AWS logo
Amazon QDetector Library

High

Showing all detectors for the C++ language with high severity.

Disabled HTML autoescape

Disabling the HTML autoescape mechanism exposes your web applications to attacks.

Weak pseudorandom number generation

Insecure pseudorandom number generators such as rand(), srand(), std::mt19937, or drand48() produce predictable values.

Missing Default in Switch

Missing default in switch can lead to unintended bugs.

Use Of Incorrect Operator

Weakness in software code can be introduced when the developer uses the wrong logical or relational operator in an expression.

Out Of Bounds Read

Out of bounds read can allow attackers to read sensitive information from other memory locations or cause a crash.

Out Of Bounds Write

Out-of-bounds write vulnerability occurs when software attempts to write data beyond the allocated memory bounds, potentially leading to memory corruption and security risks.

Thread safety violation

A thread safety violation might indicate a data race which can put the system into an inconsistent state.

Mismatched memory management routines.

Mismatched memory management routines are used to create and clean objects.

File System Access

Concurrent execution using shared resource with improper synchronization.

Insecure Buffer Access

Use of insecure functions can lead to buffer overflow.

Incorrect Pointer Scaling

Instances of incorrect pointer scaling detected, potentially leading to unexpected behavior and vulnerabilities.

Loose File Permissions

Weak file permissions can lead to privilege escalation.

Sensitive information leak

Sensitive information should not be exposed through log files or stack traces.

Missing Authorization

Missing authorization checks can lead to unauthorized access to a resource or performance of an action.

Return Stack Address

A function returns the address of a stack variable will cause unintended program behavior, typically in the form of a crash.

OS Command Injection

Improper neutralization of special elements used in an OS command ('OS Command Injection')

Incorrect Comparison

Secure comparison type safety recommendation.

Cross-Site Request Forgery (CSRF)

Potential Cross-Site Request Forgery (CSRF)

off by one error

Off-by-one errors occur when a loop or array index is incorrectly incremented or decremented by one, leading to unintended behavior.

Numeric Truncation Error

This code contains a potential format vulnerability due to the use of function without specifying correct format specifier.

Path traversal

Creating file paths from untrusted input might give a malicious actor access to sensitive files.

Insecure Cryptography

Use of insecure cryptography.

Insecure connection using unencrypted protocol

Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.

Unchecked Null Dereference

Dereferencing an unchecked value without verification, leading to potential runtime errors or undefined behavior.

SQL injection

Use of untrusted inputs in SQL database query can enable attackers to read, modify, or delete sensitive data in the database.

Log injection

Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.

Missing check on method output

Missing checks might cause silent failures that are harder to debug.

Improper Restriction on Memory Buffer

Improper restriction of operations within the bounds of a memory buffer.

Multiple Locks

Repeatedly locking critical resources in a concurrent environment can lead to varied consequences.

Improper Input Validation

Improper input validation can enable attacks and lead to unwanted behavior.

Improper Certificate Validation

Improper certificate validation might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client.

Cross Site Scripting

Detects potential cross-site scripting (XSS) vulnerabilities in C++ web applications.

Improper Authentication

Improper authentication from insufficient identity verification.