CodeGuru
Detector Library
Python detectors (123/123)
Improper privilege managementResource leakTensorflow redundant softmaxAWS insecure transmission CDKSpawning a process without main modulePublic method parameter validationImproper error handlingInteger overflowTime zone aware datetimesCatch and swallow exceptionPytorch control sources of randomnessDeadlocks caused by improper multiprocessing API usageUnauthenticated LDAP requestsLow maintainability with low class cohesionUntrusted AMI imagesNotebook invalid execution orderConfusion between equality and identity in conditional expressionPytorch sigmoid before bcelossPath traversalLoose file permissionsPytorch data loader with multiple workersPytorch avoid softmax with nlllossPytorch miss call to zero gradError prone sequence modificationBad exception handlingUse of Default Credentials CDKExposure of Sensitive Information CDKFile injectionIncorrect use of Process.terminate APIXML External EntityNotebook variable redefinitionPytorch use nondeterministic algoritmSet SNS Return Subscription ARNDo not pass generic exception ruleUsage of an API that is not recommended - High SeverityInsecure cryptographyTensorflow enable ops determinismOutdated subprocess module APIS3 partial encrypt CDKImproper input validationImproper authenticationCross-site scriptingMissing paginationSemaphore overflow preventionMutable objects as default arguments of functionsInsecure cookieViolation of PEP8 programming recommendationsInsecure temporary file or directoryUsage of an API that is not recommended - Low SeveritySocket connection timeoutAWS client not reused in a Lambda functionPytorch assign in place modComplex code hard to maintainLeaky subprocess timeoutUsage of an API that is not recommendedPytorch disable gradient calculationEnabling and overriding debug featureRisky use of dict get methodXPath injectionMissing authorizationDeserialization of untrusted objectUse of an inefficient or incorrect APIMultidimensional list initialization using replication is error proneSQL injectionAvoid using nondeterministic Tensorflow APIPytorch miss call to evalInefficient string concatenation inside loopImproper sanitization of wildcards or matching symbolsImproper certificate validationURL redirection to untrusted siteMutually exclusive callInsecure hashingNotebook best practice violationStack trace exposureUsing AutoAddPolicy or WarningPolicyUse of a deprecated methodLog injectionWeak obfuscation of web requestAWS api logging disabled cdkOS command injectionAWS credentials loggedSocket close platform compatibilityZip bomb attackUnsanitized input is run as codeSensitive data stored unencrypted due to partial encryptionSynchronous publication of AWS Lambda metricsBatch request with unchecked failuresUnrestricted upload of dangerous file typePytorch redundant softmaxInefficient polling of AWS resourceHardcoded interface bindingHardcoded IP addressInsecure connection using unencrypted protocolUnauthenticated Amazon SNS unsubscribe requests might succeedHardcoded credentialsInsecure Socket BindInsecure CORS policyCross-site request forgeryServer-side request forgeryModule injectionUnnecessary iterationTensorflow control sources of randomnessGarbage collection prevention in multiprocessingCatch and rethrow exceptionWeak algorithm used for Password HashingMissing Authentication for Critical Function CDKUsage of an API that is not recommended - Medium SeverityMissing none check on response metadataSensitive information leakIncorrect binding of SNS publish operationsClient-side KMS reencryptionPyTorch create tensors directly on deviceInefficient new method from hashlibDangerous global variablesMultiple values in return statement is prone to errorLDAP injectionClear text credentialsOverride of reserved variable names in a Lambda functionDocker arbitrary container runMissing S3 bucket owner conditionDirect dict object modificationCatastrophic backtracking regexAWS missing encryption CDK
Tag: top25-cwes
Improper privilege management
Privilege escalation happens when a malicious user gains elevated access to resources that should be unavailable to them.
Resource leak
Allocated resources are not released properly.
Public method parameter validation
Public method parameters should be validated for nullness, unexpected values, and malicious values.
Integer overflow
An integer overflow might might cause security issues when it is used for resource management or execution control.
Path traversal
Constructing path names with unsanitized user input can lead to path traversal attacks (for example,
../../..) that allow an attacker access to file system resources.Loose file permissions
Weak file permissions can lead to privilege escalation.
XML External Entity
Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.
Improper input validation
Improper input validation can enable attacks and lead to unwanted behavior.
Improper authentication
Your code doesn't sufficiently authenticate identities provided by its users.
Cross-site scripting
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
Missing authorization
Missing authorization checks can lead to unauthorized access to a resource or performance of an action.
Deserialization of untrusted object
Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.
SQL injection
Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database
URL redirection to untrusted site
User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.
Weak obfuscation of web request
Weak obfuscation while configuring a web request.
OS command injection
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
Unsanitized input is run as code
Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.
Unrestricted upload of dangerous file type
Insufficiently restrictive file uploads can lead to inadvertently running malicious code.
Hardcoded credentials
Credentials, such as passwords and access keys, should not be hardcoded in source code.
Insecure Socket Bind
Binding the socket with an empty IP address can introduce security risks.
Cross-site request forgery
Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.
Server-side request forgery
Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.
Sensitive information leak
Exposure of sensitive information can lead to an unauthorized actor having access to the information.
Docker arbitrary container run
Passing an unsanitized user argument to a function call makes your code insecure.