Your go-to resource for comprehensive remediation guidance to address source code vulnerabilities across various programming languages. This section serves as a compass, offering tailored solutions and practices to fortify your code.

The programming languages that you will see in this guide are:

Index

• Aws

  • 005. Privilege escalation
  • 016. Insecure encryption algorithm - SSL/TLS
  • 024. Unrestricted access between network segments - AWS
  • 031. Excessive privileges - AWS
  • 047. Automatic information enumeration
  • 050. Guessed weak credentials
  • 070. Insecure service configuration - ELB
  • 073. Improper authorization control for web services - RDS
  • 099. Non-encrypted confidential information - S3 Server Side Encryption
  • 109. Unrestricted access between network segments - RDS
  • 165. Insecure service configuration - AWS
  • 177. Insecure service configuration - Security Groups
  • 181. Insecure service configuration - DynamoDB
  • 202. Unauthorized access to files - Debug APK
  • 203. Unauthorized access to files - S3 Bucket
  • 214. Business information leak - Credentials
  • 224. Business information leak - AWS
  • 241. Authentication mechanism absence or evasion - AWS
  • 246. Non-encrypted confidential information - DB
  • 247. Non-encrypted confidential information - AWS
  • 250. Non-encrypted hard drives
  • 252. Automatic information enumeration - Open ports
  • 253. Automatic information enumeration - AWS
  • 256. Lack of protection against deletion - RDS
  • 257. Lack of protection against deletion - EC2
  • 258. Lack of protection against deletion - ELB
  • 259. Lack of protection against deletion - DynamoDB
  • 277. Weak credential policy - Password Expiration
  • 281. Use of an insecure channel - AWS
  • 325. Excessive privileges - Wildcards
  • 333. Insecure service configuration - EC2
  • 334. Insecure service configuration - IAM
  • 335. Insecure service configuration - Bucket
  • 363. Weak credential policy - Password strength
  • 364. Weak credential policy - Temporary passwords
  • 372. Use of an insecure channel - HTTP
  • 378. Non-encrypted confidential information - Hexadecimal
  • 394. Insufficient data authenticity validation - Cloudtrail Logs
  • 396. Insecure service configuration - KMS
  • 399. Security controls absence - Monitoring
  • 400. Traceability Loss - AWS
  • 406. Non-encrypted confidential information - EFS
  • 407. Non-encrypted confidential information - EBS Volumes
  • 408. Traceability Loss - API Gateway
  • 409. Non-encrypted confidential information - DynamoDB
  • 411. Insecure encryption algorithm - Default encryption
  • 430. Serverless - one dedicated IAM role per function
  • 433. Non-encrypted confidential information - Redshift Cluster

• Azure

  • 015. Insecure authentication method - Basic
  • 016. Insecure encryption algorithm - SSL/TLS
  • 101. Lack of protection against deletion
  • 157. Unrestricted access between network segments
  • 158. Unrestricted access between network segments - Azure AD
  • 225. Business information leak - Azure
  • 300. Authentication mechanism absence or evasion - Azure
  • 372. Use of an insecure channel - HTTP
  • 401. Insecure service configuration - AKV Secret Expiration
  • 402. Traceability Loss - Azure
  • 412. Lack of protection against deletion - Azure Key Vault

• Csharp

  • 001. SQL injection - C Sharp SQL API
  • 002. Asymmetric denial of service
  • 003. Symmetric denial of service
  • 004. Remote command execution
  • 005. Privilege escalation
  • 006. Authentication mechanism absence or evasion
  • 007. Cross-site request forgery
  • 008. Reflected cross-site scripting (XSS)
  • 010. Stored cross-site scripting (XSS)
  • 013. Insecure object reference
  • 014. Insecure functionality
  • 015. Insecure authentication method - Basic
  • 017. Sensitive information sent insecurely
  • 020. Non-encrypted confidential information
  • 021. XPath injection
  • 023. Uncontrolled external site redirect - Host Header Injection
  • 026. User enumeration
  • 027. Insecure file upload
  • 028. Insecure temporary files
  • 029. Inadequate file size control
  • 030. Sensitive information sent via URL parameters
  • 033. Password change without identity check
  • 034. Insecure generation of random numbers
  • 038. Business information leak
  • 039. Improper authorization control for web services
  • 040. Exposed web services
  • 041. Enabled default credentials
  • 042. Insecurely generated cookies
  • 043. Insecure or unset HTTP headers - Content-Security-Policy
  • 047. Automatic information enumeration
  • 050. Guessed weak credentials
  • 051. Cracked weak credentials
  • 052. Insecure encryption algorithm
  • 053. Lack of protection against brute force attacks
  • 057. Asymmetric denial of service - Content length
  • 059. Sensitive information stored in logs
  • 062. Concurrent sessions
  • 063. Lack of data validation - Path Traversal
  • 064. Traceability loss - Server's clock
  • 065. Cached form fields
  • 066. Technical information leak - Console functions
  • 067. Improper resource allocation
  • 068. Insecure session expiration time
  • 071. Insecure or unset HTTP headers - Referrer-Policy
  • 076. Insecure session management
  • 078. Insecurely generated token
  • 080. Business information leak - Customers or providers
  • 081. Lack of multi-factor authentication
  • 083. XML injection (XXE)
  • 085. Sensitive data stored in client-side storage
  • 087. Account lockout
  • 088. Privacy violation
  • 089. Lack of data validation - Trust boundary violation
  • 090. CSV injection
  • 091. Log injection
  • 092. Insecure encryption algorithm - Anonymous cipher suites
  • 093. Hidden fields manipulation
  • 094. Insecure encryption algorithm - Cipher Block Chaining
  • 095. Data uniqueness not properly verified
  • 096. Insecure deserialization
  • 098. External control of file name or path
  • 100. Server-side request forgery (SSRF)
  • 101. Lack of protection against deletion
  • 102. Email uniqueness not properly verified
  • 106. NoSQL injection
  • 107. LDAP injection
  • 108. Improper control of interaction frequency
  • 111. Out-of-bounds read
  • 113. Improper type assignation
  • 115. Security controls bypass or absence
  • 117. Unverifiable files
  • 118. Regulation infringement
  • 119. Metadata with sensitive information
  • 121. HTTP parameter pollution
  • 123. Local file inclusion
  • 124. Race condition
  • 127. Lack of data validation - Type confusion
  • 128. Insecurely generated cookies - HttpOnly
  • 129. Insecurely generated cookies - SameSite
  • 130. Insecurely generated cookies - Secure
  • 131. Insecure or unset HTTP headers - Strict Transport Security
  • 132. Insecure or unset HTTP headers - X-Content-Type-Options
  • 133. Insecure encryption algorithm - Perfect Forward Secrecy
  • 134. Insecure or unset HTTP headers - CORS
  • 135. Insecure or unset HTTP headers - X-XSS Protection
  • 136. Insecure or unset HTTP headers - Cache Control
  • 138. Inappropriate coding practices
  • 140. Insecure exceptions - Empty or no catch
  • 141. Lack of data validation - URL
  • 142. Sensitive information in source code - API Key
  • 143. Inappropriate coding practices - Eval function
  • 145. Inappropriate coding practices - Cyclomatic complexity
  • 146. SQL injection
  • 148. Use of an insecure channel - FTP
  • 149. Use of an insecure channel - SMTP
  • 151. Use of an insecure channel - Telnet
  • 152. Insecure or unset HTTP headers - X-Frame Options
  • 153. Insecure or unset HTTP headers - Accept
  • 155. SQL Injection - Headers
  • 156. Uncontrolled external site redirect
  • 160. Excessive privileges - Temporary Files
  • 164. Insecure service configuration
  • 183. Debugging enabled in production
  • 184. Lack of data validation
  • 185. Lack of data validation - Header x-amzn-RequestId
  • 186. Lack of data validation - Web Service
  • 187. Lack of data validation - Source Code
  • 190. Lack of data validation - Session Cookie
  • 191. Lack of data validation - Responses
  • 192. Lack of data validation - Reflected Parameters
  • 193. Lack of data validation - Host Header Injection
  • 194. Lack of data validation - Input Length
  • 195. Lack of data validation - Headers
  • 196. Lack of data validation - Dates
  • 197. Lack of data validation - Numbers
  • 198. Lack of data validation - Out of range
  • 199. Lack of data validation - Emails
  • 201. Unauthorized access to files
  • 204. Insufficient data authenticity validation
  • 211. Asymmetric denial of service - ReDoS
  • 213. Business information leak - JWT
  • 214. Business information leak - Credentials
  • 217. Business information leak - Credit Cards
  • 220. Business information leak - Token
  • 221. Business information leak - Users
  • 226. Business information leak - Personal Information
  • 228. Business information leak - Analytics
  • 231. Message flooding
  • 233. Incomplete funcional code
  • 234. Technical information leak - Stacktrace
  • 235. Technical information leak - Headers
  • 236. Technical information leak - SourceMap
  • 237. Technical information leak - Print Functions
  • 238. Technical information leak - API
  • 239. Technical information leak - Errors
  • 240. Authentication mechanism absence or evasion - OTP
  • 245. Non-encrypted confidential information - Credit Cards
  • 248. Non-encrypted confidential information - LDAP
  • 249. Non-encrypted confidential information - Credentials
  • 254. Automatic information enumeration - Credit Cards
  • 255. Insecure functionality - Pass the hash
  • 261. Insecure encryption algorithm - DSA
  • 262. Insecure encryption algorithm - SHA1
  • 263. Insecure encryption algorithm - MD5
  • 264. Insecure encryption algorithm - TripleDES
  • 265. Insecure encryption algorithm - AES
  • 269. Insecure encryption algorithm - Blowfish
  • 270. Insecure functionality - File Creation
  • 271. Insecure functionality - Password management
  • 272. Insecure functionality - Masking
  • 273. Insecure functionality - Fingerprint
  • 274. Restricted fields manipulation
  • 275. Non-encrypted confidential information - Local data
  • 276. Sensitive information sent via URL parameters - Session
  • 278. Insecure exceptions - NullPointerException
  • 280. Session Fixation
  • 282. Insecure encryption algorithm - ECB
  • 283. Automatic information enumeration - Personal Information
  • 284. Non-encrypted confidential information - Base 64
  • 286. Insecure object reference - Personal information
  • 287. Insecure object reference - Corporate information
  • 288. Insecure object reference - Financial information
  • 289. Technical information leak - Logs
  • 290. Technical information leak - IPs
  • 291. Business information leak - Financial Information
  • 295. Insecure session management - Change Password
  • 296. Weak credential policy - Password Change Limit
  • 297. SQL injection - Code
  • 298. Authentication mechanism absence or evasion - Redirect
  • 301. Concurrent sessions control bypass
  • 302. Insecure functionality - Session management
  • 305. Security controls bypass or absence - Data creation
  • 306. Insecure object reference - Files
  • 307. Insecure object reference - Data
  • 308. Enabled default configuration
  • 316. Improper resource allocation - Buffer overflow
  • 317. Improper resource allocation - Memory leak
  • 318. Insecurely generated token - Validation
  • 321. Lack of data validation - HTML code
  • 322. Insecurely generated token - Lifespan
  • 324. Insecure functionality - User management
  • 328. Insecure object reference - Session management
  • 329. Insecure or unset HTTP headers - Content-Type
  • 330. Lack of protection against brute force attacks - Credentials
  • 332. Use of insecure channel - Source code
  • 336. Business information leak - Corporate information
  • 337. Insecure session management - CSRF Fixation
  • 340. Lack of data validation - Special Characters
  • 341. Lack of data validation - OTP
  • 344. Lack of data validation - Non Sanitized Variables
  • 345. Security controls bypass or absence - Session Invalidation
  • 349. Technical information leak - Credentials
  • 350. Insecure digital certificates - Chain of trust
  • 351. Automatic information enumeration - Corporate information
  • 353. Lack of data validation - Token
  • 354. Insecure file upload - Files Limit
  • 355. Insufficient data authenticity validation - Checksum verification
  • 356. Symmetric denial of service - SMTP
  • 357. Symmetric denial of service - FTP
  • 359. Sensitive information in source code - Credentials
  • 363. Weak credential policy - Password strength
  • 364. Weak credential policy - Temporary passwords
  • 365. Authentication mechanism absence or evasion - Response tampering
  • 369. Insecure object reference - User deletion
  • 371. DOM-Based cross-site scripting (XSS)
  • 372. Use of an insecure channel - HTTP
  • 377. Insufficient data authenticity validation - Device Binding
  • 378. Non-encrypted confidential information - Hexadecimal
  • 382. Insufficient data authenticity validation - Front bypass
  • 383. Insecurely generated token - OTP
  • 388. Insecure authentication method - NTLM
  • 391. Inappropriate coding practices - Unused properties
  • 393. Use of software with known vulnerabilities in development
  • 395. Insecure generation of random numbers - Static IV
  • 404. OS Command Injection
  • 405. Excessive privileges - Access Mode
  • 411. Insecure encryption algorithm - Default encryption
  • 413. Insecure file upload - DLL Injection
  • 416. XAML injection
  • 417. Account Takeover
  • 420. Password reset poisoning
  • 421. Insecure encryption algorithm - Insecure Elliptic Curve
  • 422. Server side template injection
  • 425. Server side cross-site scripting
  • 428. Inappropriate coding practices - invalid file
  • 432. Inappropriate coding practices - relative path command
  • 435. Use of software with known vulnerabilities in environments
  • 436. Security controls bypass or absence - Fingerprint

