Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Generating a session token or credentials directly from a process ID (PID) makes the token highly predictable. Attackers can guess valid tokens to hijack sessions or trigger unauthorized actions. Use a cryptographically secure random number generator (CSPRNG) to generate session identifiers.
Authentication/API token is generated using itsdangerous.URLSafeTimedSerializer keyed by a non-secret value (e.g. tenant_id) and/or signing a predictable payload such as a UUID, with the output being sliced. This treats the serializer as a randomness source instead of a verifiable signed token. URLSafeTimedSerializer produces deterministic base64(payload).ti
Session/token identifier is derived by hashing the output of Perl's built-in rand(), which is a non-cryptographic PRNG seeded with only ~32 bits and is therefore predictable. Combining it with $$ (PID), time, or stringified references (memory addresses) does not add meaningful entropy, and wrapping the result in a digest (sha1_hex/md5_hex/sha256_hex/...) doe
Perl's built-in rand() is being fed into a cryptographic hash (SHA-1/SHA-256/SHA-512/MD5) to derive bytes. rand() is seeded with at most 32 bits and is not a CSPRNG, so hashing it (optionally with $$, Time::HiRes::time, or other low-entropy values) does not produce cryptographically strong output. This pattern produces predictable session IDs, CSRF tokens, a
