High

Showing all detectors for the Python language with high severity.

Improper privilege management

Privilege escalation happens when a malicious user gains elevated access to resources that should be unavailable to them.

Module injection

Untrusted user imports in the importlib.import_module() function allow attacks.

Improper certificate validation

Lack of validation of a security certificate can lead to host impersonation and sensitive data leaks.

Outdated subprocess module API

Using outdated multiprocessing API calls and parameters is not recommended.

Garbage collection prevention in multiprocessing

Passing a parent process object in a child process can prevent its garbage collection.

Mutually exclusive call

Calls to mutually exclusive methods were found in the code.

Improper authentication

Your code doesn't sufficiently authenticate identities provided by its users.

Insecure hashing

Obsolete, broken, or weak hashing algorithms can lead to security vulnerabilities.

Cross-site scripting

Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.

Missing pagination

Missing pagination on a paginated call can lead to inaccurate results.

Semaphore overflow prevention

When you process and remove an item from the JoinableQueue without calling JoinableQueue.task_done(), a semaphore overflow exception might be thrown.

Log injection

Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.

Weak obfuscation of web request

Weak obfuscation while configuring a web request.

Deadlocks caused by improper multiprocessing API usage

Improper multiprocessing API usage with wrong parameters might lead to deadlocks.

Insecure cookie

Insecure cookies can lead to unencrypted transmission of sensitive data.

OS command injection

Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.

Unauthenticated LDAP requests

Unauthenticated LDAP requests can allow untrusted access to LDAP servers.

Incorrect binding of SNS publish operations

Incorrect binding of SNS publish operations with the subscribe or create_topic operations might lead to latency issues.

Client-side KMS reencryption

Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.

Socket connection timeout

Not setting the connection timeout parameter can cause a blocking socket connection.

Complex code hard to maintain

Complex code can be difficult to read and hard to maintain.

Inefficient new method from hashlib

The constructors for the hashlib module are faster than new()

Leaky subprocess timeout

Failure to end a child process that doesn't terminate before its timeout expires can result in leaked resources.

Usage of an API that is not recommended

APIs that are not recommended were found.

AWS credentials logged

Logging unencrypted AWS credentials can expose them to an attacker.

Path traversal

Constructing path names with unsanitized user input can lead to path traversal attacks (for example, ../../..) that allow an attacker access to file system resources.

Loose file permissions

Weak file permissions can lead to privilege escalation.

Socket close platform compatibility

The os.close() does not work on some platforms.

Zip bomb attack

Expanding unsanitized archive files taken as input can lead to zip bomb attacks.

Unsanitized input is run as code

Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.

LDAP injection

LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.

XPath injection

Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.

Error prone sequence modification

Sequence modification while iterating over it might cause unexpected bugs.

Clear text credentials

Credentials that are stored in clear text can be intercepted by a malicious actor.

Unrestricted upload of dangerous file type

Insufficiently restrictive file uploads can lead to inadvertently running malicious code.

Deserialization of untrusted object

Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.

Multidimensional list initialization using replication is error prone

list replication using replication operator creates references to the existing objects, not copies, which could introduce bugs.

Inefficient polling of AWS resource

Custom polling can be inefficient and prone to error. Consider using AWS waiters instead.

Override of reserved variable names in a Lambda function

Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.

SQL injection

Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database

Missing S3 bucket owner condition

Not setting the S3 bucket owner condition might introduce a risk of accidentally using a wrong bucket.

Insecure connection using unencrypted protocol

Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.

Direct dict object modification

Directly modifying the dict object might cause undesirable behavior due to symbol table modification.

Incorrect use of Process.terminate API

The Process.terminate API might cause data corruption of shared resources.

Unauthenticated Amazon SNS unsubscribe requests might succeed

Failing to set the AuthenticateOnUnsubscribe flag to True when confirming an SNS subscription can lead to unauthenticated cancellations.

Cross-site request forgery

Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.

XML External Entity

Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.