Open
Conversation
Owner
Author
|
|
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 93 | 9.0 | critical | Remote Code Execution: Code Injection Through Attacker-controlled Data via foo in SearchController.doGetSearch |
| 94 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.checkCookie |
| 95 | 9.0 | critical | Directory Traversal: Attacker-controlled Data Used in File Path via request in CustomerController.saveSettings |
| 72 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via foo in SearchController.doGetSearch |
| 73 | 8.0 | high | Cross-Site Scripting: Attacker-Controlled Data Used as HTML Content via customerId in CustomerController.debug |
| Severity rating | Count |
|---|---|
| Critical | 3 |
| High | 9 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Cross-Site Scripting | 8 |
| Directory Traversal | 2 |
| Remote Code Execution | 1 |
| Deserialization | 1 |
| OWASP 2021 Category | Count |
|---|---|
| A03-Injection | 9 |
| A01-Broken-Access-Control | 2 |
| A08-Software-And-Data-Integrity-Failures | 1 |
Allow 0 secrets: FAIL
(7 matched vulnerabilities; configured threshold is 0).
Findings:
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 65 | 0.0 | none | Hardcoded Sensitive Secrets/Credentials in Config |
| 66 | 0.0 | none | Hardcoded Sensitive Secrets/Credentials in Config |
| 67 | 0.0 | none | Hardcoded Sensitive Secrets/Credentials in Config |
| 68 | 0.0 | none | Hardcoded Sensitive Secrets/Credentials in Config |
| 69 | 0.0 | none | Hardcoded Sensitive Secrets/Credentials in Config |
| 70 | 0.0 | none | Hardcoded Sensitive Secrets/Credentials in Config |
| 71 | 0.0 | none | Hardcoded Sensitive Secrets/Credentials in Config |
| Severity rating | Count |
|---|---|
| Critical | 0 |
| High | 0 |
| Medium | 0 |
| Low | 0 |
| Category | Count |
|---|---|
| Secret | 7 |
| User | 5 |
| Password | 5 |
| URI | 1 |
| Infra | 1 |
| IaaS | 1 |
| Amazon | 1 |
| Access ID | 1 |
No reachable SCA findings: FAIL
(43 matched vulnerabilities; configured threshold is 0).
First 10 findings:
| ID | CVSS | Rating | CVE | Title |
|---|---|---|---|---|
| 310 | 10.0 | critical | GMS-2022-559 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core. |
| 235 | 9.8 | critical | CVE-2018-8014 | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insec… |
| 245 | 9.8 | critical | CVE-2020-1938 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as ha… |
| 248 | 9.8 | critical | CVE-2017-5651 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing.… |
| 295 | 9.8 | critical | CVE-2018-1270 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over … |
| 303 | 9.8 | critical | CVE-2018-1275 | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over … |
| 312 | 9.8 | critical | CVE-2016-1000027 | Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. De… |
| 234 | 9.1 | critical | CVE-2017-5648 | While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.R… |
| 309 | 8.8 | high | CVE-2020-5421 | In Spring Framework the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessioni… |
| 262 | 8.6 | high | CVE-2022-25762 | If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apac… |
| Severity rating | Count |
|---|---|
| Critical | 8 |
| High | 35 |
| Medium | 0 |
| Low | 0 |
No critical or high container findings: pass
(0 matched vulnerabilities; configured threshold is 0).
3 rules failed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.