• Dart

  • 003. Symmetric denial of service
  • 004. Remote command execution
  • 006. Authentication mechanism absence or evasion
  • 007. Cross-site request forgery
  • 009. Sensitive information in source code
  • 011. Use of software with known vulnerabilities
  • 013. Insecure object reference
  • 014. Insecure functionality
  • 017. Sensitive information sent insecurely
  • 020. Non-encrypted confidential information
  • 021. XPath injection
  • 022. Use of an insecure channel
  • 028. Insecure temporary files
  • 033. Password change without identity check
  • 034. Insecure generation of random numbers
  • 036. ViewState not encrypted
  • 039. Improper authorization control for web services
  • 042. Insecurely generated cookies
  • 043. Insecure or unset HTTP headers - Content-Security-Policy
  • 052. Insecure encryption algorithm
  • 053. Lack of protection against brute force attacks
  • 059. Sensitive information stored in logs
  • 060. Insecure service configuration - Host verification
  • 066. Technical information leak - Console functions
  • 067. Improper resource allocation
  • 068. Insecure session expiration time
  • 071. Insecure or unset HTTP headers - Referrer-Policy
  • 076. Insecure session management
  • 078. Insecurely generated token
  • 079. Non-upgradable dependencies
  • 088. Privacy violation
  • 089. Lack of data validation - Trust boundary violation
  • 091. Log injection
  • 092. Insecure encryption algorithm - Anonymous cipher suites
  • 094. Insecure encryption algorithm - Cipher Block Chaining
  • 095. Data uniqueness not properly verified
  • 096. Insecure deserialization
  • 098. External control of file name or path
  • 102. Email uniqueness not properly verified
  • 106. NoSQL injection
  • 108. Improper control of interaction frequency
  • 113. Improper type assignation
  • 115. Security controls bypass or absence
  • 118. Regulation infringement
  • 119. Metadata with sensitive information
  • 120. Improper dependency pinning
  • 124. Race condition
  • 127. Lack of data validation - Type confusion
  • 128. Insecurely generated cookies - HttpOnly
  • 129. Insecurely generated cookies - SameSite
  • 130. Insecurely generated cookies - Secure
  • 132. Insecure or unset HTTP headers - X-Content-Type-Options
  • 133. Insecure encryption algorithm - Perfect Forward Secrecy
  • 134. Insecure or unset HTTP headers - CORS
  • 137. Insecure or unset HTTP headers - X-Permitted-Cross-Domain-Policies
  • 138. Inappropriate coding practices
  • 140. Insecure exceptions - Empty or no catch
  • 141. Lack of data validation - URL
  • 142. Sensitive information in source code - API Key
  • 143. Inappropriate coding practices - Eval function
  • 145. Inappropriate coding practices - Cyclomatic complexity
  • 147. Insecure encryption algorithm - SSLContext
  • 150. Use of an insecure channel - useSslProtocol()
  • 153. Insecure or unset HTTP headers - Accept
  • 156. Uncontrolled external site redirect
  • 160. Excessive privileges - Temporary Files
  • 164. Insecure service configuration
  • 169. Insecure service configuration - Keys
  • 183. Debugging enabled in production
  • 184. Lack of data validation
  • 185. Lack of data validation - Header x-amzn-RequestId
  • 187. Lack of data validation - Source Code
  • 190. Lack of data validation - Session Cookie
  • 191. Lack of data validation - Responses
  • 192. Lack of data validation - Reflected Parameters
  • 194. Lack of data validation - Input Length
  • 195. Lack of data validation - Headers
  • 196. Lack of data validation - Dates
  • 197. Lack of data validation - Numbers
  • 199. Lack of data validation - Emails
  • 201. Unauthorized access to files
  • 204. Insufficient data authenticity validation
  • 211. Asymmetric denial of service - ReDoS
  • 213. Business information leak - JWT
  • 216. Business information leak - Source Code
  • 217. Business information leak - Credit Cards
  • 220. Business information leak - Token
  • 222. Business information leak - DB
  • 226. Business information leak - Personal Information
  • 230. Business information leak - Firestore
  • 233. Incomplete funcional code
  • 234. Technical information leak - Stacktrace
  • 236. Technical information leak - SourceMap
  • 237. Technical information leak - Print Functions
  • 240. Authentication mechanism absence or evasion - OTP
  • 243. Authentication mechanism absence or evasion - Admin Console
  • 246. Non-encrypted confidential information - DB
  • 248. Non-encrypted confidential information - LDAP
  • 249. Non-encrypted confidential information - Credentials
  • 254. Automatic information enumeration - Credit Cards
  • 269. Insecure encryption algorithm - Blowfish
  • 270. Insecure functionality - File Creation
  • 271. Insecure functionality - Password management
  • 272. Insecure functionality - Masking
  • 273. Insecure functionality - Fingerprint
  • 275. Non-encrypted confidential information - Local data
  • 276. Sensitive information sent via URL parameters - Session
  • 278. Insecure exceptions - NullPointerException
  • 282. Insecure encryption algorithm - ECB
  • 283. Automatic information enumeration - Personal Information
  • 286. Insecure object reference - Personal information
  • 288. Insecure object reference - Financial information
  • 294. Insecure service configuration - OTP
  • 295. Insecure session management - Change Password
  • 298. Authentication mechanism absence or evasion - Redirect
  • 302. Insecure functionality - Session management
  • 305. Security controls bypass or absence - Data creation
  • 306. Insecure object reference - Files
  • 307. Insecure object reference - Data
  • 308. Enabled default configuration
  • 309. Insecurely generated token - JWT
  • 313. Insecure service configuration - Certificates
  • 317. Improper resource allocation - Memory leak
  • 318. Insecurely generated token - Validation
  • 319. Insecure service configuration - Roles
  • 321. Lack of data validation - HTML code
  • 322. Insecurely generated token - Lifespan
  • 324. Insecure functionality - User management
  • 326. Sensitive information in source code - Dependencies
  • 327. Insufficient data authenticity validation - Images
  • 328. Insecure object reference - Session management
  • 329. Insecure or unset HTTP headers - Content-Type
  • 330. Lack of protection against brute force attacks - Credentials
  • 332. Use of insecure channel - Source code
  • 337. Insecure session management - CSRF Fixation
  • 339. Insecure service configuration - Request Validation
  • 340. Lack of data validation - Special Characters
  • 341. Lack of data validation - OTP
  • 344. Lack of data validation - Non Sanitized Variables
  • 345. Security controls bypass or absence - Session Invalidation
  • 353. Lack of data validation - Token
  • 354. Insecure file upload - Files Limit
  • 355. Insufficient data authenticity validation - Checksum verification
  • 359. Sensitive information in source code - Credentials
  • 365. Authentication mechanism absence or evasion - Response tampering
  • 369. Insecure object reference - User deletion
  • 372. Use of an insecure channel - HTTP
  • 378. Non-encrypted confidential information - Hexadecimal
  • 383. Insecurely generated token - OTP
  • 384. Inappropriate coding practices - Wildcard export
  • 385. Non-encrypted confidential information - Keys
  • 387. Insecure service configuration - Object Reutilization
  • 391. Inappropriate coding practices - Unused properties
  • 393. Use of software with known vulnerabilities in development
  • 395. Insecure generation of random numbers - Static IV
  • 410. Dependency Confusion
  • 414. Insecure service configuration - Header Checking
  • 420. Password reset poisoning
  • 421. Insecure encryption algorithm - Insecure Elliptic Curve
  • 428. Inappropriate coding practices - invalid file
  • 435. Use of software with known vulnerabilities in environments

• Docker

  • 266. Excessive Privileges - Docker
  • 380. Supply Chain Attack - Docker
  • 418. Insecure service configuration - Docker
  • 427. Use of an insecure channel - Docker

• Elixir

  • 002. Asymmetric denial of service
  • 003. Symmetric denial of service
  • 004. Remote command execution
  • 005. Privilege escalation
  • 006. Authentication mechanism absence or evasion
  • 007. Cross-site request forgery
  • 008. Reflected cross-site scripting (XSS)
  • 009. Sensitive information in source code
  • 010. Stored cross-site scripting (XSS)
  • 011. Use of software with known vulnerabilities
  • 013. Insecure object reference
  • 014. Insecure functionality
  • 015. Insecure authentication method - Basic
  • 016. Insecure encryption algorithm - SSL/TLS
  • 017. Sensitive information sent insecurely
  • 019. Administrative credentials stored in cache memory
  • 020. Non-encrypted confidential information
  • 021. XPath injection
  • 022. Use of an insecure channel
  • 023. Uncontrolled external site redirect - Host Header Injection
  • 026. User enumeration
  • 027. Insecure file upload
  • 028. Insecure temporary files
  • 029. Inadequate file size control
  • 030. Sensitive information sent via URL parameters
  • 033. Password change without identity check
  • 034. Insecure generation of random numbers
  • 037. Technical information leak
  • 038. Business information leak
  • 039. Improper authorization control for web services
  • 041. Enabled default credentials
  • 042. Insecurely generated cookies
  • 043. Insecure or unset HTTP headers - Content-Security-Policy
  • 044. Insecure HTTP methods enabled
  • 050. Guessed weak credentials
  • 051. Cracked weak credentials
  • 052. Insecure encryption algorithm
  • 053. Lack of protection against brute force attacks
  • 057. Asymmetric denial of service - Content length
  • 059. Sensitive information stored in logs
  • 061. Remote File Inclusion
  • 062. Concurrent sessions
  • 063. Lack of data validation - Path Traversal
  • 064. Traceability loss - Server's clock
  • 066. Technical information leak - Console functions
  • 067. Improper resource allocation
  • 068. Insecure session expiration time
  • 071. Insecure or unset HTTP headers - Referrer-Policy
  • 076. Insecure session management
  • 078. Insecurely generated token
  • 079. Non-upgradable dependencies
  • 080. Business information leak - Customers or providers
  • 083. XML injection (XXE)
  • 087. Account lockout
  • 089. Lack of data validation - Trust boundary violation
  • 090. CSV injection
  • 091. Log injection
  • 092. Insecure encryption algorithm - Anonymous cipher suites
  • 093. Hidden fields manipulation
  • 094. Insecure encryption algorithm - Cipher Block Chaining
  • 095. Data uniqueness not properly verified
  • 096. Insecure deserialization
  • 098. External control of file name or path
  • 100. Server-side request forgery (SSRF)
  • 102. Email uniqueness not properly verified
  • 106. NoSQL injection
  • 107. LDAP injection
  • 108. Improper control of interaction frequency
  • 113. Improper type assignation
  • 115. Security controls bypass or absence
  • 119. Metadata with sensitive information
  • 120. Improper dependency pinning
  • 121. HTTP parameter pollution
  • 122. Email flooding
  • 123. Local file inclusion
  • 124. Race condition
  • 125. Directory listing
  • 127. Lack of data validation - Type confusion
  • 128. Insecurely generated cookies - HttpOnly
  • 129. Insecurely generated cookies - SameSite
  • 130. Insecurely generated cookies - Secure
  • 131. Insecure or unset HTTP headers - Strict Transport Security
  • 132. Insecure or unset HTTP headers - X-Content-Type-Options
  • 134. Insecure or unset HTTP headers - CORS
  • 135. Insecure or unset HTTP headers - X-XSS Protection
  • 136. Insecure or unset HTTP headers - Cache Control
  • 137. Insecure or unset HTTP headers - X-Permitted-Cross-Domain-Policies
  • 141. Lack of data validation - URL
  • 142. Sensitive information in source code - API Key
  • 145. Inappropriate coding practices - Cyclomatic complexity
  • 146. SQL injection
  • 148. Use of an insecure channel - FTP
  • 149. Use of an insecure channel - SMTP
  • 152. Insecure or unset HTTP headers - X-Frame Options
  • 153. Insecure or unset HTTP headers - Accept
  • 154. Time-based SQL Injection
  • 155. SQL Injection - Headers
  • 156. Uncontrolled external site redirect
  • 159. Excessive privileges
  • 160. Excessive privileges - Temporary Files
  • 183. Debugging enabled in production
  • 184. Lack of data validation
  • 185. Lack of data validation - Header x-amzn-RequestId
  • 186. Lack of data validation - Web Service
  • 187. Lack of data validation - Source Code
  • 189. Lack of data validation - Content Spoofing
  • 190. Lack of data validation - Session Cookie
  • 191. Lack of data validation - Responses
  • 192. Lack of data validation - Reflected Parameters
  • 193. Lack of data validation - Host Header Injection
  • 194. Lack of data validation - Input Length
  • 195. Lack of data validation - Headers
  • 196. Lack of data validation - Dates
  • 197. Lack of data validation - Numbers
  • 198. Lack of data validation - Out of range
  • 199. Lack of data validation - Emails
  • 200. Traceability loss
  • 201. Unauthorized access to files
  • 204. Insufficient data authenticity validation
  • 211. Asymmetric denial of service - ReDoS
  • 213. Business information leak - JWT
  • 214. Business information leak - Credentials
  • 217. Business information leak - Credit Cards
  • 220. Business information leak - Token
  • 221. Business information leak - Users
  • 222. Business information leak - DB
  • 226. Business information leak - Personal Information
  • 228. Business information leak - Analytics
  • 231. Message flooding
  • 235. Technical information leak - Headers
  • 238. Technical information leak - API
  • 239. Technical information leak - Errors
  • 240. Authentication mechanism absence or evasion - OTP
  • 245. Non-encrypted confidential information - Credit Cards
  • 246. Non-encrypted confidential information - DB
  • 248. Non-encrypted confidential information - LDAP
  • 249. Non-encrypted confidential information - Credentials
  • 254. Automatic information enumeration - Credit Cards
  • 261. Insecure encryption algorithm - DSA
  • 262. Insecure encryption algorithm - SHA1
  • 263. Insecure encryption algorithm - MD5
  • 264. Insecure encryption algorithm - TripleDES
  • 265. Insecure encryption algorithm - AES
  • 270. Insecure functionality - File Creation
  • 271. Insecure functionality - Password management
  • 272. Insecure functionality - Masking
  • 273. Insecure functionality - Fingerprint
  • 274. Restricted fields manipulation
  • 276. Sensitive information sent via URL parameters - Session
  • 280. Session Fixation
  • 282. Insecure encryption algorithm - ECB
  • 283. Automatic information enumeration - Personal Information
  • 284. Non-encrypted confidential information - Base 64
  • 286. Insecure object reference - Personal information
  • 287. Insecure object reference - Corporate information
  • 288. Insecure object reference - Financial information
  • 290. Technical information leak - IPs
  • 291. Business information leak - Financial Information
  • 295. Insecure session management - Change Password
  • 296. Weak credential policy - Password Change Limit
  • 297. SQL injection - Code
  • 298. Authentication mechanism absence or evasion - Redirect
  • 301. Concurrent sessions control bypass
  • 302. Insecure functionality - Session management
  • 305. Security controls bypass or absence - Data creation
  • 306. Insecure object reference - Files
  • 307. Insecure object reference - Data
  • 309. Insecurely generated token - JWT
  • 317. Improper resource allocation - Memory leak
  • 318. Insecurely generated token - Validation
  • 321. Lack of data validation - HTML code
  • 322. Insecurely generated token - Lifespan
  • 324. Insecure functionality - User management
  • 328. Insecure object reference - Session management
  • 329. Insecure or unset HTTP headers - Content-Type
  • 330. Lack of protection against brute force attacks - Credentials
  • 332. Use of insecure channel - Source code
  • 337. Insecure session management - CSRF Fixation
  • 340. Lack of data validation - Special Characters
  • 341. Lack of data validation - OTP
  • 345. Security controls bypass or absence - Session Invalidation
  • 353. Lack of data validation - Token
  • 354. Insecure file upload - Files Limit
  • 355. Insufficient data authenticity validation - Checksum verification
  • 362. Technical information leak - Content response
  • 363. Weak credential policy - Password strength
  • 364. Weak credential policy - Temporary passwords
  • 369. Insecure object reference - User deletion
  • 372. Use of an insecure channel - HTTP
  • 378. Non-encrypted confidential information - Hexadecimal
  • 383. Insecurely generated token - OTP
  • 395. Insecure generation of random numbers - Static IV
  • 397. Insecure authentication method - LDAP
  • 404. OS Command Injection
  • 417. Account Takeover
  • 420. Password reset poisoning
  • 421. Insecure encryption algorithm - Insecure Elliptic Curve

