Amazon QDetector Library Sign in to Amazon Q

Q

Detector Library

Go detectors (45/45)

Useless if Body Channel Guarded With Mutex Improper Certificate Validation Unvalidated S3 Bucket Ownership Resource Leak Insecure Cookie Weak Random Number Generation Redundant Equality Check Insecure Ignore Host Key Unsafe Reflection Unchecked Batch Operation Failures Lambda Client Reuse Os Command Injection Useless if Conditional Log Injection Httptrace FileServer As Handler Pprof Endpoint Cross Site Scripting (XSS)Not Recommended API Usage Hidden Goroutine Channel Accessible By Non Endpoint Decompression Bomb Cross-Site Request Forgery (CSRF)Thread Safety Violation Insecure Connection SQL Injection Deprecated Key Generator Exported Loop Pointer Server Side Request Forgery (SSRF)Sensitive Information Leak Integer Overflow Missing Pagination Insecure Cryptography Protection Mechanism Failure Nil Pointer Dereference Temporary Files XML External Entity Insecure File Permissions Authentication Bypass By Alternate Name Code Injection Improper authentication Use Filepath Join Path Traversal Write Pprof Profile Output Hardcoded true or false

Tag: top25-cwes

Os Command Injection

OS command injection from untrusted input

Cross Site Scripting (XSS)

XSS from untrusted input in web outputs

Cross-Site Request Forgery (CSRF)

Insecure validation and lack of restrictions enable cross-site request forgery

Thread Safety Violation

Unsynchronized concurrent access to shared data

SQL Injection

Improper Neutralization of Special Elements used in an SQL Command

Server Side Request Forgery (SSRF)

User input used unsanitized in outbound requests

Integer Overflow

Integer overflow from improper input validation in conversions

Nil Pointer Dereference

Dereferencing a nil pointer can lead to unexpected nil pointer exceptions.

XML External Entity

XXE vulnerability from XML

Insecure File Permissions

Overly permissive file permissions

Code Injection

Code injection from untrusted input

Improper authentication

Improper authentication from insufficient identity verification

Write Pprof Profile Output

Identified the presence of stack traces within HTTP response, posing a potential security risk if deployed in a user-facing manner in a production environment.