Branch2

[elangosenthilnathan]

No description provided.

[elangosenthilnathan]

Checking analysis of application elangosenthilnathan-shiftleft-java-demo.

Using sl version 0.9.3356 (169fef89451c4c02b1103a1d0d8aab4225c6ca57).

Checking findings on scan 5.

Results per rule:

• report: FAIL
  (234 matched vulnerabilities; configured threshold is 0).

  First 5 findings:

  ID	CVSS	Rating	CVE	Title
  127	10.0	critical	CVE-2018-14721	FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to b…
  300	10.0	critical	GMS-2022-559	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core.
  317	10.0	critical	GMS-2022-558	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-beans.
  336	10.0	critical	GMS-2022-560	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework.boot:spring-boot-starter-web.
  90	9.8	critical	CVE-2017-5929	QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderCli…

  Severity rating	Count
  Critical	45
  High	97
  Medium	84
  Low	8

  Finding Type	Count
  Oss_vuln	201
  Vuln	33

  Category	Count
  Cross-Site Scripting	15
  Insecure Direct Object Reference	5
  Header Injection	3
  Security Best Practices	2
  Open Redirect	2
  Weak Hash	1
  Timing Attack	1
  Remote Code Execution	1
  Log Forging	1
  Directory Traversal	1
  Deserialization	1

  OWASP 2021 Category	Count
  A03-Injection	24
  A01-Broken-Access-Control	3
  A05-Security-Misconfiguration	2
  A09-Security-Logging-And-Monitoring-Failures	1
  A08-Software-And-Data-Integrity-Failures	1
  A07-Identification-And-Authentication-Failures	1
  A02-Cryptographic-Failures	1

1 rule failed.