> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codeant.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

<AccordionGroup>
  <Accordion title="cookie-missing-secure-flag">
    A cookie was detected without setting the 'secure' flag. The 'secure' flag for cookies prevents the client from transmitting the cookie over insecure channels such as HTTP. Set the 'secure' flag by calling '\$COOKIE.setSecure(true);'<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
    <br />**OWASP**: <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="cookie-missing-httponly">
    A cookie was detected without setting the 'HttpOnly' flag. The 'HttpOnly' flag for cookies instructs the browser to forbid client-side scripts from reading the cookie. Set the 'HttpOnly' flag by calling 'cookie.setHttpOnly(true);'<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
    <br />**OWASP**: <br />- A05:2021 - Security Misconfiguration
  </Accordion>

  <Accordion title="gcm-detection">
    GCM detected, please check that IV/nonce is not reused, an Initialization Vector (IV) is a nonce used to randomize the encryption, so that even if multiple messages with identical plaintext are encrypted, the generated corresponding ciphertexts are different.Unlike the Key, the IV usually does not need to be secret, rather it is important that it is random and unique. Certain encryption schemes the IV is exchanged in public as part of the ciphertext. Reusing same Initialization Vector with the same Key to encrypt multiple plaintext blocks allows an attacker to compare the ciphertexts and then, with some assumptions on the content of the messages, to gain important information about the data being encrypted.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-323: Reusing a Nonce, Key Pair in Encryption
    <br />**OWASP**: <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="bad-hexa-conversion">
    'Integer.toHexString()' strips leading zeroes from each byte if read byte-by-byte. This mistake weakens the hash value computed since it introduces more collisions. Use 'String.format("%02X", ...)' instead.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-704: Incorrect Type Conversion or Cast
    <br />**OWASP**: <br />- A
    <br />- 0
    <br />- 3
    <br />- :
    <br />- 2
    <br />- 0
    <br />- 1
    <br />- 7
    <br />-\
    <br />- -
    <br />-\
    <br />- S
    <br />- e
    <br />- n
    <br />- s
    <br />- i
    <br />- t
    <br />- i
    <br />- v
    <br />- e
    <br />-\
    <br />- D
    <br />- a
    <br />- t
    <br />- a
    <br />-\
    <br />- E
    <br />- x
    <br />- p
    <br />- o
    <br />- s
    <br />- u
    <br />- r
    <br />- e
  </Accordion>

  <Accordion title="unencrypted-socket">
    This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-319: Cleartext Transmission of Sensitive Information
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="defaulthttpclient-is-deprecated">
    DefaultHttpClient is deprecated. Further, it does not support connections using TLS1.2, which makes using DefaultHttpClient a security hazard. Use SystemDefaultHttpClient instead, which supports TLS1.2.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-326: Inadequate Encryption Strength
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="ecb-cipher">
    Cipher in ECB mode is detected. ECB mode produces the same output for the same input each time which allows an attacker to intercept and replay the data. Further, ECB mode does not provide any integrity checking. See [https://find-sec-bugs.github.io/bugs.htm#CIPHER\_INTEGRITY](https://find-sec-bugs.github.io/bugs.htm#CIPHER_INTEGRITY).<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-327: Use of a Broken or Risky Cryptographic Algorithm
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="command-injection-formatted-runtime-call">
    A formatted or concatenated string was detected as input to a java.lang.Runtime call. This is dangerous if a variable is controlled by user input and could result in a command injection. Ensure your variables are not controlled by users or sufficiently sanitized.<br />**Likelihood**: LOW<br />**Confidence**: LOW<br />**CWE**: <br />- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    <br />**OWASP**: <br />- A01:2017 - Injection
    <br />- A03:2021 - Injection
  </Accordion>

  <Accordion title="use-of-md5">
    Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-328: Use of Weak Hash
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="anonymous-ldap-bind">
    Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP. See [https://docs.oracle.com/javase/tutorial/jndi/ldap/auth\_mechs.html](https://docs.oracle.com/javase/tutorial/jndi/ldap/auth_mechs.html) for more information.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-287: Improper Authentication
    <br />**OWASP**: <br />- A02:2017 - Broken Authentication
    <br />- A07:2021 - Identification and Authentication Failures
  </Accordion>

  <Accordion title="no-null-cipher">
    NullCipher was detected. This will not encrypt anything; the cipher text will be the same as the plain text. Use a valid, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING"). See [https://owasp.org/www-community/Using\_the\_Java\_Cryptographic\_Extensions](https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions) for more information.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-327: Use of a Broken or Risky Cryptographic Algorithm
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="use-of-weak-rsa-key">
    RSA keys should be at least 2048 bits based on NIST recommendation.<br />**Likelihood**: HIGH<br />**Confidence**: HIGH<br />**CWE**: <br />- CWE-326: Inadequate Encryption Strength
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>

  <Accordion title="use-of-sha1">
    Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.<br />**Likelihood**: LOW<br />**Confidence**: MEDIUM<br />**CWE**: <br />- CWE-327: Use of a Broken or Risky Cryptographic Algorithm
    <br />**OWASP**: <br />- A03:2017 - Sensitive Data Exposure
    <br />- A02:2021 - Cryptographic Failures
  </Accordion>
</AccordionGroup>