CWE weakness

java.jboss.security.seam-log-injection.seam-log-injection

Seam Logging API support an expression language to introduce bean property

API / Function Errors - (1228)

java.lang.security.audit.ognl-injection.ognl-injection

A expression is built with a dynamic value. The source of the value(s)

Data Neutralization Issues - (137)

java.lang.security.audit.dangerous-groovy-shell.dangerous-groovy-shell

A expression is built with a dynamic value. The source of the value(s)

Data Neutralization Issues - (137)

java.lang.security.audit.el-injection.el-injection

An expression is built with a dynamic value. The source of the value(s)

Data Neutralization Issues - (137)

java.spring.security.audit.spel-injection.spel-injection

A Spring expression is built with a dynamic value. The source of the value(s)

Data Neutralization Issues - (137)

java.lang.security.audit.script-engine-injection.script-engine-injection

Detected potential code injection using ScriptEngine. Ensure user-controlled

Data Neutralization Issues - (137)

java.lang.security.audit.crlf-injection-logs.crlf-injection-logs

When data from an untrusted source is put into a logger and not neutralized

Data Neutralization Issues - (137)

mobsf.mobsfscan.hidden_ui.android_hidden_ui

Hidden elements in view can be used to hide data from user. But this data

Data Neutralization Issues - (137)

mobsf.mobsfscan.root_detection.android_root_detection

This app does not have root detection capabilities. Running a sensitive

Data Neutralization Issues - (137)

contrib.owasp.java.ssrf.ssrf.owasp.java.ssrf.java.net.url

A parameter being passed directly into java.net.URL function most likely

Data Processing Errors - (19)

contrib.owasp.java.ssrf.ssrf.owasp.java.ssrf.org.apache.commons.httpclient

A parameter being passed directly into HttpClient functions most likely

Data Processing Errors - (19)

contrib.owasp.java.ssrf.ssrf.owasp.java.ssrf.possible.import.statements

Non-exhaustive list of Libraries that provide functionality to accept URL

Data Neutralization Issues - (137)

contrib.owasp.java.ssrf.ssrf.owasp.java.ssrf.org.apache.http.impl.client.CloseableHttpClient

A parameter being passed directly into CloseableHttpClient functions most

Data Processing Errors - (19)

java.lang.security.audit.ldap-entry-poisoning.ldap-entry-poisoning

An object-returning LDAP search will allow attackers to control the LDAP

Data Neutralization Issues - (137)

java.lang.security.audit.ldap-injection.ldap-injection

Detected non-constant data passed into an LDAP query. If this data can

Data Neutralization Issues - (137)

java.lang.security.audit.tainted-ldapi-from-http-request.tainted-ldapi-from-http-request

Detected input from a HTTPServletRequest going into an LDAP query. This

Data Neutralization Issues - (137)

java.jboss.security.session_sqli.find-sql-string-concatenation

In $METHOD, $X is used to construct a SQL query via string concatenation.

Data Neutralization Issues - (137)

java.lang.security.audit.jdbc-sql-formatted-string.jdbc-sql-formatted-string

'Possible JDBC injection detected. Use the parameterized query feature

Data Neutralization Issues - (137)

java.aws-lambda.security.tainted-sqli.tainted-sqli

Detected SQL statement that is tainted by `$EVENT` object. This could lead

Data Neutralization Issues - (137)

java.lang.security.audit.sqli.tainted-sql-from-http-request.tainted-sql-from-http-request

Detected input from a HTTPServletRequest going into a SQL sink or statement.

Data Neutralization Issues - (137)

java.spring.security.injection.tainted-sql-string.tainted-sql-string

User data flows into this manually-constructed SQL string. User data can

Data Neutralization Issues - (137)

java.lang.security.audit.formatted-sql-string.formatted-sql-string

Detected a formatted string in a SQL statement. This could lead to SQL

Data Neutralization Issues - (137)

java.aws-lambda.security.tainted-sql-string.tainted-sql-string

Detected user input used to manually construct a SQL string. This is usually

Data Neutralization Issues - (137)

java.java-jwt.security.jwt-hardcode.java-jwt-hardcoded-secret

A hard-coded credential was detected. It is not recommended to store credentials

Data Neutralization Issues - (137)

mobsf.mobsfscan.secrets.hardcoded_password

A hardcoded password in plain text is identified.

Key Management Errors - (320)

mobsf.mobsfscan.secrets.hardcoded_username

A hardcoded username in plain text is identified.