• Go

  • 002. Asymmetric denial of service
  • 003. Symmetric denial of service
  • 004. Remote command execution
  • 005. Privilege escalation
  • 006. Authentication mechanism absence or evasion
  • 007. Cross-site request forgery
  • 008. Reflected cross-site scripting (XSS)
  • 009. Sensitive information in source code
  • 010. Stored cross-site scripting (XSS)
  • 011. Use of software with known vulnerabilities
  • 013. Insecure object reference
  • 014. Insecure functionality
  • 015. Insecure authentication method - Basic
  • 016. Insecure encryption algorithm - SSL/TLS
  • 017. Sensitive information sent insecurely
  • 019. Administrative credentials stored in cache memory
  • 020. Non-encrypted confidential information
  • 021. XPath injection
  • 022. Use of an insecure channel
  • 023. Uncontrolled external site redirect - Host Header Injection
  • 026. User enumeration
  • 027. Insecure file upload
  • 028. Insecure temporary files
  • 029. Inadequate file size control
  • 030. Sensitive information sent via URL parameters
  • 033. Password change without identity check
  • 034. Insecure generation of random numbers
  • 035. Weak credential policy
  • 037. Technical information leak
  • 038. Business information leak
  • 039. Improper authorization control for web services
  • 041. Enabled default credentials
  • 042. Insecurely generated cookies
  • 043. Insecure or unset HTTP headers - Content-Security-Policy
  • 044. Insecure HTTP methods enabled
  • 047. Automatic information enumeration
  • 050. Guessed weak credentials
  • 051. Cracked weak credentials
  • 052. Insecure encryption algorithm
  • 053. Lack of protection against brute force attacks
  • 056. Anonymous connection
  • 057. Asymmetric denial of service - Content length
  • 059. Sensitive information stored in logs
  • 061. Remote File Inclusion
  • 062. Concurrent sessions
  • 063. Lack of data validation - Path Traversal
  • 064. Traceability loss - Server's clock
  • 066. Technical information leak - Console functions
  • 067. Improper resource allocation
  • 068. Insecure session expiration time
  • 069. Weak CAPTCHA
  • 071. Insecure or unset HTTP headers - Referrer-Policy
  • 073. Improper authorization control for web services - RDS
  • 076. Insecure session management
  • 078. Insecurely generated token
  • 079. Non-upgradable dependencies
  • 080. Business information leak - Customers or providers
  • 081. Lack of multi-factor authentication
  • 082. Insecurely deleted files
  • 083. XML injection (XXE)
  • 087. Account lockout
  • 088. Privacy violation
  • 089. Lack of data validation - Trust boundary violation
  • 090. CSV injection
  • 091. Log injection
  • 092. Insecure encryption algorithm - Anonymous cipher suites
  • 093. Hidden fields manipulation
  • 094. Insecure encryption algorithm - Cipher Block Chaining
  • 095. Data uniqueness not properly verified
  • 096. Insecure deserialization
  • 098. External control of file name or path
  • 100. Server-side request forgery (SSRF)
  • 101. Lack of protection against deletion
  • 102. Email uniqueness not properly verified
  • 106. NoSQL injection
  • 107. LDAP injection
  • 108. Improper control of interaction frequency
  • 110. HTTP request smuggling
  • 111. Out-of-bounds read
  • 113. Improper type assignation
  • 114. Phishing
  • 115. Security controls bypass or absence
  • 117. Unverifiable files
  • 118. Regulation infringement
  • 119. Metadata with sensitive information
  • 120. Improper dependency pinning
  • 121. HTTP parameter pollution
  • 122. Email flooding
  • 123. Local file inclusion
  • 124. Race condition
  • 125. Directory listing
  • 126. Lack of isolation methods
  • 127. Lack of data validation - Type confusion
  • 128. Insecurely generated cookies - HttpOnly
  • 129. Insecurely generated cookies - SameSite
  • 130. Insecurely generated cookies - Secure
  • 131. Insecure or unset HTTP headers - Strict Transport Security
  • 132. Insecure or unset HTTP headers - X-Content-Type-Options
  • 133. Insecure encryption algorithm - Perfect Forward Secrecy
  • 134. Insecure or unset HTTP headers - CORS
  • 135. Insecure or unset HTTP headers - X-XSS Protection
  • 136. Insecure or unset HTTP headers - Cache Control
  • 137. Insecure or unset HTTP headers - X-Permitted-Cross-Domain-Policies
  • 138. Inappropriate coding practices
  • 140. Insecure exceptions - Empty or no catch
  • 141. Lack of data validation - URL
  • 142. Sensitive information in source code - API Key
  • 143. Inappropriate coding practices - Eval function
  • 145. Inappropriate coding practices - Cyclomatic complexity
  • 146. SQL injection
  • 147. Insecure encryption algorithm - SSLContext
  • 148. Use of an insecure channel - FTP
  • 149. Use of an insecure channel - SMTP
  • 151. Use of an insecure channel - Telnet
  • 152. Insecure or unset HTTP headers - X-Frame Options
  • 153. Insecure or unset HTTP headers - Accept
  • 154. Time-based SQL Injection
  • 155. SQL Injection - Headers
  • 156. Uncontrolled external site redirect
  • 157. Unrestricted access between network segments
  • 159. Excessive privileges
  • 160. Excessive privileges - Temporary Files
  • 182. Email spoofing
  • 183. Debugging enabled in production
  • 184. Lack of data validation
  • 185. Lack of data validation - Header x-amzn-RequestId
  • 186. Lack of data validation - Web Service
  • 187. Lack of data validation - Source Code
  • 189. Lack of data validation - Content Spoofing
  • 190. Lack of data validation - Session Cookie
  • 191. Lack of data validation - Responses
  • 192. Lack of data validation - Reflected Parameters
  • 193. Lack of data validation - Host Header Injection
  • 194. Lack of data validation - Input Length
  • 195. Lack of data validation - Headers
  • 196. Lack of data validation - Dates
  • 197. Lack of data validation - Numbers
  • 198. Lack of data validation - Out of range
  • 199. Lack of data validation - Emails
  • 200. Traceability loss
  • 201. Unauthorized access to files
  • 203. Unauthorized access to files - S3 Bucket
  • 204. Insufficient data authenticity validation
  • 208. Security controls bypass or absence - Antivirus
  • 210. Security controls bypass or absence - Facial Recognition
  • 211. Asymmetric denial of service - ReDoS
  • 212. Security controls bypass or absence - Cloudflare
  • 213. Business information leak - JWT
  • 214. Business information leak - Credentials
  • 216. Business information leak - Source Code
  • 217. Business information leak - Credit Cards
  • 218. Business information leak - Network Unit
  • 220. Business information leak - Token
  • 221. Business information leak - Users
  • 222. Business information leak - DB
  • 226. Business information leak - Personal Information
  • 228. Business information leak - Analytics
  • 231. Message flooding
  • 233. Incomplete funcional code
  • 234. Technical information leak - Stacktrace
  • 235. Technical information leak - Headers
  • 236. Technical information leak - SourceMap
  • 237. Technical information leak - Print Functions
  • 238. Technical information leak - API
  • 239. Technical information leak - Errors
  • 240. Authentication mechanism absence or evasion - OTP
  • 243. Authentication mechanism absence or evasion - Admin Console
  • 245. Non-encrypted confidential information - Credit Cards
  • 246. Non-encrypted confidential information - DB
  • 248. Non-encrypted confidential information - LDAP
  • 249. Non-encrypted confidential information - Credentials
  • 250. Non-encrypted hard drives
  • 252. Automatic information enumeration - Open ports
  • 254. Automatic information enumeration - Credit Cards
  • 255. Insecure functionality - Pass the hash
  • 261. Insecure encryption algorithm - DSA
  • 262. Insecure encryption algorithm - SHA1
  • 263. Insecure encryption algorithm - MD5
  • 264. Insecure encryption algorithm - TripleDES
  • 265. Insecure encryption algorithm - AES
  • 269. Insecure encryption algorithm - Blowfish
  • 270. Insecure functionality - File Creation
  • 271. Insecure functionality - Password management
  • 272. Insecure functionality - Masking
  • 273. Insecure functionality - Fingerprint
  • 274. Restricted fields manipulation
  • 276. Sensitive information sent via URL parameters - Session
  • 277. Weak credential policy - Password Expiration
  • 280. Session Fixation
  • 282. Insecure encryption algorithm - ECB
  • 283. Automatic information enumeration - Personal Information
  • 284. Non-encrypted confidential information - Base 64
  • 286. Insecure object reference - Personal information
  • 287. Insecure object reference - Corporate information
  • 288. Insecure object reference - Financial information
  • 289. Technical information leak - Logs
  • 290. Technical information leak - IPs
  • 291. Business information leak - Financial Information
  • 295. Insecure session management - Change Password
  • 296. Weak credential policy - Password Change Limit
  • 297. SQL injection - Code
  • 298. Authentication mechanism absence or evasion - Redirect
  • 301. Concurrent sessions control bypass
  • 302. Insecure functionality - Session management
  • 305. Security controls bypass or absence - Data creation
  • 306. Insecure object reference - Files
  • 307. Insecure object reference - Data
  • 308. Enabled default configuration
  • 309. Insecurely generated token - JWT
  • 317. Improper resource allocation - Memory leak
  • 318. Insecurely generated token - Validation
  • 321. Lack of data validation - HTML code
  • 322. Insecurely generated token - Lifespan
  • 324. Insecure functionality - User management
  • 328. Insecure object reference - Session management
  • 329. Insecure or unset HTTP headers - Content-Type
  • 330. Lack of protection against brute force attacks - Credentials
  • 332. Use of insecure channel - Source code
  • 336. Business information leak - Corporate information
  • 337. Insecure session management - CSRF Fixation
  • 340. Lack of data validation - Special Characters
  • 341. Lack of data validation - OTP
  • 344. Lack of data validation - Non Sanitized Variables
  • 345. Security controls bypass or absence - Session Invalidation
  • 349. Technical information leak - Credentials
  • 353. Lack of data validation - Token
  • 354. Insecure file upload - Files Limit
  • 355. Insufficient data authenticity validation - Checksum verification
  • 359. Sensitive information in source code - Credentials
  • 362. Technical information leak - Content response
  • 363. Weak credential policy - Password strength
  • 364. Weak credential policy - Temporary passwords
  • 365. Authentication mechanism absence or evasion - Response tampering
  • 369. Insecure object reference - User deletion
  • 371. DOM-Based cross-site scripting (XSS)
  • 372. Use of an insecure channel - HTTP
  • 375. Security controls bypass or absence - Tampering Protection
  • 378. Non-encrypted confidential information - Hexadecimal
  • 383. Insecurely generated token - OTP
  • 384. Inappropriate coding practices - Wildcard export
  • 388. Insecure authentication method - NTLM
  • 391. Inappropriate coding practices - Unused properties
  • 393. Use of software with known vulnerabilities in development
  • 395. Insecure generation of random numbers - Static IV
  • 397. Insecure authentication method - LDAP
  • 404. OS Command Injection
  • 405. Excessive privileges - Access Mode
  • 411. Insecure encryption algorithm - Default encryption
  • 417. Account Takeover
  • 420. Password reset poisoning
  • 421. Insecure encryption algorithm - Insecure Elliptic Curve
  • 422. Server side template injection
  • 425. Server side cross-site scripting
  • 428. Inappropriate coding practices - invalid file
  • 432. Inappropriate coding practices - relative path command
  • 435. Use of software with known vulnerabilities in environments
  • 436. Security controls bypass or absence - Fingerprint

