Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
The Express application hosting Model Context Protocol (MCP) transports calls `app.listen()` without specifying an explicit host or bind address. In Express, omitting the host defaults to binding on all network interfaces (`0.0.0.0`), exposing MCP tools to any reachable network client. Explicitly bind to a loopback address (e.g., `127.0.0.1`) or enforce inbo
Defaulting the host binding address to '::' binds the server to all network interfaces, potentially exposing sensitive or unauthenticated endpoints to external network clients. Default to '127.0.0.1' or 'localhost' instead.
Calling ListenTCP with hardcoded allInterfaces=true binds the forwarded port listener to all network interfaces (0.0.0.0) instead of restricting it to loopback, exposing forwarded services to network-adjacent hosts.
InMemoryListenerConfig is configured without specifying a listen address, which binds the LDAP server to all network interfaces (0.0.0.0). Specify a loopback address using createLDAPConfig(listenerName, InetAddress.getLoopbackAddress(), listenPort, socketFactory) to prevent unintended network exposure.
Hono node server (or equivalent serve() call) is bound to "0.0.0.0", exposing the service on every network interface. Local developer tools that expose privileged endpoints (process spawn, file access, plugin install) must bind to the loopback address ("127.0.0.1") to prevent remote attackers — including drive-by browser requests from malicious sites — from
The Uvicorn server is configured to bind to all network interfaces ('0.0.0.0' or '::'). This publicly exposes the service on all available interfaces by default. Bind to a loopback host (such as '127.0.0.1') or use a configurable environment variable instead.
Binding to all network interfaces can potentially open up a service to traffic on unintended interfaces, that may not be properly documented or secured. By passing "0.0.0.0" as the address to the `Listen` family of functions, the application will bind to all interfaces. Consider passing in the interface ip address through an environment variable, configurati
GoCWE-1327Binding to all network interfaces can potentially open up a service to traffic on unintended interfaces, that may not be properly documented or secured. By passing "0.0.0.0", "::" or an empty string as the address to the `socket.bind` function, the application will bind to all interfaces. Consider passing in the interface ip address through an environment va
PythonCWE-1327
