verademo's Issues
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/UserController.java:505]
Filename: com/veracode/verademo/controller/UserController.java
Line: 505
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.PreparedStatement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. executeQuery() was called on the myInfo object, which contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/UserController.java:316]
Filename: com/veracode/verademo/controller/UserController.java
Line: 316
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sql. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/ListenCommand.java:47]
Filename: com/veracode/verademo/commands/ListenCommand.java
Line: 47
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/IgnoreCommand.java:47]
Filename: /src/main/java/com/veracode/verademo/commands/IgnoreCommand.java
Line: 47
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/UserController.java:494]
Filename: com/veracode/verademo/controller/UserController.java
Line: 494
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlMyEvents. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/RemoveAccountCommand.java:47]
Filename: com/veracode/verademo/commands/RemoveAccountCommand.java
Line: 47
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/RemoveAccountCommand.java:40]
Filename: com/veracode/verademo/commands/RemoveAccountCommand.java
Line: 40
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/RemoveAccountCommand.java:51]
Filename: com/veracode/verademo/commands/RemoveAccountCommand.java
Line: 51
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/UserController.java:251]
Filename: com/veracode/verademo/controller/UserController.java
Line: 251
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sql. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/UserController.java:166]
Filename: com/veracode/verademo/controller/UserController.java
Line: 166
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/UserController.java:384]
Filename: com/veracode/verademo/controller/UserController.java
Line: 384
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable query. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/IgnoreCommand.java:40]
Filename: com/veracode/verademo/commands/IgnoreCommand.java
Line: 40
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') [VID:78:com/veracode/verademo/controller/ToolsController.java:91]
Filename:
Line: 91
CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
This call to java.lang.Runtime.exec() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec() contains tainted data from the variable cmd. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') [VID:78:com/veracode/verademo/controller/ToolsController.java:59]
Filename: com/veracode/verademo/controller/ToolsController.java
Line: 59
CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
This call to java.lang.Runtime.exec() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec() contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/controller/BlabController.java:490]
Filename: com/veracode/verademo/controller/BlabController.java
Line: 490
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.PreparedStatement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. executeQuery() was called on the blabberQuery object, which contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') [VID:78:com/veracode/verademo/controller/ToolsController.java:56]
Filename: com/veracode/verademo/controller/ToolsController.java
Line: 56
CWE: 78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
This call to java.lang.Runtime.exec() contains a command injection flaw. The argument to the function is constructed using untrusted input. If an attacker is allowed to specify all or part of the command, it may be possible to execute commands on the server with the privileges of the executing process. The level of exposure depends on the effectiveness of input validation routines, if any. The first argument to exec() contains tainted data. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Validate all untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. When using blocklists, be sure that the sanitizing routine performs a sufficient number of iterations to remove all instances of disallowed characters. Most APIs that execute system commands also have a "safe" version of the method that takes an array of strings as input rather than a single string, which protects against some forms of command injection. References: CWE OWASP WASC
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [VID:89:com/veracode/verademo/commands/ListenCommand.java:40]
Filename: com/veracode/verademo/commands/ListenCommand.java
Line: 40
CWE: 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
This database query contains a SQL injection flaw. The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input. An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry. Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. References: CWE OWASP WASC
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') [VID:95:WEB-INF/views/login.jsp:32]
Verademo/src/main/webapp/WEB-INF/views/login.jsp
Lines 27 to 37 in 9ae7692
Filename: WEB-INF/views/login.jsp
Line: 32
CWE: 95 (Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'))
This call to eval() contains untrusted input or potentially untrusted data. If this input could be modified by an attacker, arbitrary JS code could be executed. Validate all untrusted and untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible. In general, avoid executing code derived from untrusted input. References: CWE
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. ๐๐๐
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google โค๏ธ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.