@provally
CVE and 1-day SAST rule packs maintained by Provally from validated vulnerability analysis artifacts.
Directly reading the Kubernetes ServiceAccount token from '/var/run/secrets/kubernetes.io/serviceaccount/token' can expose cluster credentials if the token is transmitted in outbound requests. Use a scoped token with a restricted audience instead.
Configuration value is passed directly to an OS command execution function without proper escaping or validation. An attacker with configuration modification privileges could inject arbitrary commands.
Schedule status is updated based on stream key lookup without verifying that the stream key belongs to the schedule or playlist owner. This can allow unauthorized users to modify or cancel scheduled broadcasts.
Route-bound model is updated directly from generic Request input without explicit authorization or FormRequest validation, potentially allowing IDOR or unauthorized modifications.
State-changing API action is executed while same-domain checks are explicitly bypassed without validating the HTTP request method or request origin, leading to CSRF.
Deserialization of data using ObjectInputStream without an ObjectInputFilter allowlist can allow remote code execution via gadget chains (CWE-502). Configure an ObjectInputFilter via setObjectInputFilter() before calling readObject() or readUnshared().
ARM CMSE non-secure callable entry function receives pointer '$PTR' from untrusted Non-Secure world without verifying memory attribution via cmse_check_address_range() or equivalent validation. This allows Non-Secure callers to pass pointers targeting Secure memory.
Session pointer obtained from `tee_ta_get_session` is used in `tee_ta_invoke_command` without checking if it is NULL. An invalid or unallocated session ID can result in a NULL pointer dereference and DoS.
SAXParser is created from SAXParserFactory without disabling DOCTYPE declarations or external entity resolution. This can lead to XML External Entity (XXE) injection vulnerabilities when parsing untrusted XML data. Ensure `disallow-doctype-decl` or entity resolution features are explicitly disabled.
Potential missing object-level authorization check. Sensitive operations on resources identified by user-controlled IDs should verify that the current subject has appropriate read/manage permissions.
Organization-scoped route is protected by JwtAuthGuard but lacks OrganizationValidateGuard, allowing authenticated cross-tenant access to organization resources.
Interpolating unescaped option values into <option> template strings and assigning to innerHTML can lead to Cross-Site Scripting (XSS). Use document.createElement('option') and assign textContent and value properties instead.
A URL is fetched after only verifying its prefix (e.g., startsWith('http')), without validating against internal or private IP addresses. This can allow Server-Side Request Forgery (SSRF) attacks against internal endpoints.
A buffer growth routine exponentially increases buffer capacity without checking against a maximum decoded size limit. This may allow decompression bombs or oversized stream inputs to exhaust system memory and cause a denial of service.
Skill instruction executes helper scripts via relative paths from the workspace directory instead of anchoring to the skill root directory.
Checking resource parentage or identity by testing substring presence in a Pulumi URN (e.g. `urn.includes(...)`) is susceptible to spoofing. Parse and validate the URN structure explicitly.
IAM policy inspection only checks standalone 'aws:iam/policy:Policy' resources, ignoring inline policies (RolePolicy, UserPolicy, GroupPolicy) and policy attachments. This allows administrator or unsafe policy definitions to bypass security guardrails.
Falling back to plan.actions when token-based lookup from an internal store fails allows execution of unverified or forged actions. Ensure the token exists in the store and do not fall back to untrusted actions supplied in the plan object.
Directly accessing 'StringLike' or 'StringEquals' on an AWS IAM Condition object ignores set-qualified operators (e.g., 'ForAnyValue:StringLike') and modifier suffixes (e.g., 'StringLikeIfExists'). Iterate over condition entries and normalize the operator base name instead.
Naive URN prefix matching using split('$')[0] and startsWith can lead to policy validation bypasses due to crafted resource names. Parse URN type hierarchies structurally and enforce property-level value bindings.
Envelope size is concatenated directly into SMTP command arguments without numeric coercion, which may allow SMTP command injection via CRLF sequences.
Ash.Actions.Update.UpdateMany executes atomic updates directly without evaluating authorization policies or applying policy filters to the changesets.
Calling `Task.yield/2` with a 0ms timeout performs a non-blocking check. When executed in a loop or recursive polling function without blocking or sleeping, it causes busy-spinning that exhausts BEAM scheduler CPU resources. Use `Task.yield_many/2` with a blocking timeout or an appropriate synchronization mechanism.
`apply_constraints` for doubly-nested arrays delegates directly to `map_while_ok` without validating outer array constraints (such as min_length, max_length, or nil_items?) or verifying that the outer term is a list.
