoded Algorithm Selection)


JWT Signature Verification Bypass


PQC Hybrid (Bare Post-Quantum Algorithm Without a Classical Partner)


PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)


PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)


Unverified Webhook Signature


Use of a broken or risky cryptographic algorithm


Use of a broken or risky cryptographic mode of operation


Use of a weak cryptographic initialization vector


Weak Hash Algorithm


Weak Password Hash





Entry Points



Profiling Endpoint Exposed





Information Leak



Hardcoded Credentials


Information Exposure Through Debug Log


Information Exposure Through Error Message


Information Exposure Through External Request


Information Exposure Through Query String


Insecure Authentication


Insecure Transport


JSONP Hijacking


Observable Timing Discrepancy


Password In Redirect


Plaintext Storage In Cookie


Plaintext Storage Of Password


Serializable Class Containing Sensitive Data


Server Insecure Transport


Trust Boundary Violation





Injection



Code Injection


Cookie Poisoning


Format String Injection


HTTP Parameter Pollution


HTTP Splitting


Improper neutralization of data within XPath expressions ('XPath Injection')


Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')


JSON Injection


LDAP Injection


Log Forging


Mail Command Injection


NoSQL Injection


OS Command Injection


Regex Injection


Resource Injection


SQL Injection


Server-side Template Injection


Sleep Injection


URL Redirection to Untrusted Site ('Open Redirect')


Unsafe Reflection


XML Injection





Misconfiguration



Insecure SSL


Insecure SSL Version


Missing SSH host key verification


SameSite None Without Secure


Too Broad Cors Policy


Unsafe Cookie


Unsafe Session Configuration


User Controlled Primary Key





Other



Execution After Redirect ('EAR')





Path Resolution



Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')


Zip Slip





Predictability



Hardcoded Cryptographic Key


Hardcoded Cryptographic Salt


Inadequate Padding


Insecure Randomness


Insufficient Key Size





Resource Management



Connection String Parameter Pollution


DoS Decompression Bomb


Slowloris Attack





Risky Values



Error unhandled


Integer Overflow or Wraparound





Synchronization



Shared Mutable State







Html


Access Control



Hidden Sensitive Fields


Insecure Iframe Configuration


Missing Frame Ancestors Protection


Missing Resource Integrity


Missing Tabnabbing Protection


Unsafe Content Security Policy





Authentication



Forms Without CSRF Protection





Information Leak



Autocomplete Enabled for Sensitive Fields


Insecure Authentication via HTTP GET


Insecure Meta Tags


Insecure Resource


Unmasked Password Fields





Injection



Inline JavaScript Event Handler


Input Fields Without Validation Attributes


JavaScript Protocol Urls







Java


Access Control



Android Missing Receiver Permission


Android Sticky Broadcast


Android Unrestricted Broadcast


Android Webview JavaScript Enabled


Android Webview JavaScript Interface Annotation


Android World Writeable Readable File Permission


Anonymous LDAP Bind


Database Access Control


Implicitly Exported Android Component


Intent Forwarding


Privilege Escalation Vulnerability


Too Broad App Permissions


User Controlled Ownership Field





Api



Avoid Direct Database Connection


Avoid Explicit Socket


Avoid Explicit Thread Management


Avoid JVM Exit


Avoid Native Calls





Authentication



Cookies In Security Decision


Cross Site Request Forgery ('CSRF')


Insufficient Session Expiration





Channel



Server Side Request Forgery ('SSRF')





Cryptography



Crypto Agility (Hardcoded Algorithm Selection)


JWT Signature Verification Bypass


PQC Hybrid (Bare Post-Quantum Algorithm Without a Classical Partner)


PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)


PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)


Unverified Webhook Signature


Use of a broken or risky cryptographic mode of operation


Use of a weak cryptographic initialization vector


Weak Encryption Algorithm


Weak Hash Algorithm


Weak Password Hash





Entry Points



Android Debugging Enabled


Android Webview Debugging Enabled


Avoid Leftover Debug Code





Exception Management



Unhandled SSL Exception





Information Leak



Android Application Backup Allowed


Android Screenshot Allowed


Android Sensitive Keyboard Cache


Android Webview Content Access Enabled


Android Webview File Access Enabled


Hardcoded Credentials


Information Exposure Through Debug Log


Information Exposure Through Error Message


Information Exposure Through External Request


Information Exposure Through Query String


Insecure Authentication


Insecure Transport


Observable Timing Discrepancy


Password In Redirect


Plaintext Storage In Cookie


Plaintext Storage Of Password


SMS Monitoring


Serializable Class Containing Sensitive Data


Trust Boundary Violation





Injection



Android Fragment Injection


Android URI Permission Manipulation


Code Injection


Code Injection During Deserialization


Cookie Poisoning


Cross Site History Manipulation ('XSHM')


