Tag: top25-cwes

Improper privilege management

Privilege escalation happens when a malicious user gains elevated access to resources that should be unavailable to them.

Resource leak

Allocated resources are not released properly.

URL redirection to untrusted site

User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.

Integer overflow

An integer overflow might might cause security issues when it is used for resource management or execution control.

Weak obfuscation of web request

Weak obfuscation while configuring a web request.

OS command injection

Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.

Path traversal

Constructing path names with unsanitized user input can lead to path traversal attacks (for example, ../../..) that allow an attacker access to file system resources.

Loose file permissions

Weak file permissions can lead to privilege escalation.

Unsanitized input is run as code

Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.

Unrestricted upload of dangerous file type

Insufficiently restrictive file uploads can lead to inadvertently running malicious code.

Hardcoded credentials

Credentials, such as passwords and access keys, should not be hardcoded in source code.

Insecure Socket Bind

Binding the socket with an empty IP address can introduce security risks.

XML External Entity

Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.

Cross-site request forgery

Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.

Improper input validation

Improper input validation can enable attacks and lead to unwanted behavior.

Improper authentication

Your code doesn't sufficiently authenticate identities provided by its users.

Cross-site scripting

Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.

Deserialization of untrusted object

Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.

SQL injection

Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database

Docker arbitrary container run

Passing an unsanitized user argument to a function call makes your code insecure.