• Java

  • 002. Asymmetric denial of service
  • 003. Symmetric denial of service
  • 004. Remote command execution
  • 005. Privilege escalation
  • 006. Authentication mechanism absence or evasion
  • 007. Cross-site request forgery
  • 008. Reflected cross-site scripting (XSS)
  • 009. Sensitive information in source code
  • 010. Stored cross-site scripting (XSS)
  • 011. Use of software with known vulnerabilities
  • 013. Insecure object reference
  • 014. Insecure functionality
  • 015. Insecure authentication method - Basic
  • 016. Insecure encryption algorithm - SSL/TLS
  • 017. Sensitive information sent insecurely
  • 019. Administrative credentials stored in cache memory
  • 020. Non-encrypted confidential information
  • 021. XPath injection
  • 022. Use of an insecure channel
  • 023. Uncontrolled external site redirect - Host Header Injection
  • 026. User enumeration
  • 027. Insecure file upload
  • 028. Insecure temporary files
  • 029. Inadequate file size control
  • 030. Sensitive information sent via URL parameters
  • 033. Password change without identity check
  • 034. Insecure generation of random numbers
  • 035. Weak credential policy
  • 037. Technical information leak
  • 038. Business information leak
  • 039. Improper authorization control for web services
  • 041. Enabled default credentials
  • 042. Insecurely generated cookies
  • 043. Insecure or unset HTTP headers - Content-Security-Policy
  • 044. Insecure HTTP methods enabled
  • 047. Automatic information enumeration
  • 050. Guessed weak credentials
  • 051. Cracked weak credentials
  • 052. Insecure encryption algorithm
  • 053. Lack of protection against brute force attacks
  • 056. Anonymous connection
  • 057. Asymmetric denial of service - Content length
  • 059. Sensitive information stored in logs
  • 061. Remote File Inclusion
  • 062. Concurrent sessions
  • 063. Lack of data validation - Path Traversal
  • 064. Traceability loss - Server's clock
  • 066. Technical information leak - Console functions
  • 067. Improper resource allocation
  • 068. Insecure session expiration time
  • 069. Weak CAPTCHA
  • 071. Insecure or unset HTTP headers - Referrer-Policy
  • 073. Improper authorization control for web services - RDS
  • 076. Insecure session management
  • 078. Insecurely generated token
  • 079. Non-upgradable dependencies
  • 080. Business information leak - Customers or providers
  • 081. Lack of multi-factor authentication
  • 082. Insecurely deleted files
  • 083. XML injection (XXE)
  • 087. Account lockout
  • 088. Privacy violation
  • 089. Lack of data validation - Trust boundary violation
  • 090. CSV injection
  • 091. Log injection
  • 092. Insecure encryption algorithm - Anonymous cipher suites
  • 093. Hidden fields manipulation
  • 094. Insecure encryption algorithm - Cipher Block Chaining
  • 095. Data uniqueness not properly verified
  • 096. Insecure deserialization
  • 098. External control of file name or path
  • 100. Server-side request forgery (SSRF)
  • 101. Lack of protection against deletion
  • 102. Email uniqueness not properly verified
  • 106. NoSQL injection
  • 107. LDAP injection
  • 108. Improper control of interaction frequency
  • 110. HTTP request smuggling
  • 111. Out-of-bounds read
  • 113. Improper type assignation
  • 114. Phishing
  • 115. Security controls bypass or absence
  • 117. Unverifiable files
  • 118. Regulation infringement
  • 119. Metadata with sensitive information
  • 120. Improper dependency pinning
  • 121. HTTP parameter pollution
  • 122. Email flooding
  • 123. Local file inclusion
  • 124. Race condition
  • 125. Directory listing
  • 126. Lack of isolation methods
  • 127. Lack of data validation - Type confusion
  • 128. Insecurely generated cookies - HttpOnly
  • 129. Insecurely generated cookies - SameSite
  • 130. Insecurely generated cookies - Secure
  • 131. Insecure or unset HTTP headers - Strict Transport Security
  • 132. Insecure or unset HTTP headers - X-Content-Type-Options
  • 133. Insecure encryption algorithm - Perfect Forward Secrecy
  • 134. Insecure or unset HTTP headers - CORS
  • 135. Insecure or unset HTTP headers - X-XSS Protection
  • 136. Insecure or unset HTTP headers - Cache Control
  • 137. Insecure or unset HTTP headers - X-Permitted-Cross-Domain-Policies
  • 138. Inappropriate coding practices
  • 140. Insecure exceptions - Empty or no catch
  • 141. Lack of data validation - URL
  • 142. Sensitive information in source code - API Key
  • 143. Inappropriate coding practices - Eval function
  • 145. Inappropriate coding practices - Cyclomatic complexity
  • 146. SQL injection
  • 147. Insecure encryption algorithm - SSLContext
  • 148. Use of an insecure channel - FTP
  • 149. Use of an insecure channel - SMTP
  • 151. Use of an insecure channel - Telnet
  • 152. Insecure or unset HTTP headers - X-Frame Options
  • 153. Insecure or unset HTTP headers - Accept
  • 154. Time-based SQL Injection
  • 155. SQL Injection - Headers
  • 156. Uncontrolled external site redirect
  • 157. Unrestricted access between network segments
  • 159. Excessive privileges
  • 160. Excessive privileges - Temporary Files
  • 182. Email spoofing
  • 183. Debugging enabled in production
  • 184. Lack of data validation
  • 185. Lack of data validation - Header x-amzn-RequestId
  • 186. Lack of data validation - Web Service
  • 187. Lack of data validation - Source Code
  • 189. Lack of data validation - Content Spoofing
  • 190. Lack of data validation - Session Cookie
  • 191. Lack of data validation - Responses
  • 192. Lack of data validation - Reflected Parameters
  • 193. Lack of data validation - Host Header Injection
  • 194. Lack of data validation - Input Length
  • 195. Lack of data validation - Headers
  • 196. Lack of data validation - Dates
  • 197. Lack of data validation - Numbers
  • 198. Lack of data validation - Out of range
  • 199. Lack of data validation - Emails
  • 200. Traceability loss
  • 201. Unauthorized access to files
  • 203. Unauthorized access to files - S3 Bucket
  • 204. Insufficient data authenticity validation
  • 208. Security controls bypass or absence - Antivirus
  • 210. Security controls bypass or absence - Facial Recognition
  • 211. Asymmetric denial of service - ReDoS
  • 212. Security controls bypass or absence - Cloudflare
  • 213. Business information leak - JWT
  • 214. Business information leak - Credentials
  • 216. Business information leak - Source Code
  • 217. Business information leak - Credit Cards
  • 218. Business information leak - Network Unit
  • 220. Business information leak - Token
  • 221. Business information leak - Users
  • 222. Business information leak - DB
  • 226. Business information leak - Personal Information
  • 228. Business information leak - Analytics
  • 231. Message flooding
  • 233. Incomplete funcional code
  • 234. Technical information leak - Stacktrace
  • 235. Technical information leak - Headers
  • 236. Technical information leak - SourceMap
  • 237. Technical information leak - Print Functions
  • 238. Technical information leak - API
  • 239. Technical information leak - Errors
  • 240. Authentication mechanism absence or evasion - OTP
  • 243. Authentication mechanism absence or evasion - Admin Console
  • 245. Non-encrypted confidential information - Credit Cards
  • 246. Non-encrypted confidential information - DB
  • 248. Non-encrypted confidential information - LDAP
  • 249. Non-encrypted confidential information - Credentials
  • 250. Non-encrypted hard drives
  • 252. Automatic information enumeration - Open ports
  • 254. Automatic information enumeration - Credit Cards
  • 255. Insecure functionality - Pass the hash
  • 261. Insecure encryption algorithm - DSA
  • 262. Insecure encryption algorithm - SHA1
  • 263. Insecure encryption algorithm - MD5
  • 264. Insecure encryption algorithm - TripleDES
  • 265. Insecure encryption algorithm - AES
  • 269. Insecure encryption algorithm - Blowfish
  • 270. Insecure functionality - File Creation
  • 271. Insecure functionality - Password management
  • 272. Insecure functionality - Masking
  • 273. Insecure functionality - Fingerprint
  • 274. Restricted fields manipulation
  • 276. Sensitive information sent via URL parameters - Session
  • 277. Weak credential policy - Password Expiration
  • 280. Session Fixation
  • 282. Insecure encryption algorithm - ECB
  • 283. Automatic information enumeration - Personal Information
  • 284. Non-encrypted confidential information - Base 64
  • 286. Insecure object reference - Personal information
  • 287. Insecure object reference - Corporate information
  • 288. Insecure object reference - Financial information
  • 289. Technical information leak - Logs
  • 290. Technical information leak - IPs
  • 291. Business information leak - Financial Information
  • 295. Insecure session management - Change Password
  • 296. Weak credential policy - Password Change Limit
  • 297. SQL injection - Code
  • 298. Authentication mechanism absence or evasion - Redirect
  • 301. Concurrent sessions control bypass
  • 302. Insecure functionality - Session management
  • 305. Security controls bypass or absence - Data creation
  • 306. Insecure object reference - Files
  • 307. Insecure object reference - Data
  • 308. Enabled default configuration
  • 309. Insecurely generated token - JWT
  • 317. Improper resource allocation - Memory leak
  • 318. Insecurely generated token - Validation
  • 321. Lack of data validation - HTML code
  • 322. Insecurely generated token - Lifespan
  • 324. Insecure functionality - User management
  • 328. Insecure object reference - Session management
  • 329. Insecure or unset HTTP headers - Content-Type
  • 330. Lack of protection against brute force attacks - Credentials
  • 332. Use of insecure channel - Source code
  • 336. Business information leak - Corporate information
  • 337. Insecure session management - CSRF Fixation
  • 340. Lack of data validation - Special Characters
  • 341. Lack of data validation - OTP
  • 344. Lack of data validation - Non Sanitized Variables
  • 345. Security controls bypass or absence - Session Invalidation
  • 349. Technical information leak - Credentials
  • 353. Lack of data validation - Token
  • 354. Insecure file upload - Files Limit
  • 355. Insufficient data authenticity validation - Checksum verification
  • 359. Sensitive information in source code - Credentials
  • 362. Technical information leak - Content response
  • 363. Weak credential policy - Password strength
  • 364. Weak credential policy - Temporary passwords
  • 365. Authentication mechanism absence or evasion - Response tampering
  • 369. Insecure object reference - User deletion
  • 371. DOM-Based cross-site scripting (XSS)
  • 372. Use of an insecure channel - HTTP
  • 375. Security controls bypass or absence - Tampering Protection
  • 378. Non-encrypted confidential information - Hexadecimal
  • 383. Insecurely generated token - OTP
  • 384. Inappropriate coding practices - Wildcard export
  • 388. Insecure authentication method - NTLM
  • 391. Inappropriate coding practices - Unused properties
  • 393. Use of software with known vulnerabilities in development
  • 395. Insecure generation of random numbers - Static IV
  • 397. Insecure authentication method - LDAP
  • 404. OS Command Injection
  • 405. Excessive privileges - Access Mode
  • 411. Insecure encryption algorithm - Default encryption
  • 417. Account Takeover
  • 420. Password reset poisoning
  • 421. Insecure encryption algorithm - Insecure Elliptic Curve
  • 422. Server side template injection
  • 425. Server side cross-site scripting
  • 428. Inappropriate coding practices - invalid file
  • 432. Inappropriate coding practices - relative path command
  • 435. Use of software with known vulnerabilities in environments
  • 436. Security controls bypass or absence - Fingerprint