Key Management Errors - (320)

mobsf.mobsfscan.secrets.hardcoded_api_key

A hardcoded Key is identified.

Key Management Errors - (320)

mobsf.mobsfscan.secrets.hardcoded_secret

A hardcoded secret is identified.

Key Management Errors - (320)

java.lang.security.audit.xssrequestwrapper-is-insecure.xssrequestwrapper-is-insecure

It looks like you're using an implementation of XSSRequestWrapper from

Data Neutralization Issues - (137)

java.lang.security.servletresponse-writer-xss.servletresponse-writer-xss

'Cross-site scripting detected in HttpServletResponse writer with variable

Data Neutralization Issues - (137)

java.lang.security.audit.xss.no-direct-response-writer.no-direct-response-writer

Detected a request with potential user-input going into a OutputStream

Data Neutralization Issues - (137)

mobsf.mobsfscan.rsa_no_oeap.rsa_no_oeap

This App uses RSA Crypto without OAEP padding. The purpose of the padding

Data Neutralization Issues - (137)

java.lang.security.audit.tainted-cmd-from-http-request.tainted-cmd-from-http-request

Detected input from a HTTPServletRequest going into a 'ProcessBuilder'

Data Neutralization Issues - (137)

java.lang.security.audit.command-injection-formatted-runtime-call.command-injection-formatted-runtime-call

A formatted or concatenated string was detected as input to a java.lang.Runtime

Data Neutralization Issues - (137)

java.lang.security.audit.command-injection-process-builder.command-injection-process-builder

A formatted or concatenated string was detected as input to a ProcessBuilder

Data Neutralization Issues - (137)

mobsf.mobsfscan.command_injection.command_injection

User controlled strings in exec() will result in command execution.

Data Neutralization Issues - (137)

mobsf.mobsfscan.command_injection_formated.command_injection_warning

'A formatted or concatenated string was detected as input to a java.lang.Runtime

Data Neutralization Issues - (137)

mobsf.mobsfscan.sqlite_injection.sqlite_injection

App uses SQLite Database and execute raw SQL query. Untrusted user input

Data Neutralization Issues - (137)

mobsf.mobsfscan.default_http_client_tls.default_http_client_tls

DefaultHTTPClient() with default constructor is not compatible with TLS

API / Function Errors - (1228)

mobsf.mobsfscan.webview_external_storage.webview_external_storage

WebView load files from external storage. Files in external storage can

API / Function Errors - (1228)

mobsf.mobsfscan.webview_javascript_interface.webview_javascript_interface

Ensure that javascript interface is implemented securely. Execution of

API / Function Errors - (1228)

java.log4j.security.log4j-message-lookup-injection.log4j-message-lookup-injection

Possible Lookup injection into Log4j messages. Lookups provide a way to

Audit / Logging Errors - (1210)

java.lang.security.audit.bad-hexa-conversion.bad-hexa-conversion

'''Integer.toHexString()'' strips leading zeroes from each byte if read

Data Neutralization Issues - (137)

java.lang.security.audit.cbc-padding-oracle.cbc-padding-oracle

Using CBC with PKCS5Padding is susceptible to padding oracle attacks. A

Data Neutralization Issues - (137)

mobsf.mobsfscan.cbc_padding_oracle.cbc_padding_oracle

The App uses the encryption mode CBC with PKCS5/PKCS7 padding. This configuration

Data Integrity Issues - (1214)

java.lang.security.audit.tainted-xpath-from-http-request.tainted-xpath-from-http-request

Detected input from a HTTPServletRequest going into a XPath evaluate or

Data Neutralization Issues - (137)

java.lang.security.audit.cookie-missing-secure-flag.cookie-missing-secure-flag

A cookie was detected without setting the 'secure' flag. The 'secure' flag

Business Logic Errors - (840)

java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-false.documentbuilderfactory-disallow-doctype-decl-false

DOCTYPE declarations are enabled for this DocumentBuilderFactory. Without

Data Processing Errors - (19)

java.lang.security.audit.xxe.documentbuilderfactory-external-general-entities-true.documentbuilderfactory-external-general-entities-true

External entities are allowed for this DocumentBuilderFactory. This is

Data Processing Errors - (19)

java.lang.security.audit.xxe.documentbuilderfactory-external-parameter-entities-true.documentbuilderfactory-external-parameter-entities-true

