CodeAnt AI home pagelight logodark logo
  • Dashboard
  • Dashboard
  • Documentation
  • Demo Call with CEO
  • Blog
  • Slack
  • Get Started
    • CodeAnt AI
    • Setup
    • Control Center
    • Pull Request Review
    • IDE
    • Compliance
    • Anti-Patterns
    • Code Governance
    • Infrastructure Security Database
    • Application Security Database
      • Apex
      • Bash
      • C
      • Clojure
      • Cpp
      • Csharp
      • Dockerfile
      • Elixir
      • Fingerprints
      • Generic
      • Go
      • Html
      • Java
      • Javascript
      • Json
      • Kotlin
        • Generic
        • Java-jwt
        • Jedis
        • Jjwt
        • Ktor
        • Lang
          • Security
          • Security
        • Mongo
        • Okhttp
        • Openai
        • Spring
        • Sql
        • Xxe
      • Ocaml
      • Php
      • Problem-based-packs
      • Python
      • Ruby
      • Rust
      • Scala
      • Solidity
      • Swift
      • Terraform
      • Typescript
      • Yaml
    Lang

    Security

    A cookie was detected without setting the ‘secure’ flag. The ‘secure’ flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the ‘secure’ flag by calling ‘$COOKIE.setSecure(true);‘
    Likelihood: LOW
    Confidence: LOW
    CWE:
    - CWE-614: Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute
    OWASP:
    - A05:2021 - Security Misconfiguration

    A cookie was detected without setting the ‘HttpOnly’ flag. The ‘HttpOnly’ flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the ‘HttpOnly’ flag by calling ‘cookie.setHttpOnly(true);‘
    Likelihood: LOW
    Confidence: LOW
    CWE:
    - CWE-1004: Sensitive Cookie Without ‘HttpOnly’ Flag
    OWASP:
    - A05:2021 - Security Misconfiguration

    GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted.
    Likelihood: LOW
    Confidence: LOW
    CWE:
    - CWE-323: Reusing a Nonce, Key Pair in Encryption
    OWASP:
    - A02:2021 - Cryptographic Failures

    ‘Integer.toHexString()’ strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use ‘String.format(“%02X”, …)’ instead.
    Likelihood: LOW
    Confidence: LOW
    CWE:
    - CWE-704: Incorrect Type Conversion or Cast
    OWASP:
    - A
    - 0
    - 3
    - :
    - 2
    - 0
    - 1
    - 7
    -

    - -
    -

    - S
    - e
    - n
    - s
    - i
    - t
    - i
    - v
    - e
    -

    - D
    - a
    - t
    - a
    -

    - E
    - x
    - p
    - o
    - s
    - u
    - r
    - e

    This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by ‘SSLSocketFactory’ or ‘SSLServerSocketFactory’ instead
    Likelihood: LOW
    Confidence: LOW
    CWE:
    - CWE-319: Cleartext Transmission of Sensitive Information
    OWASP:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures

    DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2.
    Likelihood: LOW
    Confidence: LOW
    CWE:
    - CWE-326: Inadequate Encryption Strength
    OWASP:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures

    Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY.
    Likelihood: LOW
    Confidence: MEDIUM
    CWE:
    - CWE-327: Use of a Broken or Risky Cryptographic Algorithm
    OWASP:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures

    A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.
    Likelihood: LOW
    Confidence: LOW
    CWE:
    - CWE-78: Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
    OWASP:
    - A01:2017 - Injection
    - A03:2021 - Injection

    Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
    Likelihood: LOW
    Confidence: MEDIUM
    CWE:
    - CWE-328: Use of Weak Hash
    OWASP:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures

    Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html for more information.
    Likelihood: LOW
    Confidence: MEDIUM
    CWE:
    - CWE-287: Improper Authentication
    OWASP:
    - A02:2017 - Broken Authentication
    - A07:2021 - Identification and Authentication Failures

    NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance(“AES/CBC/PKCS7PADDING”). See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions for more information.
    Likelihood: LOW
    Confidence: MEDIUM
    CWE:
    - CWE-327: Use of a Broken or Risky Cryptographic Algorithm
    OWASP:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures

    RSA keys should be at least 2048 bits based on NIST recommendation.
    Likelihood: HIGH
    Confidence: HIGH
    CWE:
    - CWE-326: Inadequate Encryption Strength
    OWASP:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures

    Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
    Likelihood: LOW
    Confidence: MEDIUM
    CWE:
    - CWE-327: Use of a Broken or Risky Cryptographic Algorithm
    OWASP:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures

    Ktor request xssHardcoded secret key spec
    twitterlinkedin
    Powered by Mintlify