Cross Site Scripting ('XSS')


External Control Of Configuration Setting


Format String Injection


HTTP Parameter Pollution


HTTP Splitting


Improper Validation Of Array Index


JSON Injection


LDAP Injection


Log Forging


Mail Command Injection


NoSQL Injection


OS Command Injection


Open Redirect


Process Control


Reflected File Download


Regex Injection


Resource Injection


SQL Injection ('SQLi')


Same Origin Method Execution ('SOME')


Security Check In Overridable Method


Sleep Injection


Third-Party Package Context Code Execution


Unchecked Input In Loop Condition


Unsafe Reflection


View Manipulation


XML Entity Injection


XML Injection


XPath Injection





Misconfiguration



Cross-site scripting protection disabled


Deserialization without a class restriction


Insecure SSL


Insecure Transport Configuration


Missing Certificate Pinning


Missing Content-Security-Policy Header


SameSite None Without Secure


Sensitive Spring Boot Actuator Endpoints Exposed


Spring Security Debug Enabled


Spring XSS Protection Disabled


Too Broad Cors Policy


Unprotected Storage of Credentials


Unrestricted Request Mapping


Unsafe Cookie


User Controlled Primary Key


Web.xml security misconfigurations


XML parser created without XXE hardening





Other



Dangerous API


Execution After Redirect ('EAR')





Path Resolution



Input Path Not Canonicalized


Input Path Not Normalized


Path Traversal





Predictability



Hardcoded Cryptographic Key


Hardcoded Cryptographic Salt


Inadequate Padding


Insecure Randomness


Insufficient Key Size


Non Random IV With CBC Mode





Resource Management



Connection String Parameter Pollution


Potential Infinite Loop


Regular expression Denial of Service ('ReDoS')





Risky Values



Avoid Non Serializable Objects Stored


Dangerous Hostname Check





Synchronization



Race Condition Format


Race Condition Matcher


Race Condition Servlet


Race Condition on a Shared XML Processor


Shared Mutable State


Static Database Connection







Javascript


Access Control



User Controlled Ownership Field





Authentication



Cross Site Request Forgery (CSRF)


Improper Certificate Validation





Channel



Server Side Request Forgery ('SSRF')





Cryptography



Crypto Agility (Hardcoded Algorithm Selection)


Insufficient Cryptographic Key Length


JWT Signature Verification Bypass


PQC Hybrid (Bare Post-Quantum Algorithm Without a Classical Partner)


PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)


PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)


Unverified Webhook Signature


Use of a broken or risky cryptographic algorithm


Use of a broken or risky cryptographic mode of operation


Use of a weak cryptographic initialization vector


Use of a weak password hashing


Weak Hash Algorithm





Information Leak



Hardcoded Credentials


Information Exposure Through Debug Log


Information Exposure Through Error Message


Information Exposure Through Query String


Insecure Transport


Plaintext Storage In Cookie


Sensitive data in HTML5 Web Storage


Server Insecure Transport


Too Broad Message Posting





Injection



Angular Cross Site Scripting


Client-side Template Injection


Code Injection


Code injection during object deserialization


Code injection with javascript: URL in JSX


Cookie Poisoning


HTML escape disabled in Vue component


Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')


Improper neutralization of XML entities ('Xml Entity Injection')


Improper neutralization of data within XPath expressions ('XPath Injection')


Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')


NoSQL Injection


OS Command Injection


Prototype Pollution


Regex Injection


Resource Injection


SQL Injection


Server-side Template Injection


URL Redirection to Untrusted Site ('Open Redirect')


Unsafe JQuery Plugin





Misconfiguration



CORS Policy is too broad


Cross-site scripting protection disabled


Deserialization that evaluates the payload


HTTP Strict Transport Security (HSTS) not set


Insecure SSL


Prevent MIME Sniffing


SameSite None Without Secure


Strict Contextual Escaping (SCE) disabled


Unsafe Cookie


User Controlled Primary Key


X-Powered-By header must be disabled





Path Resolution



Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')


