CodeGuru
Detector Library
Python detectors (128/128)
Improper privilege managementSpawning a process without main moduleInteger overflowCatch and swallow exceptionInsufficient Logging CDKUnauthenticated LDAP requestsPath traversalLoose file permissionsExposure of Sensitive Information CDKFile injectionIncorrect use of Process.terminate APIXML External EntityPytorch use nondeterministic algoritmSet SNS Return Subscription ARNTensorflow enable ops determinismOutdated subprocess module APIImproper input validationImproper authenticationMissing paginationSemaphore overflow preventionInsecure cookieUsage of an API that is not recommended - Low SeveritySocket connection timeoutAWS client not reused in a Lambda functionPytorch assign in place modLeaky subprocess timeoutPytorch disable gradient calculationRisky use of dict get methodXPath injectionMissing authorizationMultidimensional list initialization using replication is error proneSQL injectionPytorch miss call to evalImproper certificate validationURL redirection to untrusted siteMutually exclusive callNotebook best practice violationStack trace exposureUse of a deprecated methodAWS api logging disabled cdkOS command injectionAWS credentials loggedMissing Authorization CDKZip bomb attackSensitive data stored unencrypted due to partial encryptionSynchronous publication of AWS Lambda metricsUnrestricted upload of dangerous file typePytorch redundant softmaxInsecure connection using unencrypted protocolUnauthenticated Amazon SNS unsubscribe requests might succeedInsecure Socket BindInsecure CORS policyCross-site request forgeryGarbage collection prevention in multiprocessingCatch and rethrow exceptionWeak algorithm used for Password HashingMissing none check on response metadataSensitive information leakClient-side KMS reencryptionOverride of reserved variable names in a Lambda functionDocker arbitrary container runDirect dict object modificationCatastrophic backtracking regexResource management errors cdkResource leakTensorflow redundant softmaxAWS insecure transmission CDKPublic method parameter validationImproper error handlingTime zone aware datetimesPytorch control sources of randomnessDeadlocks caused by improper multiprocessing API usageLow maintainability with low class cohesionUntrusted AMI imagesNotebook invalid execution orderConfusion between equality and identity in conditional expressionPytorch sigmoid before bcelossPytorch data loader with multiple workersPytorch avoid softmax with nlllossPytorch miss call to zero gradError prone sequence modificationBad exception handlingUse of Default Credentials CDKNotebook variable redefinitionDo not pass generic exception ruleUsage of an API that is not recommended - High SeverityInsecure cryptographyS3 partial encrypt CDKCross-site scriptingMutable objects as default arguments of functionsImproper Access Control CDKViolation of PEP8 programming recommendationsInsecure temporary file or directoryComplex code hard to maintainaws kmskey encryption cdkUsage of an API that is not recommendedEnabling and overriding debug featureDeserialization of untrusted objectUse of an inefficient or incorrect APIAvoid using nondeterministic Tensorflow APIInefficient string concatenation inside loopImproper sanitization of wildcards or matching symbolsInsecure hashingUsing AutoAddPolicy or WarningPolicyLog injectionWeak obfuscation of web requestSocket close platform compatibilityUnsanitized input is run as codeBatch request with unchecked failuresInefficient polling of AWS resourceHardcoded interface bindingHardcoded IP addressHardcoded credentialsServer-side request forgeryModule injectionUnnecessary iterationTensorflow control sources of randomnessMissing Authentication for Critical Function CDKUsage of an API that is not recommended - Medium SeverityIncorrect binding of SNS publish operationsPyTorch create tensors directly on deviceInefficient new method from hashlibDangerous global variablesMultiple values in return statement is prone to errorLDAP injectionClear text credentialsMissing S3 bucket owner conditionAWS missing encryption CDK
Tag: top25-cwes
Improper privilege management
Privilege escalation happens when a malicious user gains elevated access to resources that should be unavailable to them.
Integer overflow
An integer overflow might might cause security issues when it is used for resource management or execution control.
Path traversal
Constructing path names with unsanitized user input can lead to path traversal attacks (for example,
../../..) that allow an attacker access to file system resources.Loose file permissions
Weak file permissions can lead to privilege escalation.
XML External Entity
Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.
Improper input validation
Improper input validation can enable attacks and lead to unwanted behavior.
Improper authentication
Your code doesn't sufficiently authenticate identities provided by its users.
Missing authorization
Missing authorization checks can lead to unauthorized access to a resource or performance of an action.
SQL injection
Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database
URL redirection to untrusted site
User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.
OS command injection
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
Unrestricted upload of dangerous file type
Insufficiently restrictive file uploads can lead to inadvertently running malicious code.
Insecure Socket Bind
Binding the socket with an empty IP address can introduce security risks.
Cross-site request forgery
Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.
Sensitive information leak
Exposure of sensitive information can lead to an unauthorized actor having access to the information.
Docker arbitrary container run
Passing an unsanitized user argument to a function call makes your code insecure.
Resource leak
Allocated resources are not released properly.
Public method parameter validation
Public method parameters should be validated for nullness, unexpected values, and malicious values.
Cross-site scripting
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
Deserialization of untrusted object
Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.
Weak obfuscation of web request
Weak obfuscation while configuring a web request.
Unsanitized input is run as code
Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.
Hardcoded credentials
Credentials, such as passwords and access keys, should not be hardcoded in source code.
Server-side request forgery
Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.