Privilege escalation happens when a malicious user gains elevated access to resources that should be unavailable to them.
Untrusted user imports in the
importlib.import_module() function allow attacks.
Weak, broken, or misconfigured cryptography can lead to security vulnerabilities.
Lack of validation of a security certificate can lead to host impersonation and sensitive data leaks.
Improper input validation can enable attacks and lead to unwanted behavior.
Your code doesn't sufficiently authenticate identities provided by its users.
Obsolete, broken, or weak hashing algorithms can lead to security vulnerabilities.
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
WarningPolicy can allow a malicious server to impersonate a trusted server.
Stack traces can be hard to use for debugging.
Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.
Weak obfuscation while configuring a web request.
Insecure cookies can lead to unencrypted transmission of sensitive data.
Insecure ways of creating temporary files and directories can lead to race conditions, privilege escalation, and other security vulnerabilities.
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
Unauthenticated LDAP requests can allow untrusted access to LDAP servers.
Client-side decryption followed by reencryption is inefficient and can lead to sensitive data leaks.
Logging unencrypted AWS credentials can expose them to an attacker.
Constructing path names with unsanitized user input can lead to path traversal attacks (for example,
../../..) that allow an attacker access to file system resources.
Weak file permissions can lead to privilege escalation.
Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.
LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.
Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.
Credentials that are stored in clear text can be intercepted by a malicious actor.
Insufficiently restrictive file uploads can lead to inadvertently running malicious code.
Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.
Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database
Passing an unsanitized user argument to a function call makes your code insecure.
Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.
Credentials, such as passwords and access keys, should not be hardcoded in source code.
Binding the socket with an empty IP address can introduce security risks.
Cross-Origin Resource Sharing policies that are too permissive may lead to security vulnerabilities.
Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.
Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.