Tag: access-control

Error-prone AWS IAM policy creation

Manually creating text-based IAM policies is error-prone.

Missing Authorization for address id

Rule to detect lack of authorization check when using address ID.

Not recommended aws credentials classes

Find usages of not recommended classes for AWS Credentials and suggest replacing them with something else.

Insecure JSON web token (JWT) parsing

JWTs should not be parsed using the parse method.

Insecure SAML parser configuration

Comment parsing for OpenSAML2 might enable an attacker to bypass authentication.

Unauthenticated LDAP requests

Unauthenticated LDAP requests can allow untrusted access to LDAP servers.

Clear text credentials

Credentials that are stored in clear text can be intercepted by a malicious actor.

Session fixation

Session fixation might allow an attacker to steal authenticated session IDs.

Loose file permissions

Weak file permissions can lead to privilege escalation.