Zip Slip





Predictability



Hardcoded Cryptographic Key


Insecure Randomness





Resource Management



Allocation Of Resources Without Limits


Potential loop with unreachable exit condition ('Infinite Loop')


Regular Expression DoS





Risky Values



Do not use eval()


React dangerouslySetInnerHTML should not be used


ReactDOM.findDOMNode() should not be used


SolidJS innerHTML should not be used without sanitization





Synchronization



Shared Mutable State





UI



No clickjacking protection configured







Kotlin


Access Control



Android Missing Receiver Permission


Android Sticky Broadcast


Android Unrestricted Broadcast


Android Webview JavaScript Enabled


Android Webview JavaScript Interface Annotation


Android World Writeable Readable File Permission


Anonymous LDAP Bind


Implicitly Exported Android Component


Intent Forwarding


Privilege Escalation Vulnerability


Too Broad App Permissions


User Controlled Ownership Field





Api



Avoid Native Calls





Authentication



Cookies In Security Decision


Cross Site Request Forgery ('CSRF')





Channel



Server Side Request Forgery ('SSRF')





Cryptography



Crypto Agility (Hardcoded Algorithm Selection)


JWT Signature Verification Bypass


PQC Hybrid (Bare Post-Quantum Algorithm Without a Classical Partner)


PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)


PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)


Use of a broken or risky cryptographic mode of operation


Use of a weak cryptographic initialization vector


Weak Encryption Algorithm


Weak Hash Algorithm


Weak Password Hash





Entry Points



Android Debugging Enabled


Android Webview Debugging Enabled





Exception Management



Unhandled SSL Exception





Information Leak



Android Application Backup Allowed


Android Screenshot Allowed


Android Sensitive Keyboard Cache


Android Webview Content Access Enabled


Android Webview File Access Enabled


Hardcoded Credentials


Information Exposure Through Debug Log


Information Exposure Through Error Message


Information Exposure Through External Request


Information Exposure Through Query String


Insecure Authentication


Insecure Transport


Observable Timing Discrepancy


Password In Redirect


Plaintext Storage In Cookie


Plaintext Storage Of Password


SMS Monitoring


Serializable Class Containing Sensitive Data


Trust Boundary Violation





Injection



Android Fragment Injection


Android URI Permission Manipulation


Code Injection


Code Injection During Deserialization


Cookie Poisoning


Cross Site Scripting ('XSS')


Format String Injection


HTTP Parameter Pollution


HTTP Splitting


LDAP Injection


Log Forging


Mail Command Injection


NoSQL Injection


OS Command Injection


Open Redirect


Process Control


Reflected File Download


Regex Injection


Resource Injection


SQL Injection ('SQLi')


Same Origin Method Execution ('SOME')


Sleep Injection


Third-Party Package Context Code Execution


Unsafe Reflection


View Manipulation


XML Entity Injection


XPath Injection





Misconfiguration



Cross-site scripting protection disabled


Deserialization without a class restriction


Insecure SSL


Insecure Transport Configuration


Missing Certificate Pinning


SameSite None Without Secure


Spring XSS Protection Disabled


Too Broad Cors Policy


Unprotected Storage of Credentials


Unrestricted Request Mapping


Unsafe Cookie


User Controlled Primary Key


XML parser created without XXE hardening





Other



Dangerous API





Path Resolution



Path Traversal


Zip Slip





Predictability



Hardcoded Cryptographic Key


Hardcoded Cryptographic Salt


Inadequate Padding


Insecure Randomness


Insufficient Key Size





Resource Management



Connection String Parameter Pollution


Regular expression Denial of Service ('ReDoS')





Synchronization



Shared Mutable State







Objectivec


Auth



Biometric authentication should be hardware and keychain backed.





Code



The App may contain banned API(s). These API(s) are insecure and must not be used.





Cryptography



SHA1 is a weak hash known to have hash collisions.


The App uses ECB mode in Cryptographic encryption algorithm.


Weak Hash algorithm used.





Network



App allows self signed or invalid SSL certificates. App is vulnerable to MITM attacks.


UIWebView in App ignore SSL errors and accept any SSL Certificate.





Platform



User input in "loadHTMLString" will result in JavaScript Injection.





Storage



Hardcoded sensitive information.


The App logs information. Sensitive information should never be logged.


The file has no special protections associated with it.







