Skip to content

Conversation

@ast-phoenix
Copy link
Collaborator

Updates checkmarx-ast-cli to 2.3.19

Auto-generated by [create-pull-request][2]

@cx-ben-alvo
Copy link
Collaborator

cx-ben-alvo commented Apr 17, 2025

Logo
Checkmarx One – Scan Summary & Detailse4c08522-3723-46c9-bc41-69c15277b9b7

New Issues (11)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
CRITICAL Code_Injection /src/test/resources/python-vul-file.py: 25
detailsThe application's do_GET method receives and dynamically executes user-controlled code using exec, at line 57 of /src/test/resources/python-vul-fil...
ID: Pj46V8ZbbhrIv3XExEc%2FixwLG10%3D
Attack Vector
CRITICAL Code_Injection /src/test/resources/python-vul-file.py: 25
detailsThe application's do_GET method receives and dynamically executes user-controlled code using exec, at line 57 of /src/test/resources/python-vul-fil...
ID: 968DquMd1%2B%2Bd5VYCtTiUx0%2FUEkQ%3D
Attack Vector
CRITICAL Code_Injection /src/test/resources/python-vul-file.py: 56
detailsThe application's do_GET method receives and dynamically executes user-controlled code using exec, at line 57 of /src/test/resources/python-vul-fil...
ID: CxJQK%2FR5GA07kVEuTVQ%2F9Cinrco%3D
Attack Vector
CRITICAL Command_Injection /src/test/resources/python-vul-file.py: 25
detailsThe application's do_GET method calls an OS (shell) command with envs, at line 57 of /src/test/resources/python-vul-file.py, using an untrusted str...
ID: 3XOHOUCcJ5vEH41x2cNQeV09nME%3D
Attack Vector
CRITICAL Command_Injection /src/test/resources/python-vul-file.py: 25
detailsThe application's do_GET method calls an OS (shell) command with envs, at line 57 of /src/test/resources/python-vul-file.py, using an untrusted str...
ID: IocVQr6NbkjjsiUrf6hFI1HWcNU%3D
Attack Vector
CRITICAL Command_Injection /src/test/resources/python-vul-file.py: 56
detailsThe application's do_GET method calls an OS (shell) command with envs, at line 57 of /src/test/resources/python-vul-file.py, using an untrusted str...
ID: SppN4%2BmDsQiDRH5A9iNLB35N%2FdE%3D
Attack Vector
CRITICAL Stored_XSS /src/test/resources/python-vul-file.py: 26
detailsThe method do_GET embeds untrusted data in generated output with write, at line 80 of /src/test/resources/python-vul-file.py. This untrusted data i...
ID: c32uR7szSc3A5XOPWWtXEanF0bw%3D
Attack Vector
CRITICAL Stored_XSS /src/test/resources/python-vul-file.py: 37
detailsThe method do_GET embeds untrusted data in generated output with write, at line 80 of /src/test/resources/python-vul-file.py. This untrusted data i...
ID: p6PRV4rf34dtTSGf9Z1UCd9PeCk%3D
Attack Vector
CRITICAL Stored_XSS /src/test/resources/python-vul-file.py: 35
detailsThe method do_GET embeds untrusted data in generated output with write, at line 80 of /src/test/resources/python-vul-file.py. This untrusted data i...
ID: MY28ZHZglWnSFyh1%2FzPM468a%2Bl8%3D
Attack Vector
MEDIUM CVE-2020-15250 Maven-junit:junit-4.10
detailsRecommended version: 4.13.1
Description: In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like sys...
Attack Vector: LOCAL
Attack Complexity: LOW

ID: jPNx6Rhz1%2FmdtkXhKbVoDGDR%2FX71CEHVPo6IsPeHa98%3D
Vulnerable Package
MEDIUM Missing_HSTS_Header /src/test/resources/python-vul-file.py: 76
detailsThe web-application does not define an HSTS header, leaving it vulnerable to attack.
ID: clgolK0H6TtBF9SvGwT233kkgps%3D
Attack Vector

@cx-daniel-greenspan cx-daniel-greenspan merged commit 8db9b0c into main Apr 17, 2025
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants