Privilege escalation happens when a malicious user gains elevated access to resources that should be unavailable to them.
Allocated resources are not released properly.
Public method parameters should be validated for nullness, unexpected values, and malicious values.
An integer overflow might might cause security issues when it is used for resource management or execution control.
Constructing path names with unsanitized user input can lead to path traversal attacks (for example,
../../..) that allow an attacker access to file system resources.
Weak file permissions can lead to privilege escalation.
Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.
Improper input validation can enable attacks and lead to unwanted behavior.
Your code doesn't sufficiently authenticate identities provided by its users.
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
Missing authorization checks can lead to unauthorized access to a resource or performance of an action.
Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.
Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database
User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.
Weak obfuscation while configuring a web request.
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.
Insufficiently restrictive file uploads can lead to inadvertently running malicious code.
Credentials, such as passwords and access keys, should not be hardcoded in source code.
Binding the socket with an empty IP address can introduce security risks.
Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.
Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.
Exposure of sensitive information can lead to an unauthorized actor having access to the information.
Passing an unsanitized user argument to a function call makes your code insecure.