• Php

  • 002. Asymmetric denial of service
  • 003. Symmetric denial of service
  • 004. Remote command execution
  • 007. Cross-site request forgery
  • 008. Reflected cross-site scripting (XSS)
  • 010. Stored cross-site scripting (XSS)
  • 014. Insecure functionality
  • 015. Insecure authentication method - Basic
  • 016. Insecure encryption algorithm - SSL/TLS
  • 017. Sensitive information sent insecurely
  • 019. Administrative credentials stored in cache memory
  • 021. XPath injection
  • 022. Use of an insecure channel
  • 026. User enumeration
  • 027. Insecure file upload
  • 029. Inadequate file size control
  • 030. Sensitive information sent via URL parameters
  • 032. Spoofing
  • 033. Password change without identity check
  • 034. Insecure generation of random numbers
  • 036. ViewState not encrypted
  • 037. Technical information leak
  • 038. Business information leak
  • 042. Insecurely generated cookies
  • 045. HTML code injection
  • 051. Cracked weak credentials
  • 052. Insecure encryption algorithm
  • 059. Sensitive information stored in logs
  • 061. Remote File Inclusion
  • 062. Concurrent sessions
  • 063. Lack of data validation - Path Traversal
  • 067. Improper resource allocation
  • 068. Insecure session expiration time
  • 069. Weak CAPTCHA
  • 078. Insecurely generated token
  • 080. Business information leak - Customers or providers
  • 088. Privacy violation
  • 089. Lack of data validation - Trust boundary violation
  • 091. Log injection
  • 092. Insecure encryption algorithm - Anonymous cipher suites
  • 093. Hidden fields manipulation
  • 094. Insecure encryption algorithm - Cipher Block Chaining
  • 095. Data uniqueness not properly verified
  • 096. Insecure deserialization
  • 098. External control of file name or path
  • 102. Email uniqueness not properly verified
  • 106. NoSQL injection
  • 107. LDAP injection
  • 108. Improper control of interaction frequency
  • 111. Out-of-bounds read
  • 113. Improper type assignation
  • 115. Security controls bypass or absence
  • 121. HTTP parameter pollution
  • 122. Email flooding
  • 123. Local file inclusion
  • 124. Race condition
  • 125. Directory listing
  • 127. Lack of data validation - Type confusion
  • 128. Insecurely generated cookies - HttpOnly
  • 129. Insecurely generated cookies - SameSite
  • 131. Insecure or unset HTTP headers - Strict Transport Security
  • 132. Insecure or unset HTTP headers - X-Content-Type-Options
  • 136. Insecure or unset HTTP headers - Cache Control
  • 138. Inappropriate coding practices
  • 141. Lack of data validation - URL
  • 142. Sensitive information in source code - API Key
  • 143. Inappropriate coding practices - Eval function
  • 145. Inappropriate coding practices - Cyclomatic complexity
  • 146. SQL injection
  • 150. Use of an insecure channel - useSslProtocol()
  • 153. Insecure or unset HTTP headers - Accept
  • 154. Time-based SQL Injection
  • 155. SQL Injection - Headers
  • 156. Uncontrolled external site redirect
  • 160. Excessive privileges - Temporary Files
  • 164. Insecure service configuration
  • 174. Insecure service configuration - Backdoor
  • 183. Debugging enabled in production
  • 186. Lack of data validation - Web Service
  • 187. Lack of data validation - Source Code
  • 189. Lack of data validation - Content Spoofing
  • 190. Lack of data validation - Session Cookie
  • 191. Lack of data validation - Responses
  • 192. Lack of data validation - Reflected Parameters
  • 193. Lack of data validation - Host Header Injection
  • 194. Lack of data validation - Input Length
  • 195. Lack of data validation - Headers
  • 196. Lack of data validation - Dates
  • 197. Lack of data validation - Numbers
  • 198. Lack of data validation - Out of range
  • 199. Lack of data validation - Emails
  • 201. Unauthorized access to files
  • 211. Asymmetric denial of service - ReDoS
  • 217. Business information leak - Credit Cards
  • 221. Business information leak - Users
  • 231. Message flooding
  • 235. Technical information leak - Headers
  • 237. Technical information leak - Print Functions
  • 240. Authentication mechanism absence or evasion - OTP
  • 243. Authentication mechanism absence or evasion - Admin Console
  • 248. Non-encrypted confidential information - LDAP
  • 254. Automatic information enumeration - Credit Cards
  • 261. Insecure encryption algorithm - DSA
  • 262. Insecure encryption algorithm - SHA1
  • 264. Insecure encryption algorithm - TripleDES
  • 270. Insecure functionality - File Creation
  • 271. Insecure functionality - Password management
  • 272. Insecure functionality - Masking
  • 273. Insecure functionality - Fingerprint
  • 274. Restricted fields manipulation
  • 278. Insecure exceptions - NullPointerException
  • 280. Session Fixation
  • 282. Insecure encryption algorithm - ECB
  • 283. Automatic information enumeration - Personal Information
  • 284. Non-encrypted confidential information - Base 64
  • 286. Insecure object reference - Personal information
  • 288. Insecure object reference - Financial information
  • 289. Technical information leak - Logs
  • 290. Technical information leak - IPs
  • 291. Business information leak - Financial Information
  • 295. Insecure session management - Change Password
  • 297. SQL injection - Code
  • 298. Authentication mechanism absence or evasion - Redirect
  • 302. Insecure functionality - Session management
  • 305. Security controls bypass or absence - Data creation
  • 306. Insecure object reference - Files
  • 307. Insecure object reference - Data
  • 308. Enabled default configuration
  • 317. Improper resource allocation - Memory leak
  • 321. Lack of data validation - HTML code
  • 323. XML injection (XXE) - Unmarshaller
  • 326. Sensitive information in source code - Dependencies
  • 327. Insufficient data authenticity validation - Images
  • 328. Insecure object reference - Session management
  • 329. Insecure or unset HTTP headers - Content-Type
  • 330. Lack of protection against brute force attacks - Credentials
  • 331. User Enumeration - Wordpress
  • 332. Use of insecure channel - Source code
  • 339. Insecure service configuration - Request Validation
  • 340. Lack of data validation - Special Characters
  • 341. Lack of data validation - OTP
  • 343. Insecure service configuration - BREACH Attack
  • 344. Lack of data validation - Non Sanitized Variables
  • 345. Security controls bypass or absence - Session Invalidation
  • 351. Automatic information enumeration - Corporate information
  • 354. Insecure file upload - Files Limit
  • 355. Insufficient data authenticity validation - Checksum verification
  • 356. Symmetric denial of service - SMTP
  • 359. Sensitive information in source code - Credentials
  • 362. Technical information leak - Content response
  • 369. Insecure object reference - User deletion
  • 371. DOM-Based cross-site scripting (XSS)
  • 372. Use of an insecure channel - HTTP
  • 378. Non-encrypted confidential information - Hexadecimal
  • 382. Insufficient data authenticity validation - Front bypass
  • 387. Insecure service configuration - Object Reutilization
  • 395. Insecure generation of random numbers - Static IV
  • 399. Security controls absence - Monitoring
  • 404. OS Command Injection
  • 414. Insecure service configuration - Header Checking
  • 417. Account Takeover
  • 420. Password reset poisoning
  • 421. Insecure encryption algorithm - Insecure Elliptic Curve
  • 422. Server side template injection
  • 428. Inappropriate coding practices - invalid file
  • 435. Use of software with known vulnerabilities in environments
  • 436. Security controls bypass or absence - Fingerprint