Php


Access Control



User Controlled Ownership Field





Authentication



Cookies In Security Decision


Cross Site Request Forgery (CSRF)





Channel



Server Side Request Forgery ('SSRF')





Cryptography



Crypto Agility (Hardcoded Algorithm Selection)


PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)


PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)


Use of a broken or risky cryptographic algorithm


Use of a broken or risky cryptographic mode of operation


Use of a weak cryptographic initialization vector


Weak Hash Algorithm


Weak Password Hash





Information Leak



Hardcoded Credentials


Information Exposure Through Debug Log


Information Exposure Through Error Message


Information Exposure Through Query String


Insecure Transport


Password In Redirect


Trust Boundary Violation


Twig No Use Debug





Injection



Code Injection


Code injection during object deserialization


External Variable Modification


Format String Injection


HTTP Parameter Pollution


Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')


Improper neutralization of XML entities ('Xml Entity Injection')


Improper neutralization of data within XPath expressions ('XPath Injection')


Improper neutralization of external input used within a CSV or Excel formula ('Formula Injection')


Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')


LDAP Injection


Log Forging


Mail Command Injection


Mail Content Injection


Mail Header Manipulation


NoSQL Injection


OS Command Injection


Regex Injection


Resource Injection


SQL Injection


Sleep Injection


URL Redirection to Untrusted Site ('Open Redirect')





Misconfiguration



CakePHP Unsafe Configuration


CakePHP Unsafe Session Configuration


CodeIgniter Unsafe Session Configuration


Laravel Unsafe Session Configuration


SameSite None Without Secure


Too Broad Cors Policy


Twig XSS protection disabled


Unsafe Configuration


Unsafe Cookie


Unsafe Session Configuration


User Controlled Primary Key


XML parsed with entity substitution turned on


Zend/ Laminas Unsafe Session Configuration


unserialize without a class restriction





Other



Execution After Redirect ('EAR')





Path Resolution



Dangerous File Upload


Improper Control of filename for include / require statement ('Include File Injection')


Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')





Predictability



Hardcoded Cryptographic Key


Hardcoded Cryptographic Salt


Inadequate Padding


Insecure Randomness





Resource Management



Connection String Parameter Pollution


Regular Expression DoS





Risky Values



Do not use $_REQUEST


Do not use eval()


Symfony No Use Default Secret





Synchronization



Shared Mutable State







Python


Access Control



Anonymous LDAP Bind


Django Missing Permissions Check


Insecure File Permissions


Socket Binding To All Interfaces


User Controlled Ownership Field





Api



Insecure Temporary File





Authentication



Cookies In Security Decision


Cross Site Request Forgery (CSRF)


JWT Missing Claim Validation





Channel



Server Side Request Forgery ('SSRF')





Cryptography



Crypto Agility (Hardcoded Algorithm Selection)


JWT Signature Verification Bypass


PQC Hybrid (Bare Post-Quantum Algorithm Without a Classical Partner)


PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)


PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)


Unverified Webhook Signature


Use of a broken or risky cryptographic algorithm


Use of a broken or risky cryptographic mode of operation


Use of a weak cryptographic initialization vector


Weak Hash Algorithm


Weak Password Hash





Information Leak



Hardcoded Credentials


Information Exposure Through Debug Log


Information Exposure Through Error Message


Information Exposure Through External Request


Information Exposure Through Query String


Insecure Authentication


Insecure Transport


Observable Timing Discrepancy


Password In Redirect


Plaintext Storage In Cookie


Server Insecure Transport


Trust Boundary Violation





Injection



Code Injection


Code injection during object deserialization


Cookie Poisoning


HTTP Parameter Pollution


HTTP Splitting


Improper neutralization of XML entities ('Xml Entity Injection')


Improper neutralization of data within XPath expressions ('XPath Injection')


Improper neutralization of input during web page generation ('Cross-site Scripting' aka 'XSS')


JSON Injection


LDAP Injection


Log Forging


Mail Command Injection


NoSQL Injection


OS Command Injection


Regex Injection


Resource Injection


SQL Injection


Server-side Template Injection


Sleep Injection


URL Redirection to Untrusted Site ('Open Redirect')