External entities are allowed for this DocumentBuilderFactory. This is

Data Processing Errors - (19)

contrib.owasp.java.xxe.digester3-digester.owasp.java.xxe.org.apache.commons.digester3.Digester

Digester being instantiated without calling the setFeature functions that

Data Processing Errors - (19)

contrib.owasp.java.xxe.saxbuilder.owasp.java.xxe.org.jdom2.input.SAXBuilder

SAXBuilder being instantiated without calling the setFeature functions

Data Processing Errors - (19)

contrib.owasp.java.xxe.saxreader.owasp.java.xxe.org.dom4j.io.SAXReader

SAXReader being instantiated without calling the setFeature functions that

Data Processing Errors - (19)

contrib.owasp.java.xxe.xmlreader.owasp.java.xxe.org.xml.sax.XMLReader

XMLReader being instantiated without calling the setFeature functions that

Data Processing Errors - (19)

contrib.owasp.java.xxe.xmlinputfactory.owasp.java.xxe.javax.xml.stream.XMLInputFactory

XMLInputFactory being instantiated without calling the setProperty functions

Data Processing Errors - (19)

java.lang.security.audit.xml-decoder.xml-decoder

XMLDecoder should not be used to parse untrusted data. Deserializing user

Data Processing Errors - (19)

java.lang.security.xmlinputfactory-external-entities-enabled.xmlinputfactory-external-entities-enabled

XML external entities are enabled for this XMLInputFactory. This is vulnerable

Data Processing Errors - (19)

java.lang.security.xmlinputfactory-possible-xxe.xmlinputfactory-possible-xxe

XML external entities are not explicitly disabled for this XMLInputFactory.

Data Processing Errors - (19)

java.lang.security.audit.xxe.documentbuilderfactory-disallow-doctype-decl-missing.documentbuilderfactory-disallow-doctype-decl-missing

DOCTYPE declarations are enabled for this DocumentBuilderFactory. This

Data Processing Errors - (19)

contrib.owasp.java.xxe.xxe-imports.owasp.java.xxe.possible.import.statements

Non-exhaustive list of Libraries that provide functionality to accept XML

Data Processing Errors - (19)

mobsf.mobsfscan.xmldecoder_xxe.xml_decoder_xxe

'XMLDecoder should not be used to parse untrusted data.

Data Processing Errors - (19)

mobsf.mobsfscan.xmlfactory_external_entities_enabled.xmlinputfactory_xxe_enabled

'XML external entities are enabled for this XMLInputFactory. This is vulnerable

Data Processing Errors - (19)

mobsf.mobsfscan.xmlfactory_xxe.xmlinputfactory_xxe

'XML external entities are not explicitly disabled for this XMLInputFactory.

Data Processing Errors - (19)

java.lang.security.audit.unvalidated-redirect.unvalidated-redirect

Application redirects to a destination URL specified by a user-supplied

Data Processing Errors - (19)

java.spring.security.audit.spring-unvalidated-redirect.spring-unvalidated-redirect

Application redirects a user to a destination URL specified by a user supplied

Data Processing Errors - (19)

mobsf.mobsfscan.logging.android_logging

The App logs information. Please ensure that sensitive information is never

Information Management Errors - (199)

java.lang.security.audit.object-deserialization.object-deserialization

Found object deserialization using ObjectInputStream. Deserializing entire

Resource Management Errors - (399)

java.lang.security.use-snakeyaml-constructor.use-snakeyaml-constructor

Used SnakeYAML org.yaml.snakeyaml.Yaml() constructor with no arguments,

Resource Management Errors - (399)

java.jax-rs.security.insecure-resteasy.insecure-resteasy-deserialization

When a Restful webservice endpoint is configured to use wildcard mediaType

Resource Management Errors - (399)

java.lang.security.insecure-jms-deserialization.insecure-jms-deserialization

JMS Object messages depend on Java Serialization for marshalling/unmarshalling

Resource Management Errors - (399)

java.rmi.security.server-dangerous-class-deserialization.server-dangerous-class-deserialization

Using a non-primitive class with Java RMI may be an insecure deserialization

Resource Management Errors - (399)

java.rmi.security.server-dangerous-object-deserialization.server-dangerous-object-deserialization

