-
Notifications
You must be signed in to change notification settings - Fork 80
/
Filter_SecComply.txt
executable file
·271 lines (270 loc) · 12 KB
/
Filter_SecComply.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
Code Correctness: Arithmetic Operation on Boolean
Code Correctness: Function Not Invoked
Code Correctness: Function Returns Stack Address
Code Correctness: Macro Misuse
Code Correctness: Memory Free on Stack Variable
Code Correctness: Premature Thread Termination
Dead Code
Double Free
Format String: Argument Number Mismatch
Format String: Argument Type Mismatch
Memory Leak
Memory Leak: Reallocation
Null Dereference
Obsolete
Obsolete: Inadequate Pointer Validation
Poor Style: Redundant Initialization
Poor Style: Value Never Read
Poor Style: Variable Never Used
Portability Flaw
Redundant Null Check
Type Mismatch: Integer to Character
Type Mismatch: Negative to Unsigned
Type Mismatch: Signed to Unsigned
Undefined Behavior
Undefined Behavior: Redundant Delete
Uninitialized Variable
Use After Free
Missing Check against Null
Often Misused: Authentication(gethostby)
Often Misused: Authentication(getlogin)
Often Misused: Exception Handling(_alloca)
Often Misused: Exception Handling(criticalsection)
Often Misused: File System(getwd)
Often Misused: File System(readlink)
Often Misused: File System(realpath)
Often Misused: File System(umask)
Often Misused: File System(windows)
Often Misused: Privilege Management
Often Misused: Privilege Management(setuid)
Often Misused: Strings(_mbs)
Often Misused: Strings(multibytewidechar)
Unchecked Return Value
System Information Leak
Insecure Compiler Optimization
Insecure Compiler Optimization: Pointer Arithmetic
Code Correctness: Erroneous Synchronization
Insecure Temporary File
Race Condition: File System Access
Race Condition: Signal Handling
ADF Faces Bad Practices: unsecure Attribute
Castor Bad Practices: Query Mode Not Read-Only
Castor Bad Practices: Unspecified Query Mode
Code Correctness: Call to System.gc()
Code Correctness: Class Does Not Implement equals
Code Correctness: Erroneous finalize() Method
Code Correctness: toString on Array
Dangerous Field
Dangerous Method
Dangerous Type
EJB Bad Practices: Use of AWT/Swing
EJB Bad Practices: Use of Class Loader
EJB Bad Practices: Use of Sockets
EJB Bad Practices: Use of Synchronization Primitives
EJB Bad Practices: Use of java.io
Immutable Classes: Field Mutation
Immutable Classes: Non-final Fields
Immutable Classes: Public Mutable Fields
J2EE Bad Practices: Sockets
J2EE Bad Practices: getConnection()
Missing Check against Null
Missing Check for Null Parameter
Object Model Violation: Erroneous clone() Method
Object Model Violation: Just one of equals() and hashCode() Defined
Object Model Violation: Just one of restoreState() and saveState() Defined
Obsolete: Deprecated by ESAPI
Often Misused: Authentication
Often Misused: Encoding
Password Management: Weak Redundancy
Poor Style: Explicit Call to finalize()
Unchecked Return Value
Code Correctness: Call to Thread.run()
Code Correctness: Call to notify()
Code Correctness: Class Does Not Implement Cloneable
Code Correctness: Erroneous Class Compare
Code Correctness: Erroneous Negative Value
Code Correctness: Erroneous String Compare
Code Correctness: Erroneous Zero Value
Code Correctness: Incorrect serialPersistentFields Modifier
Code Correctness: Misspelled Method Name
Code Correctness: Non-Synchronized Method Overrides Synchronized Method
Code Correctness: null Argument to equals()
Dead Code: Empty Try Block
Dead Code: Expression is Always false
Dead Code: Expression is Always true
Dead Code: Unused Field
Dead Code: Unused Method
Null Dereference
Obsolete
Poor Style: Confusing Naming(class_and_member)
Poor Style: Confusing Naming(member_and_method)
Poor Style: Empty Synchronized Block
Poor Style: Identifier Contains Dollar Symbol ($)
Poor Style: Redundant Initialization
Poor Style: Value Never Read
Redundant Null Check
Unreleased Resource: Synchronization
ADF Bad Practices: Default url-invoke-disallowed Setting
Cross-Site Request Forgery
Hidden Field
Insecure Storage: Android External Storage
J2EE Bad Practices: Leftover Debug Code