Unsafe Cookie


Unsafe Reflection





Misconfiguration



Deserialization with a reader that reconstructs arbitrary objects


Django Unsafe Configuration


Django Unsafe Session Configuration


Django XSS Protection Disabled


Flask Unsafe Configuration


Flask XSS Protection Disabled


Improper Request Certificate Verification


Insecure Parser


Insecure SSL Version


Jinja XSS Protection Disabled


Mako XSS Protection Disabled


Missing Resource Integrity Check


Missing SSH Host Key Verification


SameSite None Without Secure


Template XSS Protection Disabled


Too Broad Cors Policy


Unsafe Cookie


Unsafe Logging Configuration


User Controlled Primary Key





Other



Execution After Redirect ('EAR')





Path Resolution



Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')


Zip Slip





Predictability



Hardcoded Cryptographic Key


Hardcoded Cryptographic Salt


Insecure Randomness


Insufficient Key Size





Resource Management



Connection String Parameter Pollution


External Request DoS


Regular Expression DoS





Risky Values



Django Password Requirements Not Enforced


Do not use assert


Do not use compile()


Do not use eval()





Synchronization



Shared Mutable State







Ruby


Attribute Restriction



Attribute Restriction





Authentication



Authentication





Basic Auth



Basic Auth





Command Injection



Command Injection





Cross-Site Request Forgery



Cross-Site Request Forgery: Missing protect_from_forgery


Cross-Site Request Forgery: Skipping CSRF or authentication checks by default


Cross-Site Request Forgery: Versions with CSRF token forgery vulnerability





Cross-Site Scripting



Cross-Site Scripting: HTML escaping is disabled for JSON output


Cross-Site Scripting: I18n XSS (CVE-2013-4491)


Cross-Site Scripting: Missing JSON encoding (CVE-2015-3226)


Cross-Site Scripting: Number helpers XSS vulnerabilities in certain versions


Cross-Site Scripting: Rails versions with SafeBuffer bug


Cross-Site Scripting: Strip_tags vulnerabilities


Cross-Site Scripting: Unescaped output in views


Cross-Site Scripting: Unsafe uses of select() helper


Cross-Site Scripting: Unsafe uses of select_tag() in some versions of Rails 3.x


Cross-Site Scripting: Unsanitized href Values


Cross-Site Scripting: Versions before 2.3.14 which have a vulnerable escape method


Cross-Site Scripting: Versions which do not escape single quotes (CVE-2012-3464)


Cross-Site Scripting: Versions with vulnerable sanitize and sanitize_css


Cross-Site Scripting: Vunerable uses of sanitize (CVE-2022-32209)


Cross-Site Scripting: XSS in Render Calls


Cross-Site Scripting: XSS in calls to content_tag


Cross-Site Scripting: XSS in link_to in versions before 3.0


Cross-Site Scripting: XSS vulnerability in translate helper


Cross-Site Scripting: simple_format XSS (CVE-2013-6416)





Dangerous Eval



Dangerous Eval





Dangerous Send



Dangerous Send





Default Routes



Default Routes: Filter Skipping (Rails 3.0-3.0.9)


Default Routes: General Warning





Denial Of Service



Denial of Service: Digest authentication DoS vulnerability


Denial of Service: Header DoS (CVE-2013-6414)


Denial of Service: Mime type denial of service (CVE-2016-0751)


Denial of Service: Route DoS (CVE-2015-7581)


Denial of Service: Searches regexes including user input


Denial of Service: Symbol DoS


Denial of Service: Versions with ActiveRecord symbol denial of service


Denial of Service: XML denial of service (CVE-2015-3227)


Denial of Service: render :text DoS (CVE-2014-0082)





Directory Traversal



Directory Traversal





Divide By Zero



Divide by Zero





Dynamic Render Path



Dynamic Render Path





File Access



File Access: Possible file access using user input


File Access: Versions with JRuby XML parsing backend


File Access: Versions with file existence disclosure vulnerability





Format Validation



Format Validation





HTTP Verb Confusion



HTTP Verb Confusion





Information Disclosure



Information Disclosure





Mail Link



Mail Link





Mass Assignment



Mass Assignment: Dangerous attr_accessible Attributes


Mass Assignment: General Mass Assignment


Mass Assignment: Mass assignment using without_protection


Mass Assignment: Potentially dangerous attributes allowed via permit


Mass Assignment: Strong params bypass in CVE-2014-3514





Missing Authorization



Missing Authorization





Missing Encryption



Missing Encryption





Nested Attributes



Nested Attributes: Nested attributes vulnerability (CVE-2015-7577)


Nested Attributes: Nested attributes vulnerability in Rails 2.3.9 and 3.0.0





Path Traversal



Path Traversal: CVE-2018-3760


Path Traversal: Unexpected Pathname behavior





Redirect



Redirect





Remote Code Execution



Remote Code Execution: JSON parsing vulnerabilities CVE-2013-0333 and CVE-2013-0269


