CodeGuru
Detector Library
Python detectors (86/86)
Improper privilege managementResource leakInefficient string concatenation inside loopSpawning a process without main moduleImproper sanitization of wildcards or matching symbolsImproper certificate validationURL redirection to untrusted siteInteger overflowMutually exclusive callTime zone aware datetimesCatch and swallow exceptionInsecure hashingStack trace exposureUsing AutoAddPolicy or WarningPolicyUse of a deprecated methodLog injectionWeak obfuscation of web requestDeadlocks caused by improper multiprocessing API usageOS command injectionUnauthenticated LDAP requestsLow maintainability with low class cohesionUntrusted AMI imagesConfusion between equality and identity in conditional expressionPath traversalAWS credentials loggedLoose file permissionsSocket close platform compatibilityZip bomb attackUnsanitized input is run as codeSensitive data stored unencrypted due to partial encryptionSynchronous publication of AWS Lambda metricsError prone sequence modificationBatch request with unchecked failuresBad exception handlingUnrestricted upload of dangerous file typeInefficient polling of AWS resourceHardcoded IP addressInsecure connection using unencrypted protocolIncorrect use of Process.terminate APIUnauthenticated Amazon SNS unsubscribe requests might succeedHardcoded credentialsInsecure Socket BindXML External EntityInsecure CORS policyCross-site request forgerySet SNS Return Subscription ARNDo not pass generic exception ruleUnnecessary iterationInsecure cryptographyOutdated subprocess module APIGarbage collection prevention in multiprocessingCatch and rethrow exceptionImproper input validationImproper authenticationCross-site scriptingMissing none check on response metadataMissing paginationSemaphore overflow preventionMutable objects as default arguments of functionsInsecure cookieViolation of PEP8 programming recommendationsInsecure temporary file or directoryIncorrect binding of SNS publish operationsClient-side KMS reencryptionSocket connection timeoutAWS client not reused in a Lambda functionComplex code hard to maintainInefficient new method from hashlibLeaky subprocess timeoutUsage of an API that is not recommendedDangerous global variablesEnabling and overriding debug featureRisky use of dict get methodMultiple values in return statement is prone to errorLDAP injectionXPath injectionClear text credentialsDeserialization of untrusted objectUse of an inefficient or incorrect APIMultidimensional list initialization using replication is error proneOverride of reserved variable names in a Lambda functionSQL injectionDocker arbitrary container runMissing S3 bucket owner conditionDirect dict object modificationCatastrophic backtracking regex
Tag: top25-cwes
Improper privilege management
Privilege escalation happens when a malicious user gains elevated access to resources that should be unavailable to them.
Resource leak
Allocated resources are not released properly.
URL redirection to untrusted site
User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.
Integer overflow
An integer overflow might might cause security issues when it is used for resource management or execution control.
Weak obfuscation of web request
Weak obfuscation while configuring a web request.
OS command injection
Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.
Path traversal
Constructing path names with unsanitized user input can lead to path traversal attacks (for example,
../../..) that allow an attacker access to file system resources.Loose file permissions
Weak file permissions can lead to privilege escalation.
Unsanitized input is run as code
Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.
Unrestricted upload of dangerous file type
Insufficiently restrictive file uploads can lead to inadvertently running malicious code.
Hardcoded credentials
Credentials, such as passwords and access keys, should not be hardcoded in source code.
Insecure Socket Bind
Binding the socket with an empty IP address can introduce security risks.
XML External Entity
Objects that parse or handle XML can lead to XML External Entity (XXE) attacks when misconfigured.
Cross-site request forgery
Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.
Improper input validation
Improper input validation can enable attacks and lead to unwanted behavior.
Improper authentication
Your code doesn't sufficiently authenticate identities provided by its users.
Cross-site scripting
Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.
Deserialization of untrusted object
Deserialization of untrusted objects can lead to security vulnerabilities such as inadvertently running remote code.
SQL injection
Use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database
Docker arbitrary container run
Passing an unsanitized user argument to a function call makes your code insecure.