Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Checking resource parentage or identity by testing substring presence in a Pulumi URN (e.g. `urn.includes(...)`) is susceptible to spoofing. Parse and validate the URN structure explicitly.
Header-based local request validation (`isLocalDevRequest`) can be bypassed via Host header spoofing. Ensure socket/peer IP address verification (`isLoopbackPeer`) is performed.
OAuth redirect URI is dynamically constructed from untrusted HTTP Host header. Use a configured server base URL instead to prevent Host header poisoning.
The application determines the client IP address by directly trusting the `X-Real-IP` or `X-Forwarded-For` HTTP headers and unconditionally falling back to `request.client.host`. Because these headers can be freely modified by clients, an attacker can supply spoofed IP addresses to bypass IP-based rate limiting, tracking, or authentication. Ensure requests a
Using a substring match to find a dictionary key can lead to insecure matching (e.g., when checking hostnames, URLs or registry names), allowing an attacker to spoof configurations by registering a similar name (like an overlapping substring). Prefer exact matches (`===`) or proper parsing.
Invitation or activation link is constructed without validating trusted host headers via refuseIfUntrustedHost(), allowing host header poisoning.
Deleting proxy headers like 'x-forwarded-for' and injecting the raw socket IP into another header without recording the proxy presence. This destroys evidence of the proxy hop. If the application is hosted behind a local reverse proxy, downstream components may incorrectly trust external traffic as local (e.g., originating from 127.0.0.1). Evaluate or record
Unconditionally trusting the 'X-Forwarded-For' header for IP allowlisting or authentication opens the application to IP spoofing and authentication bypass. A direct attacker can forge this header. Validate the direct socket remote connection address against an explicit allowed proxies list before parsing 'X-Forwarded-For'.
Directly trusting client-supplied headers such as HTTP_X_FORWARDED_FOR or HTTP_CLIENT_IP without validating REMOTE_ADDR against a trusted proxy allowlist enables IP spoofing and authorization bypass.
Missing verification of SCRAM channel binding negotiation or empty channel binding data. This allows a silent downgrade attack, where man-in-the-middle protection is lost if the server certificate signature algorithm (e.g., Ed25519) does not support a channel binding hash. Ensure that you check `.isPlus()` on the negotiated SCRAM mechanism when channel bindi
Channel attribute containing proxy or remote address information is cleared using getAndSet(null) during resolution. On persistent (keep-alive) connections, subsequent address lookups will return null or fall back to the proxy's IP address, potentially bypassing IP-based access controls. Use get() instead.
Puma resets the proxy protocol parsing flag on every request over a persistent connection. This allows an attacker to inject a second PROXY protocol header in a subsequent keep-alive request, overwriting the connection's REMOTE_ADDR metadata and leading to IP spoofing. The fix ensures PROXY parsing only occurs on the first request (`@requests_served.zero?`).
The request handler overrides `parse_request` but does not validate the HTTP `Host` header. Without checking the `Host` header before processing requests or authenticating clients, the server is vulnerable to DNS rebinding attacks if it is bound to localhost or an internal network. Attackers can extract data or call APIs from the local server via a victim's
Directly evaluating `http.Request.RemoteAddr` for the client IP bypasses trusted proxy configurations (such as Caddy's `trusted_proxies` or standard reverse proxy setups). This can lead to authentication or access control bypass when deployed behind a reverse proxy or CDN because the immediate peer's IP is evaluated instead of the original client's IP. For C
The Traefik HTTP entrypoint handler chain wires `denyFragment` (and `normalizePath`) but does not install `denyEncodedCharacters` in the same chain. Without this middleware, suspicious percent-encoded characters in the URL path (e.g. %0A, %0D, %2F, %5C, %00, %25, %3B) reach downstream middleware and authentication subrequests, where they can be used to forge
Client identifiers extracted from worker message event payloads (`event.data.clientId`) are self-reported and untrusted. Using `event.data.clientId` to register or route MessagePorts allows untrusted contexts to spoof client IDs and hijack inter-context communication. Rely on browser-verified context identifiers such as `event.source.id` in ServiceWorkers in
Trusting the `Host` header for security decisions is insecure because attackers can spoof it. Do not rely on `$request->getUri()->getHost()` to bypass authentication or signature checks.
Channel/sender ACL check is fail-open: when the configured allow list is empty or missing, the function returns True, granting access to every sender. A remote attacker can deliver messages (e.g. via an unauthenticated email/IMAP poll, webhook, or chat platform) and have them processed as trusted owner input, enabling indirect prompt injection and tool abuse
Extracting the first IP address from the 'X-Forwarded-For' header can lead to IP spoofing. Load balancers like AWS ALB append the real client IP to the end of the header, leaving earlier values attacker-controlled. Extracting the first element allows an attacker to spoof their IP address by injecting their own 'X-Forwarded-For' header. Use the last IP addres
Authentication / authorization decision based on the HTTP `Referer` header. The Referer header is set by the client and is trivially spoofable, so calling `next()` (or otherwise granting access) based on its contents bypasses any real authentication check (CWE-290 / CWE-306). Verify a cryptographic credential (JWT, API key, signed session) instead of trustin
Call to CodeChecker permissions helper (`require_permission`, `require_manager`, or `has_permission`) does not pass the `is_auth_enabled` flag. With a missing flag, these helpers short-circuit to True when `auth_session` is None, granting anonymous callers full authorization for permission-management RPCs reachable via the `/Authentication` Thrift endpoint (
Detected password reset link constructed using unvalidated request base URI. This allows Host header injection and password reset poisoning (CVE-2026-15689).
Using a static hash of an object's `.secret` attribute (e.g., `hashlib.sha1(order.secret).hexdigest()`) for URL or webhook authentication is vulnerable to replay attacks across endpoints. Because the signature is not attached to a specific endpoint, an attacker can capture it from one view (like a return URL) and reuse it on another (like a webhook notify UR
KDC policy check for TGS requests enforces PAC presence without parsing and validating PAC content. In cross-realm Kerberos trust relationships, failing to validate PAC content allows client principal impersonation.
