Skip to content

Conversation

@cx-sumit-morchhale
Copy link
Contributor

Added code changes for engines command implementation.

@cx-ben-alvo
Copy link
Collaborator

cx-ben-alvo commented Apr 17, 2025

Logo
Checkmarx One – Scan Summary & Details31906902-7020-4797-bfc2-8040d2c5682c

New Issues (11)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
CRITICAL Code_Injection /src/test/resources/python-vul-file.py: 25
detailsThe application's do_GET method receives and dynamically executes user-controlled code using exec, at line 57 of /src/test/resources/python-vul-fil...
ID: Pj46V8ZbbhrIv3XExEc%2FixwLG10%3D
Attack Vector
CRITICAL Code_Injection /src/test/resources/python-vul-file.py: 25
detailsThe application's do_GET method receives and dynamically executes user-controlled code using exec, at line 57 of /src/test/resources/python-vul-fil...
ID: 968DquMd1%2B%2Bd5VYCtTiUx0%2FUEkQ%3D
Attack Vector
CRITICAL Code_Injection /src/test/resources/python-vul-file.py: 56
detailsThe application's do_GET method receives and dynamically executes user-controlled code using exec, at line 57 of /src/test/resources/python-vul-fil...
ID: CxJQK%2FR5GA07kVEuTVQ%2F9Cinrco%3D
Attack Vector
CRITICAL Command_Injection /src/test/resources/python-vul-file.py: 25
detailsThe application's do_GET method calls an OS (shell) command with envs, at line 57 of /src/test/resources/python-vul-file.py, using an untrusted str...
ID: 3XOHOUCcJ5vEH41x2cNQeV09nME%3D
Attack Vector
CRITICAL Command_Injection /src/test/resources/python-vul-file.py: 25
detailsThe application's do_GET method calls an OS (shell) command with envs, at line 57 of /src/test/resources/python-vul-file.py, using an untrusted str...
ID: IocVQr6NbkjjsiUrf6hFI1HWcNU%3D
Attack Vector
CRITICAL Command_Injection /src/test/resources/python-vul-file.py: 56
detailsThe application's do_GET method calls an OS (shell) command with envs, at line 57 of /src/test/resources/python-vul-file.py, using an untrusted str...
ID: SppN4%2BmDsQiDRH5A9iNLB35N%2FdE%3D
Attack Vector
CRITICAL Stored_XSS /src/test/resources/python-vul-file.py: 26
detailsThe method do_GET embeds untrusted data in generated output with write, at line 80 of /src/test/resources/python-vul-file.py. This untrusted data i...
ID: c32uR7szSc3A5XOPWWtXEanF0bw%3D
Attack Vector
CRITICAL Stored_XSS /src/test/resources/python-vul-file.py: 37
detailsThe method do_GET embeds untrusted data in generated output with write, at line 80 of /src/test/resources/python-vul-file.py. This untrusted data i...
ID: p6PRV4rf34dtTSGf9Z1UCd9PeCk%3D
Attack Vector
CRITICAL Stored_XSS /src/test/resources/python-vul-file.py: 35
detailsThe method do_GET embeds untrusted data in generated output with write, at line 80 of /src/test/resources/python-vul-file.py. This untrusted data i...
ID: MY28ZHZglWnSFyh1%2FzPM468a%2Bl8%3D
Attack Vector
MEDIUM CVE-2020-15250 Maven-junit:junit-4.10
detailsRecommended version: 4.13.1
Description: In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vulnerability. On Unix like sys...
Attack Vector: LOCAL
Attack Complexity: LOW

ID: jPNx6Rhz1%2FmdtkXhKbVoDGDR%2FX71CEHVPo6IsPeHa98%3D
Vulnerable Package
MEDIUM Missing_HSTS_Header /src/test/resources/python-vul-file.py: 76
detailsThe web-application does not define an HSTS header, leaving it vulnerable to attack.
ID: clgolK0H6TtBF9SvGwT233kkgps%3D
Attack Vector

@cx-sumit-morchhale cx-sumit-morchhale changed the title added code changes for engines command added code changes for engines command: (AST-93817) Apr 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants