Showing all detectors for the Java language with high severity.

Reflected cross site scripting

Rule to detect reflected XSS.

AWS object presence check

Manually performing an object existence check is inefficient when a built-in operation is available.

Missing timeout check on CountDownLatch.await

Missing timeout check on CountDownLatch.await can cause synchronization errors.

Unspecified default value

Unspecified defaults can cause your application to crash.

Deserialization of untrusted object

Deserialization of untrusted objects can lead to security vulnerabilities such as, inadvertently running remote code.

Preserve thread interruption status rule

Preserve Thread Interruption Status Rule.

Missing null check for cache response metadata

Accessing the cache response metadata without performing a null check might cause a null dereference error.

Insecure connection using unencrypted protocol

Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.

Use of externally-controlled input to build connection string

Use of unsanitized user input to build connection strings can allow attackers to bypass security checks and access restricted resources.

Mutually exclusive call

Calls to mutually exclusive methods were found in the code.

Unexpected re-assignment of synchronized objects

Synchronized objects should not be re-assigned in the same synchronized block because the references to the synchronized object would be lost.

XPath injection

Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.

Input and output values become out of sync

If a method that uses an input parameter to update an output value throws an exception, then the output value is not updated.

Server-side request forgery

Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.

Missing Authorization for address id

Rule to detect lack of authorization check when using address ID.

Not recommended aws credentials classes

Find usages of not recommended classes for AWS Credentials and suggest replacing them with something else.

Path traversal

Creating file paths from untrusted input might give a malicious actor access to sensitive files.

Override of reserved variable names in a Lambda function

Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.

Usage of an API that is not recommended

APIs that are not recommended were found.

Insecure JSON web token (JWT) parsing

JWTs should not be parsed using the parse method.

Unchecked S3 object metadata content length

Failure to specify a content length causes the contents of the input stream to buffer locally in memory in order to calculate its length. This can result in performance problems.

Untrusted data in security decision

Security decisions should not depend on branching that can be influenced by untrusted or client-provided data.

Permissive cors configuration rule

Rule to enable detection for potential CORS vulnerabilities in services using the Coral or Spring frameworks.

XML External Entity

Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.

LDAP injection

LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.

Log injection

Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.

Sensitive information leak

Sensitive information should not be exposed through log files or stack traces.

Synchronous publication of AWS Lambda metrics

Synchronous publication of AWS Lambda metrics is inefficient.

XML External Entity Document Builder Factory

Objects that parse or handle XML in XML document can lead to XML External Entity (XXE) attacks when misconfigured.

Insecure TLS version

TLS versions older than TLS version 1.1 support weak, broken, or misconfigured cryptography.

Unrestricted upload of dangerous file type

Insufficiently restrictive file uploads can lead to inadvertently running malicious code.

Insecure SAML parser configuration

Comment parsing for OpenSAML2 might enable an attacker to bypass authentication.

Cross-site request forgery

Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.

Case sensitive keys in S3 object user metadata

User metadata keys are case insensitive and are returned as lowercase strings, even if they were originally specified with uppercase strings.

URL redirection to untrusted site

User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.

Use of externally-controlled input to select classes or code

Use of unsanitized external input in reflection can allow attackers to bypass security checks and run malicious code.

Missing encryption of sensitive data in storage

Sensitive data is potentially persisted into storage or passed to another service without always being encrypted.

Null pointer dereference

Dereferencing a null pointer can lead to unexpected null pointer exceptions.

Cross-site scripting

Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.

Unauthenticated LDAP requests

Unauthenticated LDAP requests can allow untrusted access to LDAP servers.

Weak obfuscation of web request

Weak obfuscation while configuring a web request

Clear text credentials

Credentials that are stored in clear text can be intercepted by a malicious actor.

Syntax error in file

Some files contain syntax errors.

Loose file permissions

Weak file permissions can lead to privilege escalation.

OS command injection

Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.

SQL injection

Use of untrusted inputs in SQL database query can enable attackers to read, modify, or delete sensitive data in the database

Object Input Stream Insecure Deserialization

Deserialization of untrusted data without sufficiently verifying that the resulting data will be valid.

Weak pseudorandom number generation

Insufficiently random generators (or hardcoded seeds) can make pseudorandom sequences predictable.

Client-side KMS reencryption

Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.