JavaScript Hijacking: Ad Hoc Ajax
JavaScript Hijacking: Vulnerable Framework
Poor Logging Practice: Logger Not Declared Static Final
Poor Logging Practice: Multiple Loggers
Poor Logging Practice: Use of a System Output Stream
Poor Style: Non-final Public Static Field
System Information Leak
System Information Leak: Apache Axis
System Information Leak: Apache Axis 2
System Information Leak: HTML Comment in JSP
System Information Leak: Incomplete Servlet Error Handling
System Information Leak: Overly Broad SQL Logging
Trust Boundary Violation
Unsafe Mobile Code: Access Violation
Unsafe Mobile Code: Database Access
Unsafe Mobile Code: Inner Class
Unsafe Mobile Code: Public finalize() Method
Unsafe Mobile Code: Unsafe Array Declaration
Unsafe Mobile Code: Unsafe Public Field
Axis 2 Misconfiguration: Debug Information
Axis 2 Misconfiguration: Insecure Message Security
Axis 2 Misconfiguration: Insecure Transport Receiver
Axis 2 Misconfiguration: Insecure Transport Sender
Axis 2 Service Provider Misconfiguration: Inbound WS-Security Not Enabled
Axis 2 Service Provider Misconfiguration: Missing Inbound Encryption
Axis 2 Service Provider Misconfiguration: Missing Inbound Signature
Axis 2 Service Provider Misconfiguration: Missing Inbound Timestamp
Axis 2 Service Provider Misconfiguration: Missing Outbound Encryption
Axis 2 Service Provider Misconfiguration: Missing Outbound Signature
Axis 2 Service Provider Misconfiguration: Missing Outbound Timestamp
Axis 2 Service Provider Misconfiguration: Outbound WS-Security Not Enabled
Axis 2 Service Provider Misconfiguration: Unsigned Inbound Timestamp
Axis 2 Service Provider Misconfiguration: Unsigned Outbound Timestamp
Axis 2 Service Provider Misconfiguration: WS-Security Not Enabled
Axis 2 Service Provider Misconfiguration: Weak Token
Axis 2 Service Requester Misconfiguration: Inbound WS-Security Not Enabled
Axis 2 Service Requester Misconfiguration: Missing Inbound Encryption
Axis 2 Service Requester Misconfiguration: Missing Inbound Signature
Axis 2 Service Requester Misconfiguration: Missing Inbound Timestamp
Axis 2 Service Requester Misconfiguration: Missing Outbound Encryption
Axis 2 Service Requester Misconfiguration: Missing Outbound Signature
Axis 2 Service Requester Misconfiguration: Missing Outbound Timestamp
Axis 2 Service Requester Misconfiguration: Outbound WS-Security Not Enabled
Axis 2 Service Requester Misconfiguration: Plain Text Password
Axis 2 Service Requester Misconfiguration: Unsigned Inbound Timestamp
Axis 2 Service Requester Misconfiguration: Unsigned Outbound Timestamp
Axis 2 Service Requester Misconfiguration: WS-Security Not Enabled
Axis 2 Service Requester Misconfiguration: Weak Token
Axis Misconfiguration: Debug Information
Axis Misconfiguration: Service Enumeration
Axis Service Provider Misconfiguration: Plain Text Password
Axis Service Provider Misconfiguration: Weak Token
Axis Service Requester Misconfiguration: Plain Text Password
Axis Service Requester Misconfiguration: Weak Token
Build Misconfiguration: Dynamic Dependency Version Usage
Build Misconfiguration: External Ant Dependency Repository
Build Misconfiguration: External Ivy Dependency Repository
Build Misconfiguration: External Maven Dependency Repository
Flex Misconfiguration: Debug Information
J2EE Misconfiguration: Cookies Disabled
J2EE Misconfiguration: Debug Information
J2EE Misconfiguration: Direct JSP Access
J2EE Misconfiguration: Duplicate Security Role
J2EE Misconfiguration: Duplicate Servlet Mapping
J2EE Misconfiguration: Excessive Servlet Mappings
J2EE Misconfiguration: Excessive Session Timeout
J2EE Misconfiguration: Incomplete Error Handling - (404)
J2EE Misconfiguration: Incomplete Error Handling - (500)
J2EE Misconfiguration: Incomplete Error Handling - (throwable)
J2EE Misconfiguration: Insecure Transport
J2EE Misconfiguration: Insufficient Session-ID Length
J2EE Misconfiguration: Invalid Servlet Name
J2EE Misconfiguration: Missing Authentication Method
J2EE Misconfiguration: Missing Data Transport Constraint
J2EE Misconfiguration: Missing Error Handling
J2EE Misconfiguration: Missing Filter Definition
J2EE Misconfiguration: Missing Security Role