• Python

  • 002. Asymmetric denial of service
  • 003. Symmetric denial of service
  • 004. Remote command execution
  • 005. Privilege escalation
  • 006. Authentication mechanism absence or evasion
  • 007. Cross-site request forgery
  • 008. Reflected cross-site scripting (XSS)
  • 013. Insecure object reference
  • 014. Insecure functionality
  • 015. Insecure authentication method - Basic
  • 016. Insecure encryption algorithm - SSL/TLS
  • 017. Sensitive information sent insecurely
  • 020. Non-encrypted confidential information
  • 021. XPath injection
  • 022. Use of an insecure channel
  • 023. Uncontrolled external site redirect - Host Header Injection
  • 026. User enumeration
  • 027. Insecure file upload
  • 028. Insecure temporary files
  • 029. Inadequate file size control
  • 030. Sensitive information sent via URL parameters
  • 033. Password change without identity check
  • 034. Insecure generation of random numbers
  • 039. Improper authorization control for web services
  • 041. Enabled default credentials
  • 042. Insecurely generated cookies
  • 043. Insecure or unset HTTP headers - Content-Security-Policy
  • 047. Automatic information enumeration
  • 050. Guessed weak credentials
  • 051. Cracked weak credentials
  • 052. Insecure encryption algorithm
  • 053. Lack of protection against brute force attacks
  • 057. Asymmetric denial of service - Content length
  • 059. Sensitive information stored in logs
  • 060. Insecure service configuration - Host verification
  • 061. Remote File Inclusion
  • 062. Concurrent sessions
  • 063. Lack of data validation - Path Traversal
  • 064. Traceability loss - Server's clock
  • 067. Improper resource allocation
  • 068. Insecure session expiration time
  • 071. Insecure or unset HTTP headers - Referrer-Policy
  • 076. Insecure session management
  • 078. Insecurely generated token
  • 079. Non-upgradable dependencies
  • 080. Business information leak - Customers or providers
  • 082. Insecurely deleted files
  • 083. XML injection (XXE)
  • 089. Lack of data validation - Trust boundary violation
  • 090. CSV injection
  • 091. Log injection
  • 092. Insecure encryption algorithm - Anonymous cipher suites
  • 093. Hidden fields manipulation
  • 094. Insecure encryption algorithm - Cipher Block Chaining
  • 095. Data uniqueness not properly verified
  • 096. Insecure deserialization
  • 098. External control of file name or path
  • 100. Server-side request forgery (SSRF)
  • 102. Email uniqueness not properly verified
  • 106. NoSQL injection
  • 107. LDAP injection
  • 108. Improper control of interaction frequency
  • 113. Improper type assignation
  • 116. XS-Leaks
  • 118. Regulation infringement
  • 119. Metadata with sensitive information
  • 120. Improper dependency pinning
  • 121. HTTP parameter pollution
  • 123. Local file inclusion
  • 124. Race condition
  • 125. Directory listing
  • 127. Lack of data validation - Type confusion
  • 128. Insecurely generated cookies - HttpOnly
  • 129. Insecurely generated cookies - SameSite
  • 130. Insecurely generated cookies - Secure
  • 131. Insecure or unset HTTP headers - Strict Transport Security
  • 132. Insecure or unset HTTP headers - X-Content-Type-Options
  • 134. Insecure or unset HTTP headers - CORS
  • 135. Insecure or unset HTTP headers - X-XSS Protection
  • 136. Insecure or unset HTTP headers - Cache Control
  • 138. Inappropriate coding practices
  • 140. Insecure exceptions - Empty or no catch
  • 142. Sensitive information in source code - API Key
  • 143. Inappropriate coding practices - Eval function
  • 145. Inappropriate coding practices - Cyclomatic complexity
  • 147. Insecure encryption algorithm - SSLContext
  • 148. Use of an insecure channel - FTP
  • 150. Use of an insecure channel - useSslProtocol()
  • 151. Use of an insecure channel - Telnet
  • 152. Insecure or unset HTTP headers - X-Frame Options
  • 153. Insecure or unset HTTP headers - Accept
  • 154. Time-based SQL Injection
  • 155. SQL Injection - Headers
  • 156. Uncontrolled external site redirect
  • 179. Insecure service configuration - SMB
  • 180. Insecure service configuration - SMTP
  • 183. Debugging enabled in production
  • 184. Lack of data validation
  • 185. Lack of data validation - Header x-amzn-RequestId
  • 186. Lack of data validation - Web Service
  • 187. Lack of data validation - Source Code
  • 190. Lack of data validation - Session Cookie
  • 191. Lack of data validation - Responses
  • 192. Lack of data validation - Reflected Parameters
  • 193. Lack of data validation - Host Header Injection
  • 194. Lack of data validation - Input Length
  • 195. Lack of data validation - Headers
  • 196. Lack of data validation - Dates
  • 197. Lack of data validation - Numbers
  • 198. Lack of data validation - Out of range
  • 199. Lack of data validation - Emails
  • 200. Traceability loss
  • 201. Unauthorized access to files
  • 204. Insufficient data authenticity validation
  • 210. Security controls bypass or absence - Facial Recognition
  • 211. Asymmetric denial of service - ReDoS
  • 213. Business information leak - JWT
  • 214. Business information leak - Credentials
  • 216. Business information leak - Source Code
  • 217. Business information leak - Credit Cards
  • 218. Business information leak - Network Unit
  • 220. Business information leak - Token
  • 221. Business information leak - Users
  • 223. Business information leak - JFROG
  • 226. Business information leak - Personal Information
  • 235. Technical information leak - Headers
  • 237. Technical information leak - Print Functions
  • 239. Technical information leak - Errors
  • 240. Authentication mechanism absence or evasion - OTP
  • 243. Authentication mechanism absence or evasion - Admin Console
  • 245. Non-encrypted confidential information - Credit Cards
  • 246. Non-encrypted confidential information - DB
  • 247. Non-encrypted confidential information - AWS
  • 248. Non-encrypted confidential information - LDAP
  • 249. Non-encrypted confidential information - Credentials
  • 254. Automatic information enumeration - Credit Cards
  • 261. Insecure encryption algorithm - DSA
  • 262. Insecure encryption algorithm - SHA1
  • 263. Insecure encryption algorithm - MD5
  • 264. Insecure encryption algorithm - TripleDES
  • 265. Insecure encryption algorithm - AES
  • 269. Insecure encryption algorithm - Blowfish
  • 270. Insecure functionality - File Creation
  • 271. Insecure functionality - Password management
  • 272. Insecure functionality - Masking
  • 273. Insecure functionality - Fingerprint
  • 274. Restricted fields manipulation
  • 275. Non-encrypted confidential information - Local data
  • 276. Sensitive information sent via URL parameters - Session
  • 280. Session Fixation
  • 282. Insecure encryption algorithm - ECB
  • 283. Automatic information enumeration - Personal Information
  • 284. Non-encrypted confidential information - Base 64
  • 286. Insecure object reference - Personal information
  • 289. Technical information leak - Logs
  • 294. Insecure service configuration - OTP
  • 295. Insecure session management - Change Password
  • 296. Weak credential policy - Password Change Limit
  • 297. SQL injection - Code
  • 298. Authentication mechanism absence or evasion - Redirect
  • 302. Insecure functionality - Session management
  • 305. Security controls bypass or absence - Data creation
  • 306. Insecure object reference - Files
  • 307. Insecure object reference - Data
  • 309. Insecurely generated token - JWT
  • 310. Unauthorized access to screen
  • 317. Improper resource allocation - Memory leak
  • 318. Insecurely generated token - Validation
  • 319. Insecure service configuration - Roles
  • 321. Lack of data validation - HTML code
  • 322. Insecurely generated token - Lifespan
  • 326. Sensitive information in source code - Dependencies
  • 328. Insecure object reference - Session management
  • 329. Insecure or unset HTTP headers - Content-Type
  • 330. Lack of protection against brute force attacks - Credentials
  • 332. Use of insecure channel - Source code
  • 336. Business information leak - Corporate information
  • 337. Insecure session management - CSRF Fixation
  • 338. Insecure service configuration - Salt
  • 340. Lack of data validation - Special Characters
  • 341. Lack of data validation - OTP
  • 343. Insecure service configuration - BREACH Attack
  • 344. Lack of data validation - Non Sanitized Variables
  • 345. Security controls bypass or absence - Session Invalidation
  • 353. Lack of data validation - Token
  • 354. Insecure file upload - Files Limit
  • 355. Insufficient data authenticity validation - Checksum verification
  • 359. Sensitive information in source code - Credentials
  • 363. Weak credential policy - Password strength
  • 364. Weak credential policy - Temporary passwords
  • 365. Authentication mechanism absence or evasion - Response tampering
  • 367. Sensitive information in source code - Git history
  • 369. Insecure object reference - User deletion
  • 372. Use of an insecure channel - HTTP
  • 378. Non-encrypted confidential information - Hexadecimal
  • 383. Insecurely generated token - OTP
  • 384. Inappropriate coding practices - Wildcard export
  • 385. Non-encrypted confidential information - Keys
  • 388. Insecure authentication method - NTLM
  • 391. Inappropriate coding practices - Unused properties
  • 393. Use of software with known vulnerabilities in development
  • 395. Insecure generation of random numbers - Static IV
  • 404. OS Command Injection
  • 410. Dependency Confusion
  • 420. Password reset poisoning
  • 421. Insecure encryption algorithm - Insecure Elliptic Curve
  • 422. Server side template injection
  • 425. Server side cross-site scripting
  • 428. Inappropriate coding practices - invalid file
  • 435. Use of software with known vulnerabilities in environments
  • 436. Security controls bypass or absence - Fingerprint

• Ruby

  • 002. Asymmetric denial of service
  • 003. Symmetric denial of service
  • 004. Remote command execution
  • 005. Privilege escalation
  • 007. Cross-site request forgery
  • 008. Reflected cross-site scripting (XSS)
  • 009. Sensitive information in source code
  • 010. Stored cross-site scripting (XSS)
  • 011. Use of software with known vulnerabilities
  • 013. Insecure object reference
  • 014. Insecure functionality
  • 015. Insecure authentication method - Basic
  • 016. Insecure encryption algorithm - SSL/TLS
  • 017. Sensitive information sent insecurely
  • 019. Administrative credentials stored in cache memory
  • 021. XPath injection
  • 023. Uncontrolled external site redirect - Host Header Injection
  • 026. User enumeration
  • 027. Insecure file upload
  • 028. Insecure temporary files
  • 029. Inadequate file size control
  • 033. Password change without identity check
  • 034. Insecure generation of random numbers
  • 037. Technical information leak
  • 041. Enabled default credentials
  • 042. Insecurely generated cookies
  • 043. Insecure or unset HTTP headers - Content-Security-Policy
  • 044. Insecure HTTP methods enabled
  • 045. HTML code injection
  • 047. Automatic information enumeration
  • 050. Guessed weak credentials
  • 051. Cracked weak credentials
  • 052. Insecure encryption algorithm
  • 053. Lack of protection against brute force attacks
  • 056. Anonymous connection
  • 057. Asymmetric denial of service - Content length
  • 059. Sensitive information stored in logs
  • 061. Remote File Inclusion
  • 062. Concurrent sessions
  • 063. Lack of data validation - Path Traversal
  • 065. Cached form fields
  • 066. Technical information leak - Console functions
  • 067. Improper resource allocation
  • 068. Insecure session expiration time
  • 071. Insecure or unset HTTP headers - Referrer-Policy
  • 076. Insecure session management
  • 078. Insecurely generated token
  • 081. Lack of multi-factor authentication
  • 082. Insecurely deleted files
  • 083. XML injection (XXE)
  • 085. Sensitive data stored in client-side storage
  • 086. Missing subresource integrity check
  • 087. Account lockout
  • 090. CSV injection
  • 091. Log injection
  • 092. Insecure encryption algorithm - Anonymous cipher suites
  • 093. Hidden fields manipulation
  • 094. Insecure encryption algorithm - Cipher Block Chaining
  • 095. Data uniqueness not properly verified
  • 096. Insecure deserialization
  • 098. External control of file name or path
  • 100. Server-side request forgery (SSRF)
  • 102. Email uniqueness not properly verified
  • 105. Apache lucene query injection
  • 106. NoSQL injection
  • 107. LDAP injection
  • 108. Improper control of interaction frequency
  • 113. Improper type assignation
  • 115. Security controls bypass or absence
  • 116. XS-Leaks
  • 119. Metadata with sensitive information
  • 120. Improper dependency pinning
  • 121. HTTP parameter pollution
  • 123. Local file inclusion
  • 124. Race condition
  • 125. Directory listing
  • 127. Lack of data validation - Type confusion
  • 128. Insecurely generated cookies - HttpOnly
  • 129. Insecurely generated cookies - SameSite
  • 130. Insecurely generated cookies - Secure
  • 131. Insecure or unset HTTP headers - Strict Transport Security
  • 132. Insecure or unset HTTP headers - X-Content-Type-Options
  • 133. Insecure encryption algorithm - Perfect Forward Secrecy
  • 134. Insecure or unset HTTP headers - CORS
  • 135. Insecure or unset HTTP headers - X-XSS Protection
  • 136. Insecure or unset HTTP headers - Cache Control
  • 137. Insecure or unset HTTP headers - X-Permitted-Cross-Domain-Policies
  • 138. Inappropriate coding practices
  • 140. Insecure exceptions - Empty or no catch
  • 141. Lack of data validation - URL
  • 142. Sensitive information in source code - API Key
  • 145. Inappropriate coding practices - Cyclomatic complexity
  • 146. SQL injection
  • 147. Insecure encryption algorithm - SSLContext
  • 148. Use of an insecure channel - FTP
  • 149. Use of an insecure channel - SMTP
  • 151. Use of an insecure channel - Telnet
  • 152. Insecure or unset HTTP headers - X-Frame Options
  • 153. Insecure or unset HTTP headers - Accept
  • 154. Time-based SQL Injection
  • 155. SQL Injection - Headers
  • 156. Uncontrolled external site redirect
  • 159. Excessive privileges
  • 160. Excessive privileges - Temporary Files
  • 183. Debugging enabled in production
  • 184. Lack of data validation
  • 185. Lack of data validation - Header x-amzn-RequestId
  • 186. Lack of data validation - Web Service
  • 187. Lack of data validation - Source Code
  • 188. Lack of data validation - Modify DOM Elements
  • 190. Lack of data validation - Session Cookie
  • 191. Lack of data validation - Responses
  • 192. Lack of data validation - Reflected Parameters
  • 193. Lack of data validation - Host Header Injection
  • 194. Lack of data validation - Input Length
  • 195. Lack of data validation - Headers
  • 196. Lack of data validation - Dates
  • 197. Lack of data validation - Numbers
  • 198. Lack of data validation - Out of range
  • 199. Lack of data validation - Emails
  • 200. Traceability loss
  • 201. Unauthorized access to files
  • 204. Insufficient data authenticity validation
  • 211. Asymmetric denial of service - ReDoS
  • 233. Incomplete funcional code
  • 234. Technical information leak - Stacktrace
  • 235. Technical information leak - Headers
  • 236. Technical information leak - SourceMap
  • 237. Technical information leak - Print Functions
  • 238. Technical information leak - API
  • 239. Technical information leak - Errors
  • 252. Automatic information enumeration - Open ports
  • 254. Automatic information enumeration - Credit Cards
  • 255. Insecure functionality - Pass the hash
  • 261. Insecure encryption algorithm - DSA
  • 262. Insecure encryption algorithm - SHA1
  • 263. Insecure encryption algorithm - MD5
  • 264. Insecure encryption algorithm - TripleDES
  • 265. Insecure encryption algorithm - AES
  • 269. Insecure encryption algorithm - Blowfish
  • 270. Insecure functionality - File Creation
  • 271. Insecure functionality - Password management
  • 272. Insecure functionality - Masking
  • 273. Insecure functionality - Fingerprint
  • 274. Restricted fields manipulation
  • 276. Sensitive information sent via URL parameters - Session
  • 277. Weak credential policy - Password Expiration
  • 278. Insecure exceptions - NullPointerException
  • 280. Session Fixation
  • 283. Automatic information enumeration - Personal Information
  • 286. Insecure object reference - Personal information
  • 287. Insecure object reference - Corporate information
  • 288. Insecure object reference - Financial information
  • 289. Technical information leak - Logs
  • 290. Technical information leak - IPs
  • 295. Insecure session management - Change Password
  • 296. Weak credential policy - Password Change Limit
  • 297. SQL injection - Code
  • 301. Concurrent sessions control bypass
  • 302. Insecure functionality - Session management
  • 305. Security controls bypass or absence - Data creation
  • 306. Insecure object reference - Files
  • 307. Insecure object reference - Data
  • 308. Enabled default configuration
  • 309. Insecurely generated token - JWT
  • 310. Unauthorized access to screen
  • 317. Improper resource allocation - Memory leak
  • 318. Insecurely generated token - Validation
  • 321. Lack of data validation - HTML code
  • 322. Insecurely generated token - Lifespan
  • 324. Insecure functionality - User management
  • 326. Sensitive information in source code - Dependencies
  • 328. Insecure object reference - Session management
  • 329. Insecure or unset HTTP headers - Content-Type
  • 330. Lack of protection against brute force attacks - Credentials
  • 337. Insecure session management - CSRF Fixation
  • 340. Lack of data validation - Special Characters
  • 341. Lack of data validation - OTP
  • 344. Lack of data validation - Non Sanitized Variables
  • 345. Security controls bypass or absence - Session Invalidation
  • 349. Technical information leak - Credentials
  • 351. Automatic information enumeration - Corporate information
  • 353. Lack of data validation - Token
  • 354. Insecure file upload - Files Limit
  • 355. Insufficient data authenticity validation - Checksum verification
  • 359. Sensitive information in source code - Credentials
  • 362. Technical information leak - Content response
  • 363. Weak credential policy - Password strength
  • 364. Weak credential policy - Temporary passwords
  • 369. Insecure object reference - User deletion
  • 371. DOM-Based cross-site scripting (XSS)
  • 372. Use of an insecure channel - HTTP
  • 375. Security controls bypass or absence - Tampering Protection
  • 376. Security controls bypass or absence - Reversing Protection
  • 382. Insufficient data authenticity validation - Front bypass
  • 383. Insecurely generated token - OTP
  • 388. Insecure authentication method - NTLM
  • 391. Inappropriate coding practices - Unused properties
  • 393. Use of software with known vulnerabilities in development
  • 395. Insecure generation of random numbers - Static IV
  • 397. Insecure authentication method - LDAP
  • 404. OS Command Injection
  • 411. Insecure encryption algorithm - Default encryption
  • 420. Password reset poisoning
  • 421. Insecure encryption algorithm - Insecure Elliptic Curve
  • 422. Server side template injection
  • 423. Inappropriate coding practices - System exit
  • 428. Inappropriate coding practices - invalid file
  • 429. Universal cross-site scripting (UXSS)
  • 432. Inappropriate coding practices - relative path command
  • 434. Client-side template injection
  • 435. Use of software with known vulnerabilities in environments
  • 436. Security controls bypass or absence - Fingerprint