Remote Code Execution: Render that might be vulnerable to CVE-2016-0752


Remote Code Execution: Unsafe deserialization of objects


Remote Code Execution: Unsafe reflection


Remote Code Execution: Unsafe reflection to access methods


Remote Code Execution: Use of Marshal for cookie serialization


Remote Code Execution: Uses of serialize in versions vulnerable to CVE-2013-0277


Remote Code Execution: YAML parsing vulnerabilities (CVE-2013-0156)





Response Splitting



Response Splitting





Reverse Tabnabbing



Reverse Tabnabbing





SQL Injection



SQL Injection: General SQL Injection


SQL Injection: Quote_table_name vulnerability in versions before 2.3.14


SQL Injection: Several SQL CVEs


SQL Injection: Unsafe find_by_* Usage





SSL Verification Bypass



SSL Verification Bypass





Security



EOLRails


EOLRuby


Send File





Session Manipulation



Session Manipulation





Session Setting



Session Setting





Template Injection



Template Injection





Timing Attack



Timing Attack





Unscoped Find



Unscoped Find





Weak Cryptography



Weak Cryptography





Weak Hash



Weak Hash







Rust


Command Injection



Command injection via user-controlled input





Cryptography



Use of non-cryptographic random number generator in security context


Use of weak or non-cryptographic hash algorithm in security context





Tls



TLS/SSL certificate verification disabled





Unsafe Code



Unsafe block usage requires manual audit





Untrusted Input



Untrusted input used in security decision







Scala


Cookie



Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')


Information Exposure Through Persistent Cookies


Sensitive Cookie Without 'HttpOnly' Flag


Sensitive Cookie in HTTPS Session Without 'Secure' Attribute


Trust Boundary Violation





Cors



Permissive Cross-domain Policy with Untrusted Domains





Cryptography



Improper Certificate Validation


Inadequate Encryption Strength


Inadequate encryption strength


Incorrect Behavior Order


Missing Support for Integrity Check


Use of RSA Algorithm without OAEP


Use of a Broken or Risky Cryptographic Algorithm





Endpoint



Cleartext transmission of sensitive information


Improper Certificate Validation


URL Redirection to Untrusted Site ('Open Redirect')


Use of less trusted source





File



Improper limitation of a pathname to a restricted directory ('Path Traversal')





Form



Improper validation of unsafe equivalence in input





Inject



Expression injection (OGNL)


External Control of System or Configuration Setting


Files or Directories Accessible to External Parties


Improper Control of Generation of Code ('Code Injection')


Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')


Improper Neutralization of CRLF Sequences ('CRLF Injection')


Improper Neutralization of Special Elements in Data Query Logic


Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')


Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')


Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')


Improper limitation of a pathname to a restricted directory ('Path Traversal')





Ldap



Improperly implemented security check for standard





Password



Use of Hard-coded Password





Perm



Incorrect Permission Assignment for Critical Resource


Insecure inherited permissions





Script



Improper Control of Generation of Code ('Code Injection')





Smtp



Improper Neutralization of Special Elements used in a Command


Improper Validation of Certificate with Host Mismatch





Ssrf



Server-Side Request Forgery (SSRF)





Strings



Collapse of data into unsafe value


Improper Handling of Unicode Encoding


Incorrect Type Conversion or Cast


Use of Externally-Controlled Format String





Templateinjection



Improper Control of Generation of Code ('Code Injection')





Unsafe



Exposure of sensitive system information to an unauthorized control sphere


External Control of System or Configuration Setting


Stack trace written to an HTTP response





Xml



Deserialization of Untrusted Data


Weak authentication


XML injection (aka Blind XPath injection)





Xpathi



Improper Restriction of XML External Entity Reference ('XXE')





Xss



Improper Neutralization of Input During Web Page Generation


Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')





Xxe



Improper Restriction of XML External Entity Reference ('XXE')







Swift


Access Control



User Controlled Ownership Field





Api



Avoid Native Calls


Insecure Temporary File





Authentication



Weak Biometric Access Control Flags


Weak Biometric Authentication


Weak Keychain ACL (Device Passcode)





Cryptography



Crypto Agility (Hardcoded Algorithm Selection)


JWT Signature Verification Bypass


PQC Readiness (Quantum-Vulnerable Public-Key Cryptography)


