Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Sensitive credentials or authentication requests are transmitted to a caller-supplied server URL without validating that HTTPS is enforced and the target host is on an allowlist of configured servers.
HTTP redirect handler modifies request headers during redirects but does not check for or reject HTTPS-to-HTTP scheme downgrades, potentially exposing sensitive headers over plaintext HTTP.
Authentication plugin for cleartext credentials ('dialog' or 'mysql_clear_password') does not enforce a secure connection requirement via requireSecure() or requireSsl() returning true, allowing sensitive credentials to be sent over unencrypted transports.
Database credentials may be sent in the initial handshake response before validating authentication plugin security requirements and MitM resistance, potentially exposing plaintext credentials to a rogue server or MitM attacker.
Authentication plugin sends cleartext credentials without requiring a secure connection (TLS or local socket).
Calling `start_tls` without first clearing the protocol's internal receive buffer allows unencrypted data injected by a network attacker prior to the TLS handshake to persist and be processed as authentic data within the encrypted TLS session (STARTTLS injection). Ensure any buffered plaintext bytes are purged (e.g., `del self._buffer[:]` or `self._buffer.cl
Authentication plugin capabilities are validated against the previous plugin instance before instantiating the target plugin during an authentication switch, which can allow cleartext password transmission before certificate validation.
Calling `NegotiateAuthentication.Wrap` with `requestEncryption: false` disables confidentiality and applies only an integrity check (MIC). This exposes sensitive data like proof keys to network observers. Ensure `requestEncryption` is `true` and verify the `isEncrypted` out-parameter evaluates to `true` to prevent downgrade attacks.
A SOCKS/PDC proxy dialer is returning a raw TCP connection for ClickHouse Native protocol without wrapping in TLS. clickhouse-go bypasses its internal TLS handshake when DialContext is configured. When TLS is enabled, the custom dialer must explicitly wrap the connection using tls.Client and complete the handshake.
An insecure HTTP connection is used for AD CS certificate auto-enrollment. This is vulnerable to a Man-in-the-Middle (MITM) attack which can lead to system-wide trust store poisoning. Use 'https://' instead.
Hardcoding the SMTPSecure property to 'ssl' forces the use of a potentially deprecated SSL protocol instead of allowing modern dynamic options like STARTTLS ('tls'). This can expose communications to interception if the environment requires a different protocol configuration.
A Jetty Server is instantiated with `new Server(port)`, which hardcodes an unencrypted HTTP connector. This prevents the application from configuring transport-layer security (HTTPS/mTLS). Use `new Server()` without arguments and explicitly create and attach `ServerConnector` instances alongside an `SslContextFactory` for secure connections.
The application is making an HTTP request using an unencrypted 'http://' URL. Using cleartext HTTP can expose sensitive information like authentication tokens and API keys to Man-in-the-Middle (MITM) attacks. Upgrade the URL to use 'https://' to ensure encrypted communication.
Use of unencrypted HTTP protocol for network requests exposes traffic to Man-in-the-Middle (MITM) attacks. Use HTTPS to encrypt the transport channel.
The code checks for the 'STARTTLS' capability and silently returns or passes if it is missing. This enables a STRIPTLS attack, where a Man-In-The-Middle (MitM) attacker intercepts the initial connection and removes 'STARTTLS' from the server's capabilities response. The application will silently downgrade to a cleartext connection, exposing sensitive informa
The application was found using a telnet library. As telnet does not provide encryption, it is strongly recommended that communications use a more secure transport such as SSH. The [paramiko](https://www.paramiko.org/) library can be used to initiate SSH connections. Example using `paramiko` SSH client: ``` import paramiko import scp # Create an SSH client w
PythonCWE-319Application can load content over HTTP and that makes the app vulnerable to Man in the middle attacks.
JSCWE-319The application was found using an FTP library. As FTP does not provide encryption, it is strongly recommended that any file transfers be done over a more secure transport such as SSH. The [paramiko](https://www.paramiko.org/) library can be used with an SCP module to allow secure file transfers. Example using `paramiko` SSH client and the `scp` module: ```
PythonCWE-319Pysnmp was detected using versions SNMPv1 or SNMPv2. SNPMv1 and SNMPv2 are insecure and should no longer be used as they do not offer encryption. If possible, query SNMP devices using SNMPv3 instead. Example querying a device using SNMPv3 with SHA-AES: ``` from pysnmp.hlapi import * # Create the snpm iterator iterator = getCmd( SnmpEngine(), # Configure usin
PythonCWE-319'The Sequelize connection string indicates that database server does not use TLS. Non TLS connections are susceptible to man in the middle (MITM) attacks.'
JSCWE-319Beyond using an SSL socket, you need to make sure your use of SSLSocketFactory does all the appropriate certificate validation checks to make sure you are not subject to man-in-the-middle attacks. Please read the OWASP Transport Layer Protection Cheat Sheet for details on how to do this correctly.
ScalaCWE-319Pysnmp was detected using SNMPv3 without authentication or encryption protections enabled. - Use of `usmNoAuthProtocol` or `usmNoPrivProtocol` indicates that either authentication or privacy, respectively, is not being used. - The absence of `authKey` (or `authKey=None`) implies no authentication, which is equivalent to using `usmNoAuthProtocol`. - The absen
PythonCWE-319
