High
Showing all detectors for the Python language with high severity.
Privilege escalation happens when a malicious user gains elevated access to resources that should be unavailable to them.
Untrusted user imports in the importlib.import_module()
function allow attacks.
Lack of validation of a security certificate can lead to host impersonation and sensitive data leaks.
Using outdated multiprocessing API calls and parameters is not recommended.
Passing a parent process object in a child process can prevent its garbage collection.
Calls to mutually exclusive methods were found in the code.
Your code doesn't sufficiently authenticate identities provided by its users.
Obsolete, broken, or weak hashing algorithms can lead to security vulnerabilities.
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
Missing pagination on a paginated call can lead to inaccurate results.
When you process and remove an item from the JoinableQueue
without calling JoinableQueue.task_done()
, a semaphore overflow exception might be thrown.
Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.
Weak obfuscation while configuring a web request.
Improper multiprocessing API usage with wrong parameters might lead to deadlocks.
Insecure cookies can lead to unencrypted transmission of sensitive data.
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
Unauthenticated LDAP requests can allow untrusted access to LDAP servers.
Incorrect binding of SNS publish operations with the subscribe
or create_topic
operations might lead to latency issues.
Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.
Not setting the connection timeout parameter can cause a blocking socket connection.
Complex code can be difficult to read and hard to maintain.
The constructors for the hashlib
module are faster than new()
Failure to end a child process that doesn't terminate before its timeout expires can result in leaked resources.
APIs that are not recommended were found.
Logging unencrypted AWS credentials can expose them to an attacker.
Constructing path names with unsanitized user input can lead to path traversal attacks (for example, ../../..
) that allow an attacker access to file system resources.
Weak file permissions can lead to privilege escalation.
The os.close()
does not work on some platforms.
Expanding unsanitized archive files taken as input can lead to zip bomb attacks.
Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.
LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.
Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.
Sequence modification while iterating over it might cause unexpected bugs.
Credentials that are stored in clear text can be intercepted by a malicious actor.
Insufficiently restrictive file uploads can lead to inadvertently running malicious code.
Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.
list
replication using replication operator creates references to the existing objects, not copies, which could introduce bugs.
Custom polling can be inefficient and prone to error. Consider using AWS waiters instead.
Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.
Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database
Not setting the S3 bucket owner condition might introduce a risk of accidentally using a wrong bucket.
Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.
Directly modifying the dict object might cause undesirable behavior due to symbol table modification.
The Process.terminate
API might cause data corruption of shared resources.
Failing to set the AuthenticateOnUnsubscribe
flag to True
when confirming an SNS subscription can lead to unauthenticated cancellations.
Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.
Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.