Using an arbitrary object ('Object $PARAM') with Java RMI is an insecure

Resource Management Errors - (399)

mobsf.mobsfscan.jackson_deserialization.jackson_deserialization

The app uses jackson deserialization library. Deserialization of untrusted

Resource Management Errors - (399)

mobsf.mobsfscan.object_deserialization.object_deserialization

'Found object deserialization using ObjectInputStream. Deserializing entire

Resource Management Errors - (399)

java.lang.security.audit.tainted-session-from-http-request.tainted-session-from-http-request

Detected input from a HTTPServletRequest going into a session command,

Privilege Issues?- (265)

mobsf.mobsfscan.webview_debugging.webview_debugging

Remote WebView debugging is enabled. This allows an attacker with debugging

Bad Coding Practices - (1006)

java.lang.security.audit.unsafe-reflection.unsafe-reflection

If an attacker can supply values that the application then uses to determine

Resource Management Errors - (399)

mobsf.mobsfscan.android_safetynetapi.android_safetynet_api

'This app does not uses SafetyNet Attestation API that provides cryptographically-signed

Data Integrity Issues - (1214)

java.spring.security.unrestricted-request-mapping.unrestricted-request-mapping

Detected a method annotated with 'RequestMapping' that does not specify

Business Logic Errors - (840)

java.lang.security.audit.cookie-missing-samesite.cookie-missing-samesite

Detected cookie without the SameSite attribute.

Business Logic Errors - (840)

java.spring.security.audit.spring-csrf-disabled.spring-csrf-disabled

CSRF is disabled for this configuration. This is a security risk.

Data Neutralization Issues - (137)

java.java-jwt.security.audit.jwt-decode-without-verify.java-jwt-decode-without-verify

Detected the decoding of a JWT token without a verify step. JWT tokens

Behavioral Problems - (438)

java.lang.security.audit.crypto.weak-random.weak-random

Detected use of the functions `Math.random()` or `java.util.Random()`.

Random Number Issues - (1213)

mobsf.mobsfscan.insecure_random.java_insecure_random

The App uses an insecure Random Number Generator.

Data Processing Errors - (19)

java.lang.security.audit.crypto.no-static-initialization-vector.no-static-initialization-vector

Initialization Vectors (IVs) for block ciphers should be randomly generated

Initialization and Cleanup Errors - (452)

mobsf.mobsfscan.cbc_static_iv.cbc_static_iv

The IV for AES CBC mode should be random. A static IV makes the ciphertext

Cryptographic Issues - (310)

java.lang.security.audit.crypto.use-of-md5.use-of-md5

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision

Cryptographic Issues - (310)

java.lang.security.audit.crypto.use-of-sha1.use-of-sha1

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not

Cryptographic Issues - (310)

java.lang.security.audit.md5-used-as-password.md5-used-as-password

It looks like MD5 is used as a password hash. MD5 is not considered a secure

Cryptographic Issues - (310)

java.lang.security.audit.crypto.weak-hash.use-of-sha1

Detected SHA1 hash algorithm which is considered insecure. SHA1 is not

Cryptographic Issues - (310)

java.lang.security.audit.crypto.weak-hash.use-of-md5

Detected MD5 hash algorithm which is considered insecure. MD5 is not collision

Cryptographic Issues - (310)

java.java-jwt.security.jwt-none-alg.java-jwt-none-alg

Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm

Cryptographic Issues - (310)

java.jjwt.security.jwt-none-alg.jjwt-none-alg

Detected use of the 'none' algorithm in a JWT token. The 'none' algorithm

Cryptographic Issues - (310)

java.lang.security.audit.crypto.ecb-cipher.ecb-cipher

Cipher in ECB mode is detected. ECB mode produces the same output for the

Cryptographic Issues - (310)

java.lang.security.audit.crypto.ssl.avoid-implementing-custom-digests.avoid-implementing-custom-digests

'Cryptographic algorithms are notoriously difficult to get right. By implementing

Cryptographic Issues - (310)

java.lang.security.audit.crypto.no-null-cipher.no-null-cipher

'NullCipher was detected. This will not encrypt anything; the cipher text

Cryptographic Issues - (310)

mobsf.mobsfscan.insecure_ssl_v3.insecure_sslv3

SSLv3 is insecure and has multiple known vulnerabilities.

Cryptographic Issues - (310)

mobsf.mobsfscan.weak_ciphers.weak_cipher

Weak encryption algorithm identified. This algorithm is vulnerable to cryptographic

Cryptographic Issues - (310)

mobsf.mobsfscan.weak_hashes.weak_hash

Weak Hash algorithm used. The hash algorithm is known to have hash collisions.

Cryptographic Issues - (310)