Amazon QDetector Library Sign in to Amazon Q

Q

Detector Library

TypeScript detectors (104/104)

Integer overflow AWS insecure transmission CDK Insecure cookie AWS credentials logged SQL injection Insecure connection using unencrypted protocol New function detected Batch request with unchecked failures Unvalidated expansion of archive files Missing pagination XPath injection Logging of sensitive information Override of reserved variable names in a Lambda function Insecure CORS policy Improper input validation Hardcoded credentials Invoke super appropriately Numeric truncation error Avoid nan in comparison Missing check on method output Insufficiently protected credentials Improper restriction of rendered UI layers or frames Pseudorandom number generators AWS missing encryption CDK Catch and swallow exception Header injection Use {} instead of new Object()Hardcoded IP address Untrusted Amazon Machine Images Weak obfuscation of web requests File Race Bad Improper certificate validation Sendfile injection Cryptographic key generator improper input validation cdk XML external entity Timing attack Missing Amazon S3 bucket owner condition Insecure hashing Session fixation Use of Default Credentials CDK File injection Improper Restriction of Operations within the Bounds of a Memory Buffer Limit request length Log injection Type confusion Server side request forgery aws kmskey encryption cdk Inefficient polling of AWS resource Avoid Undefined As Variable Name Index of method comparison String passed to `setInterval` or `setTimeout`Data loss in a batch request Tainted input for Docker API Insecure temporary file or directory Check failed records when using kinesis AWS api logging disabled cdk Improper Access Control CDK Least privilege violation File extension validation Resource leak Set SNS Return Subscription ARN Insecure object attribute modification Missing Authentication for Critical Function CDK Typeof expression AWS missing encryption of sensitive data cdk Unauthenticated Amazon SNS unsubscribe requests might succeed Cross-site request forgery Client-side KMS reencryption Insecure cryptography Deserialization of untrusted object Clear text credentials Improper handling of case sensitivity Unsanitized input is run as code Protection mechanism failure Use of a deprecated method Sensitive information leak DNS prefetching Exposure of Sensitive Information CDK Insecure JWT parsing Loose file permissions Missing Authorization CDK Sensitive query string Insufficient Logging CDK OS command injection NoSQL injection Unverified hostname Path traversal Origins-verified cross-origin communications LDAP injection SNS don't bind subscribe and publish S3 partial encrypt CDK Non-literal regular expression Stack trace exposure File and directory information exposure Usage of an API that is not recommended Lazy Load Module Disabled HTML autoescape Improper access control Cross-site scripting Sensitive data stored unencrypted due to partial encryption AWS client not reused in a Lambda function URL redirection to untrusted site Untrusted data in security decision

Tag: injection

SQL injection

The use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database.

New function detected

Use of new Function() can be dangerous if used to evaluate dynamic content.

XPath injection

Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.

Improper input validation

Improper input validation can enable attacks and lead to unwanted behavior.

Header injection

Constructing HTTP response headers from user-controlled data is unsafe.

Untrusted Amazon Machine Images

Improper filtering of Amazon Machine Images (AMIs) can result in loading an untrusted image, which is a potential security vulnerability.

XML external entity

Objects that parse or handle XML can lead to XML external entity (XXE) attacks when they are misconfigured.

File injection

Writing unsanitized user data to a file is unsafe.

Log injection

Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.

Server side request forgery

Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.

Cross-site request forgery

Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.

Deserialization of untrusted object

Deserialization of untrusted objects can lead to security vulnerabilities such as, inadvertently running remote code.

Unsanitized input is run as code

Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.

OS command injection

Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.

NoSQL injection

User input can be vulnerable to injection attacks.

Path traversal

Creating file paths from untrusted input might give a malicious actor access to sensitive files.

LDAP injection

LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.

Cross-site scripting

Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.

Untrusted data in security decision

Security decisions should not depend on branching that can be influenced by untrusted or client-provided data.