PQC Weak Key Length (Symmetric/Hash Strength Below the Post-Quantum Baseline)


Weak Encryption Algorithm


Weak Encryption Mode of Operation


Weak Hash Algorithm


Weak Password Hash





Incorrect Validation



Improper input validation using regular expressions without anchors


Unsafe HTML filtering using regular expressions





Information Leak



ATS Allows Arbitrary Loads For Media


ATS Allows Arbitrary Loads In Web Content


ATS Exception Insecure HTTP Loads


ATS Exception Low TLS Version


ATS Exception No Forward Secrecy


Cleartext Transmission of Sensitive Information


Cleartext storage of sensitive information in an application preference store


File Sharing Enabled


General Pasteboard Access


Hardcoded Credentials


Insecure Transport


Sensitive Information Logging


Unprotected File Storage


Weak Keychain Accessibility





Injection



Code Injection During Deserialization


Command Injection


Cookie Poisoning


Cross Site Scripting ('XSS')


Externally Controlled Format String


HTTP Response Splitting


JavaScript injection in a web view


NoSQL Injection


Open Redirect


Predicate Injection


Regex Injection


SQL Injection ('SQLi')


Server-Side Request Forgery (SSRF)


Unsafe Reflection


WebView loaded without restricting base URL





Memory Management



Untrusted Pointer Dereference





Misconfiguration



Archive decoded with an API that reconstructs the class it names


Deprecated UIWebView Usage


Entitlement App Sandbox Disabled


Entitlement Get-Task-Allow in Release


Entitlement Hardened Runtime Exception


Entitlement Keychain Access Groups Wildcard


Insecure SSL


Missing Dangerous Permission


SameSite None Without Secure


Unsafe Cookie


User Controlled Primary Key


XML External Entity (XXE)





Path Resolution



Path Traversal





Predictability



Hardcoded Cryptographic Key


Hardcoded Cryptographic Salt


Inadequate Padding


Insecure Randomness


Insufficient Key Size


Non Random IV with CBC Mode





Resource Management



Connection String Parameter Pollution


Regular expression Denial of Service ('ReDoS')





Risky Values



Dangerous Hostname Check





Synchronization



Shared Mutable State







Vbnet


Access Control



LDAP directory accessed with an anonymous / credential-less bind





Authentication



ASP.NET Identity account lockout disabled or weakened


JWT issuer/audience claim validation disabled





Channel



Server-side request forgery via user-controlled URL





Cryptography



Hardcoded / static Initialization Vector for a symmetric cipher


JWT signature verification disabled or bypassed


JWT token lifetime/expiration validation disabled


RSA encryption using insecure PKCS#1 v1.5 padding


RSA key created with an insufficient key size (< 2048 bits)


Secret compared with a non-constant-time operation


Use of a broken or deprecated symmetric encryption algorithm


Use of a broken or weak cryptographic hash algorithm


Use of the insecure ECB cipher mode of operation





Information Leak



Sensitive data placed in a URL query string


Stack trace written to an HTTP response





Inject



Dynamic code execution from user-controlled input


HTTP response splitting / CRLF injection into HTTP headers


Insecure deserialization of untrusted data


LDAP injection via user-controlled input


Log forging via unsanitized user input written to a log


NoSQL injection via user-controlled query input


OS command injection via user-controlled input


Open redirect via user-controlled URL


Process control via user-controlled native library load or DLL search path


Reflected cross-site scripting (XSS)


Regular expression without a match timeout (ReDoS)


SQL injection via user-controlled input


Unsafe reflection / dynamic type loading from user input


XML external entity (XXE) injection via unsafe parser configuration


XML injection via user-controlled input


XPath injection via user-controlled input





Misconfiguration



ASP.NET Core anti-forgery (CSRF) protection is explicitly disabled


ASP.NET WebForms ViewState MAC integrity protection is disabled


CORS policy allows any origin together with credentials


Clickjacking protection removed or weakened on the HTTP response


Cookie added without the Secure and HttpOnly flags


HttpListener bound to a wildcard host


TLS certificate validation callback always accepts the certificate


X.509 certificate trust decided from the subject name





Path Resolution



Path traversal via user-controlled file path


Unrestricted file upload persisted under client-supplied name


Zip Slip via unvalidated archive entry extraction path





Predictability



Use of an insecure pseudo-random number generator



  © 2026 Xygeni. All rights reserved