J2EE Misconfiguration: Missing Servlet Mapping
J2EE Misconfiguration: Unsafe Bean Declaration
J2EE Misconfiguration: Weak Access Permissions
Password Management: Empty Password in Configuration File
Password Management: Password in Configuration File
Struts Misconfiguration: Duplicate Form Bean
Struts Misconfiguration: Invalid Path
Struts Misconfiguration: Missing Action Input
Struts Misconfiguration: Missing Exception Type
Struts Misconfiguration: Missing Form Bean
Struts Misconfiguration: Missing Form Bean Name
Struts Misconfiguration: Missing Form Bean Type
Struts Misconfiguration: Missing Form Property Type
Struts Misconfiguration: Missing Forward Name
Struts Misconfiguration: Missing Forward Path
Tomcat Configuration: Insecure Transport
WebSphere Misconfiguration: Missing Nonce
WebSphere Misconfiguration: Servlets Served By Class Name
WebSphere Service Provider Misconfiguration: Inbound WS-Security Not Enabled
WebSphere Service Provider Misconfiguration: Missing Inbound Encryption
WebSphere Service Provider Misconfiguration: Missing Inbound Signature
WebSphere Service Provider Misconfiguration: Missing Inbound Timestamp
WebSphere Service Provider Misconfiguration: Missing Outbound Encryption
WebSphere Service Provider Misconfiguration: Missing Outbound Signature
WebSphere Service Provider Misconfiguration: Missing Outbound Timestamp
WebSphere Service Provider Misconfiguration: Missing Timestamp Expiration
WebSphere Service Provider Misconfiguration: Outbound WS-Security Not Enabled
WebSphere Service Provider Misconfiguration: Unsigned Inbound Timestamp
WebSphere Service Provider Misconfiguration: Unsigned Outbound Timestamp
WebSphere Service Provider Misconfiguration: Weak Token
WebSphere Service Requester Misconfiguration: Inbound WS-Security Not Enabled
WebSphere Service Requester Misconfiguration: Missing Inbound Encryption
WebSphere Service Requester Misconfiguration: Missing Inbound Signature
WebSphere Service Requester Misconfiguration: Missing Inbound Timestamp
WebSphere Service Requester Misconfiguration: Missing Outbound Encryption
WebSphere Service Requester Misconfiguration: Missing Outbound Signature
WebSphere Service Requester Misconfiguration: Missing Outbound Timestamp
WebSphere Service Requester Misconfiguration: Missing Timestamp Expiration
WebSphere Service Requester Misconfiguration: Outbound WS-Security Not Enabled
WebSphere Service Requester Misconfiguration: Unsigned Inbound Timestamp
WebSphere Service Requester Misconfiguration: Unsigned Outbound Timestamp
WebSphere Service Requester Misconfiguration: Weak Token
Weblogic Misconfiguration: Missing Timestamp
Weblogic Misconfiguration: Weak Token
Poor Error Handling: Empty Catch Block
Poor Error Handling: Overly Broad Catch
Poor Error Handling: Overly Broad Throws
Poor Error Handling: Program Catches NullPointerException
Poor Error Handling: Return Inside Finally
Poor Error Handling: Swallowed ThreadDeath
Poor Error Handling: Throw Inside Finally
Poor Error Handling: Unhandled SSL Exception
Weak SecurityManager Check: Overridable Method
Privacy Violation
Privilege Management: Amazon Web Services Unchecked Permissions
Privilege Management: Android Data Storage
Privilege Management: Android Disable
Privilege Management: Android Location
Privilege Management: Android Messaging
Privilege Management: Android Network
Privilege Management: Android Telephony
Privilege Management: Overly Broad Access Specifier
Missing SecurityManager Check: Cloneable
Missing SecurityManager Check: Serializable
Access Control: Amazon Web Services
Access Control: Android ContentResolver
Access Control: Anonymous LDAP Bind
Access Control: Database
Access Control: LDAP
Access Control: Weak Security Constraint
Acegi Misconfiguration: Insecure Channel Mixing
Acegi Misconfiguration: Run-As Authentication Replacement
Code Correctness: Call to sleep() in Lock
Code Correctness: Double-Checked Locking
J2EE Bad Practices: Non-Serializable Object Stored in Session
J2EE Bad Practices: System.exit
J2EE Bad Practices: Threads
Race Condition: Format Flaw
Code Correctness: Multiple Stream Commits
Denial of Service: Parse Double
File Disclosure: J2EE
Poor Style: Confusing Naming