• Scala

  • 002. Asymmetric denial of service
  • 003. Symmetric denial of service
  • 004. Remote command execution
  • 005. Privilege escalation
  • 006. Authentication mechanism absence or evasion
  • 007. Cross-site request forgery
  • 009. Sensitive information in source code
  • 010. Stored cross-site scripting (XSS)
  • 011. Use of software with known vulnerabilities
  • 013. Insecure object reference
  • 014. Insecure functionality
  • 015. Insecure authentication method - Basic
  • 016. Insecure encryption algorithm - SSL/TLS
  • 017. Sensitive information sent insecurely
  • 019. Administrative credentials stored in cache memory
  • 020. Non-encrypted confidential information
  • 021. XPath injection
  • 022. Use of an insecure channel
  • 023. Uncontrolled external site redirect - Host Header Injection
  • 026. User enumeration
  • 027. Insecure file upload
  • 028. Insecure temporary files
  • 029. Inadequate file size control
  • 030. Sensitive information sent via URL parameters
  • 033. Password change without identity check
  • 034. Insecure generation of random numbers
  • 037. Technical information leak
  • 038. Business information leak
  • 039. Improper authorization control for web services
  • 041. Enabled default credentials
  • 042. Insecurely generated cookies
  • 044. Insecure HTTP methods enabled
  • 047. Automatic information enumeration
  • 050. Guessed weak credentials
  • 051. Cracked weak credentials
  • 052. Insecure encryption algorithm
  • 053. Lack of protection against brute force attacks
  • 057. Asymmetric denial of service - Content length
  • 059. Sensitive information stored in logs
  • 061. Remote File Inclusion
  • 062. Concurrent sessions
  • 063. Lack of data validation - Path Traversal
  • 064. Traceability loss - Server's clock
  • 066. Technical information leak - Console functions
  • 067. Improper resource allocation
  • 068. Insecure session expiration time
  • 069. Weak CAPTCHA
  • 071. Insecure or unset HTTP headers - Referrer-Policy
  • 073. Improper authorization control for web services - RDS
  • 076. Insecure session management
  • 078. Insecurely generated token
  • 079. Non-upgradable dependencies
  • 080. Business information leak - Customers or providers
  • 081. Lack of multi-factor authentication
  • 082. Insecurely deleted files
  • 087. Account lockout
  • 088. Privacy violation
  • 089. Lack of data validation - Trust boundary violation
  • 090. CSV injection
  • 091. Log injection
  • 092. Insecure encryption algorithm - Anonymous cipher suites
  • 093. Hidden fields manipulation
  • 094. Insecure encryption algorithm - Cipher Block Chaining
  • 095. Data uniqueness not properly verified
  • 096. Insecure deserialization
  • 098. External control of file name or path
  • 100. Server-side request forgery (SSRF)
  • 101. Lack of protection against deletion
  • 102. Email uniqueness not properly verified
  • 106. NoSQL injection
  • 107. LDAP injection
  • 108. Improper control of interaction frequency
  • 110. HTTP request smuggling
  • 111. Out-of-bounds read
  • 113. Improper type assignation
  • 114. Phishing
  • 115. Security controls bypass or absence
  • 117. Unverifiable files
  • 118. Regulation infringement
  • 120. Improper dependency pinning
  • 121. HTTP parameter pollution
  • 122. Email flooding
  • 123. Local file inclusion
  • 124. Race condition
  • 125. Directory listing
  • 126. Lack of isolation methods
  • 127. Lack of data validation - Type confusion
  • 128. Insecurely generated cookies - HttpOnly
  • 129. Insecurely generated cookies - SameSite
  • 130. Insecurely generated cookies - Secure
  • 131. Insecure or unset HTTP headers - Strict Transport Security
  • 132. Insecure or unset HTTP headers - X-Content-Type-Options
  • 133. Insecure encryption algorithm - Perfect Forward Secrecy
  • 134. Insecure or unset HTTP headers - CORS
  • 135. Insecure or unset HTTP headers - X-XSS Protection
  • 136. Insecure or unset HTTP headers - Cache Control
  • 137. Insecure or unset HTTP headers - X-Permitted-Cross-Domain-Policies
  • 138. Inappropriate coding practices
  • 140. Insecure exceptions - Empty or no catch
  • 141. Lack of data validation - URL
  • 143. Inappropriate coding practices - Eval function
  • 145. Inappropriate coding practices - Cyclomatic complexity
  • 146. SQL injection
  • 147. Insecure encryption algorithm - SSLContext
  • 148. Use of an insecure channel - FTP
  • 149. Use of an insecure channel - SMTP
  • 151. Use of an insecure channel - Telnet
  • 152. Insecure or unset HTTP headers - X-Frame Options
  • 153. Insecure or unset HTTP headers - Accept
  • 154. Time-based SQL Injection
  • 155. SQL Injection - Headers
  • 156. Uncontrolled external site redirect
  • 157. Unrestricted access between network segments
  • 159. Excessive privileges
  • 160. Excessive privileges - Temporary Files
  • 182. Email spoofing
  • 183. Debugging enabled in production
  • 184. Lack of data validation
  • 185. Lack of data validation - Header x-amzn-RequestId
  • 186. Lack of data validation - Web Service
  • 187. Lack of data validation - Source Code
  • 189. Lack of data validation - Content Spoofing
  • 190. Lack of data validation - Session Cookie
  • 191. Lack of data validation - Responses
  • 192. Lack of data validation - Reflected Parameters
  • 193. Lack of data validation - Host Header Injection
  • 194. Lack of data validation - Input Length
  • 195. Lack of data validation - Headers
  • 196. Lack of data validation - Dates
  • 197. Lack of data validation - Numbers
  • 198. Lack of data validation - Out of range
  • 199. Lack of data validation - Emails
  • 200. Traceability loss
  • 201. Unauthorized access to files
  • 203. Unauthorized access to files - S3 Bucket
  • 204. Insufficient data authenticity validation
  • 208. Security controls bypass or absence - Antivirus
  • 210. Security controls bypass or absence - Facial Recognition
  • 212. Security controls bypass or absence - Cloudflare
  • 213. Business information leak - JWT
  • 214. Business information leak - Credentials
  • 216. Business information leak - Source Code
  • 217. Business information leak - Credit Cards
  • 218. Business information leak - Network Unit
  • 220. Business information leak - Token
  • 221. Business information leak - Users
  • 222. Business information leak - DB
  • 226. Business information leak - Personal Information
  • 228. Business information leak - Analytics
  • 231. Message flooding
  • 234. Technical information leak - Stacktrace
  • 235. Technical information leak - Headers
  • 236. Technical information leak - SourceMap
  • 237. Technical information leak - Print Functions
  • 238. Technical information leak - API
  • 239. Technical information leak - Errors
  • 240. Authentication mechanism absence or evasion - OTP
  • 243. Authentication mechanism absence or evasion - Admin Console
  • 245. Non-encrypted confidential information - Credit Cards
  • 246. Non-encrypted confidential information - DB
  • 248. Non-encrypted confidential information - LDAP
  • 249. Non-encrypted confidential information - Credentials
  • 250. Non-encrypted hard drives
  • 254. Automatic information enumeration - Credit Cards
  • 255. Insecure functionality - Pass the hash
  • 261. Insecure encryption algorithm - DSA
  • 262. Insecure encryption algorithm - SHA1
  • 263. Insecure encryption algorithm - MD5
  • 264. Insecure encryption algorithm - TripleDES
  • 265. Insecure encryption algorithm - AES
  • 269. Insecure encryption algorithm - Blowfish
  • 270. Insecure functionality - File Creation
  • 271. Insecure functionality - Password management
  • 272. Insecure functionality - Masking
  • 273. Insecure functionality - Fingerprint
  • 274. Restricted fields manipulation
  • 276. Sensitive information sent via URL parameters - Session
  • 277. Weak credential policy - Password Expiration
  • 280. Session Fixation
  • 282. Insecure encryption algorithm - ECB
  • 283. Automatic information enumeration - Personal Information
  • 284. Non-encrypted confidential information - Base 64
  • 286. Insecure object reference - Personal information
  • 287. Insecure object reference - Corporate information
  • 288. Insecure object reference - Financial information
  • 289. Technical information leak - Logs
  • 290. Technical information leak - IPs
  • 291. Business information leak - Financial Information
  • 295. Insecure session management - Change Password
  • 297. SQL injection - Code
  • 298. Authentication mechanism absence or evasion - Redirect
  • 301. Concurrent sessions control bypass
  • 302. Insecure functionality - Session management
  • 305. Security controls bypass or absence - Data creation
  • 306. Insecure object reference - Files
  • 307. Insecure object reference - Data
  • 308. Enabled default configuration
  • 309. Insecurely generated token - JWT
  • 317. Improper resource allocation - Memory leak
  • 318. Insecurely generated token - Validation
  • 321. Lack of data validation - HTML code
  • 322. Insecurely generated token - Lifespan
  • 324. Insecure functionality - User management
  • 328. Insecure object reference - Session management
  • 329. Insecure or unset HTTP headers - Content-Type
  • 330. Lack of protection against brute force attacks - Credentials
  • 332. Use of insecure channel - Source code
  • 336. Business information leak - Corporate information
  • 337. Insecure session management - CSRF Fixation
  • 340. Lack of data validation - Special Characters
  • 341. Lack of data validation - OTP
  • 345. Security controls bypass or absence - Session Invalidation
  • 349. Technical information leak - Credentials
  • 353. Lack of data validation - Token
  • 354. Insecure file upload - Files Limit
  • 355. Insufficient data authenticity validation - Checksum verification
  • 359. Sensitive information in source code - Credentials
  • 362. Technical information leak - Content response
  • 363. Weak credential policy - Password strength
  • 364. Weak credential policy - Temporary passwords
  • 365. Authentication mechanism absence or evasion - Response tampering
  • 369. Insecure object reference - User deletion
  • 372. Use of an insecure channel - HTTP
  • 375. Security controls bypass or absence - Tampering Protection
  • 378. Non-encrypted confidential information - Hexadecimal
  • 383. Insecurely generated token - OTP
  • 384. Inappropriate coding practices - Wildcard export
  • 388. Insecure authentication method - NTLM
  • 391. Inappropriate coding practices - Unused properties
  • 393. Use of software with known vulnerabilities in development
  • 395. Insecure generation of random numbers - Static IV
  • 397. Insecure authentication method - LDAP
  • 404. OS Command Injection
  • 405. Excessive privileges - Access Mode
  • 411. Insecure encryption algorithm - Default encryption
  • 417. Account Takeover
  • 420. Password reset poisoning
  • 421. Insecure encryption algorithm - Insecure Elliptic Curve
  • 422. Server side template injection
  • 425. Server side cross-site scripting
  • 428. Inappropriate coding practices - invalid file
  • 432. Inappropriate coding practices - relative path command
  • 435. Use of software with known vulnerabilities in environments
  • 436. Security controls bypass or absence - Fingerprint

• Swift

  • 006. Authentication mechanism absence or evasion
  • 007. Cross-site request forgery
  • 011. Use of software with known vulnerabilities
  • 013. Insecure object reference
  • 014. Insecure functionality
  • 015. Insecure authentication method - Basic
  • 016. Insecure encryption algorithm - SSL/TLS
  • 017. Sensitive information sent insecurely
  • 019. Administrative credentials stored in cache memory
  • 020. Non-encrypted confidential information
  • 022. Use of an insecure channel
  • 026. User enumeration
  • 028. Insecure temporary files
  • 034. Insecure generation of random numbers
  • 038. Business information leak
  • 052. Insecure encryption algorithm
  • 060. Insecure service configuration - Host verification
  • 066. Technical information leak - Console functions
  • 067. Improper resource allocation
  • 068. Insecure session expiration time
  • 069. Weak CAPTCHA
  • 076. Insecure session management
  • 091. Log injection
  • 092. Insecure encryption algorithm - Anonymous cipher suites
  • 094. Insecure encryption algorithm - Cipher Block Chaining
  • 096. Insecure deserialization
  • 113. Improper type assignation
  • 115. Security controls bypass or absence
  • 117. Unverifiable files
  • 119. Metadata with sensitive information
  • 124. Race condition
  • 126. Lack of isolation methods
  • 138. Inappropriate coding practices
  • 140. Insecure exceptions - Empty or no catch
  • 142. Sensitive information in source code - API Key
  • 145. Inappropriate coding practices - Cyclomatic complexity
  • 147. Insecure encryption algorithm - SSLContext
  • 156. Uncontrolled external site redirect
  • 172. Insecure service configuration - App Backup
  • 173. Insecure service configuration - Backup
  • 183. Debugging enabled in production
  • 184. Lack of data validation
  • 191. Lack of data validation - Responses
  • 194. Lack of data validation - Input Length
  • 197. Lack of data validation - Numbers
  • 199. Lack of data validation - Emails
  • 201. Unauthorized access to files
  • 204. Insufficient data authenticity validation
  • 210. Security controls bypass or absence - Facial Recognition
  • 233. Incomplete funcional code
  • 237. Technical information leak - Print Functions
  • 240. Authentication mechanism absence or evasion - OTP
  • 262. Insecure encryption algorithm - SHA1
  • 265. Insecure encryption algorithm - AES
  • 268. Insecure service configuration - Webview
  • 269. Insecure encryption algorithm - Blowfish
  • 270. Insecure functionality - File Creation
  • 271. Insecure functionality - Password management
  • 273. Insecure functionality - Fingerprint
  • 275. Non-encrypted confidential information - Local data
  • 284. Non-encrypted confidential information - Base 64
  • 285. Insecure service configuration - App Transport Security
  • 298. Authentication mechanism absence or evasion - Redirect
  • 310. Unauthorized access to screen
  • 317. Improper resource allocation - Memory leak
  • 332. Use of insecure channel - Source code
  • 340. Lack of data validation - Special Characters
  • 345. Security controls bypass or absence - Session Invalidation
  • 346. Excessive privileges - Mobile App
  • 359. Sensitive information in source code - Credentials
  • 370. Authentication mechanism absence or evasion - Security Image
  • 378. Non-encrypted confidential information - Hexadecimal
  • 382. Insufficient data authenticity validation - Front bypass
  • 391. Inappropriate coding practices - Unused properties
  • 393. Use of software with known vulnerabilities in development
  • 395. Insecure generation of random numbers - Static IV
  • 421. Insecure encryption algorithm - Insecure Elliptic Curve
  • 428. Inappropriate coding practices - invalid file
  • 435. Use of software with known vulnerabilities in environments

• Typescript

  • 002. Asymmetric denial of service
  • 003. Symmetric denial of service
  • 004. Remote command execution
  • 005. Privilege escalation
  • 006. Authentication mechanism absence or evasion
  • 007. Cross-site request forgery
  • 008. Reflected cross-site scripting (XSS)
  • 009. Sensitive information in source code
  • 010. Stored cross-site scripting (XSS)
  • 013. Insecure object reference
  • 015. Insecure authentication method - Basic
  • 017. Sensitive information sent insecurely
  • 019. Administrative credentials stored in cache memory
  • 021. XPath injection
  • 022. Use of an insecure channel
  • 023. Uncontrolled external site redirect - Host Header Injection
  • 026. User enumeration
  • 027. Insecure file upload
  • 028. Insecure temporary files
  • 029. Inadequate file size control
  • 030. Sensitive information sent via URL parameters
  • 033. Password change without identity check
  • 034. Insecure generation of random numbers
  • 037. Technical information leak
  • 038. Business information leak
  • 039. Improper authorization control for web services
  • 041. Enabled default credentials
  • 042. Insecurely generated cookies
  • 043. Insecure or unset HTTP headers - Content-Security-Policy
  • 044. Insecure HTTP methods enabled
  • 047. Automatic information enumeration
  • 050. Guessed weak credentials
  • 051. Cracked weak credentials
  • 052. Insecure encryption algorithm
  • 053. Lack of protection against brute force attacks
  • 057. Asymmetric denial of service - Content length
  • 059. Sensitive information stored in logs
  • 061. Remote File Inclusion
  • 062. Concurrent sessions
  • 063. Lack of data validation - Path Traversal
  • 064. Traceability loss - Server's clock
  • 066. Technical information leak - Console functions
  • 067. Improper resource allocation
  • 068. Insecure session expiration time
  • 069. Weak CAPTCHA
  • 071. Insecure or unset HTTP headers - Referrer-Policy
  • 076. Insecure session management
  • 078. Insecurely generated token
  • 079. Non-upgradable dependencies
  • 080. Business information leak - Customers or providers
  • 083. XML injection (XXE)
  • 089. Lack of data validation - Trust boundary violation
  • 090. CSV injection
  • 091. Log injection
  • 092. Insecure encryption algorithm - Anonymous cipher suites
  • 093. Hidden fields manipulation
  • 094. Insecure encryption algorithm - Cipher Block Chaining
  • 095. Data uniqueness not properly verified
  • 096. Insecure deserialization
  • 098. External control of file name or path
  • 100. Server-side request forgery (SSRF)
  • 102. Email uniqueness not properly verified
  • 106. NoSQL injection
  • 107. LDAP injection
  • 108. Improper control of interaction frequency
  • 111. Out-of-bounds read
  • 113. Improper type assignation
  • 115. Security controls bypass or absence
  • 119. Metadata with sensitive information
  • 120. Improper dependency pinning
  • 121. HTTP parameter pollution
  • 123. Local file inclusion
  • 124. Race condition
  • 125. Directory listing
  • 127. Lack of data validation - Type confusion
  • 128. Insecurely generated cookies - HttpOnly
  • 129. Insecurely generated cookies - SameSite
  • 130. Insecurely generated cookies - Secure
  • 131. Insecure or unset HTTP headers - Strict Transport Security
  • 133. Insecure encryption algorithm - Perfect Forward Secrecy
  • 134. Insecure or unset HTTP headers - CORS
  • 135. Insecure or unset HTTP headers - X-XSS Protection
  • 136. Insecure or unset HTTP headers - Cache Control
  • 137. Insecure or unset HTTP headers - X-Permitted-Cross-Domain-Policies
  • 138. Inappropriate coding practices
  • 140. Insecure exceptions - Empty or no catch
  • 141. Lack of data validation - URL
  • 142. Sensitive information in source code - API Key
  • 143. Inappropriate coding practices - Eval function
  • 145. Inappropriate coding practices - Cyclomatic complexity
  • 146. SQL injection
  • 147. Insecure encryption algorithm - SSLContext
  • 148. Use of an insecure channel - FTP
  • 149. Use of an insecure channel - SMTP
  • 152. Insecure or unset HTTP headers - X-Frame Options
  • 153. Insecure or unset HTTP headers - Accept
  • 154. Time-based SQL Injection
  • 155. SQL Injection - Headers
  • 156. Uncontrolled external site redirect
  • 159. Excessive privileges
  • 160. Excessive privileges - Temporary Files
  • 184. Lack of data validation
  • 185. Lack of data validation - Header x-amzn-RequestId
  • 187. Lack of data validation - Source Code
  • 189. Lack of data validation - Content Spoofing
  • 190. Lack of data validation - Session Cookie
  • 191. Lack of data validation - Responses
  • 192. Lack of data validation - Reflected Parameters
  • 193. Lack of data validation - Host Header Injection
  • 194. Lack of data validation - Input Length
  • 195. Lack of data validation - Headers
  • 196. Lack of data validation - Dates
  • 197. Lack of data validation - Numbers
  • 199. Lack of data validation - Emails
  • 200. Traceability loss
  • 201. Unauthorized access to files
  • 204. Insufficient data authenticity validation
  • 211. Asymmetric denial of service - ReDoS
  • 213. Business information leak - JWT
  • 214. Business information leak - Credentials
  • 216. Business information leak - Source Code
  • 217. Business information leak - Credit Cards
  • 220. Business information leak - Token
  • 221. Business information leak - Users
  • 226. Business information leak - Personal Information
  • 228. Business information leak - Analytics
  • 233. Incomplete funcional code
  • 235. Technical information leak - Headers
  • 236. Technical information leak - SourceMap
  • 237. Technical information leak - Print Functions
  • 238. Technical information leak - API
  • 239. Technical information leak - Errors
  • 240. Authentication mechanism absence or evasion - OTP
  • 245. Non-encrypted confidential information - Credit Cards
  • 246. Non-encrypted confidential information - DB
  • 248. Non-encrypted confidential information - LDAP
  • 249. Non-encrypted confidential information - Credentials
  • 254. Automatic information enumeration - Credit Cards
  • 261. Insecure encryption algorithm - DSA
  • 262. Insecure encryption algorithm - SHA1
  • 263. Insecure encryption algorithm - MD5
  • 264. Insecure encryption algorithm - TripleDES
  • 265. Insecure encryption algorithm - AES
  • 269. Insecure encryption algorithm - Blowfish
  • 270. Insecure functionality - File Creation
  • 271. Insecure functionality - Password management
  • 272. Insecure functionality - Masking
  • 273. Insecure functionality - Fingerprint
  • 274. Restricted fields manipulation
  • 276. Sensitive information sent via URL parameters - Session
  • 280. Session Fixation
  • 282. Insecure encryption algorithm - ECB
  • 283. Automatic information enumeration - Personal Information
  • 284. Non-encrypted confidential information - Base 64
  • 286. Insecure object reference - Personal information
  • 287. Insecure object reference - Corporate information
  • 288. Insecure object reference - Financial information
  • 289. Technical information leak - Logs
  • 291. Business information leak - Financial Information
  • 295. Insecure session management - Change Password
  • 296. Weak credential policy - Password Change Limit
  • 297. SQL injection - Code
  • 298. Authentication mechanism absence or evasion - Redirect
  • 301. Concurrent sessions control bypass
  • 302. Insecure functionality - Session management
  • 305. Security controls bypass or absence - Data creation
  • 306. Insecure object reference - Files
  • 307. Insecure object reference - Data
  • 308. Enabled default configuration
  • 309. Insecurely generated token - JWT
  • 317. Improper resource allocation - Memory leak
  • 318. Insecurely generated token - Validation
  • 321. Lack of data validation - HTML code
  • 322. Insecurely generated token - Lifespan
  • 324. Insecure functionality - User management
  • 328. Insecure object reference - Session management
  • 329. Insecure or unset HTTP headers - Content-Type
  • 330. Lack of protection against brute force attacks - Credentials
  • 332. Use of insecure channel - Source code
  • 336. Business information leak - Corporate information
  • 337. Insecure session management - CSRF Fixation
  • 340. Lack of data validation - Special Characters
  • 341. Lack of data validation - OTP
  • 344. Lack of data validation - Non Sanitized Variables
  • 345. Security controls bypass or absence - Session Invalidation
  • 349. Technical information leak - Credentials
  • 353. Lack of data validation - Token
  • 354. Insecure file upload - Files Limit
  • 355. Insufficient data authenticity validation - Checksum verification
  • 359. Sensitive information in source code - Credentials
  • 362. Technical information leak - Content response
  • 363. Weak credential policy - Password strength
  • 364. Weak credential policy - Temporary passwords
  • 365. Authentication mechanism absence or evasion - Response tampering
  • 369. Insecure object reference - User deletion
  • 371. DOM-Based cross-site scripting (XSS)
  • 372. Use of an insecure channel - HTTP
  • 378. Non-encrypted confidential information - Hexadecimal
  • 383. Insecurely generated token - OTP
  • 384. Inappropriate coding practices - Wildcard export
  • 388. Insecure authentication method - NTLM
  • 391. Inappropriate coding practices - Unused properties
  • 395. Insecure generation of random numbers - Static IV
  • 404. OS Command Injection
  • 405. Excessive privileges - Access Mode
  • 417. Account Takeover
  • 420. Password reset poisoning
  • 421. Insecure encryption algorithm - Insecure Elliptic Curve
  • 422. Server side template injection
  • 425. Server side cross-site scripting
  • 432. Inappropriate coding practices - relative path command
  • 435. Use of software with known vulnerabilities in environments

Free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.