Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
NFS filehandles are decoded using an exportfs decode function without cryptographic verification. Because standard NFS filehandles are traditionally predictable, an unauthenticated network attacker can guess them to bypass path-based access controls and access restricted files. Ensure incoming filehandles are cryptographically verified (e.g., using `fh_verif
Struct field "$FIELD" holds a JWT/HMAC signing secret that is loaded from the environment without a minimum-length validation constraint. A decoded secret shorter than 32 bytes makes HS256 tokens brute-forceable offline (RFC 7518 §3.2 mandates ≥256-bit keys for HS256). Add `validate:"gte=32"` (or higher) to the struct tag so the application rejects an unders
NFS filehandles are predictable and lack cryptographic signatures. Decoding incoming filehandles without validating their authenticity allows an attacker to bypass path-based access controls by systematically guessing valid filehandles. Filehandles should be authenticated (e.g., via MAC check) before decoding.
A custom HTTP stream reader is created from an HTTP request body but fails to clear or sanitize `req.Trailer`. Go's `net/http` server automatically populates this field with trailing headers upon reading a chunked request. If the application later trusts these unverified trailers (e.g., for metadata or chunk signatures), attackers can smuggle unsigned traili
Rack::Session::Cookie#unpacked_cookie_data falls back to an unauthenticated coder (e.g. Base64::Marshal) when configured encryptors fail to decrypt the cookie. Because encryptor failures are rescued and ignored, an attacker can forge a session cookie that fails authenticated decryption but is still parsed by the fallback coder, leading to authentication bypa
ForwardAuth-style request builder calls utils.CopyHeaders to bulk-copy every incoming request header into the forwarded auth request and then only selectively rebuilds a fixed subset of X-Forwarded-* headers (For / Method / Proto / Port / Host / Uri). Other X-Forwarded-* headers such as X-Forwarded-Prefix are not stripped, so when the trust-forward flag is f
Cache key serialization for a protobuf Struct must prefix the number of fields (e.g. via strconv.Itoa(len(keys))) and sanitize Unicode control characters in string values. Without a length prefix, a single-key value containing the literal field delimiter (e.g. ",'b:'y") serializes identically to a structurally different two-key Struct, producing the same cac
The authentication tag for AES-GCM decryption is extracted using `substr` but its length is not validated. If an attacker provides a short payload, `substr` may return a truncated tag which `openssl_decrypt` accepts, allowing brute-force attacks to recover the GHASH key and forge ciphertexts. Verify the tag length using `strlen` before passing it to `openssl
When a dynamically generated atom (`String.to_atom/1`) is pinned in a pattern match inside a `case` statement, matching against structures with strings causes silent fall-through to the catch-all branch. In contexts like package resolution, this can silently bypass dependency signature and checksum evaluations, allowing tampered packages to be installed and
Using `matches!` or `assert_matches!` with a simple lowercase identifier as the pattern evaluates to `true` unconditionally (or always passes the assertion). In Rust, lowercase identifiers in patterns act as irrefutable variable bindings, bypassing any intended value comparison. This can lead to severe security vulnerabilities if used for validation. If you
Property key $KEY is used in a hasOwnProperty() security check and then in a computed property access without first coercing it to a string primitive. A non-primitive $KEY implementing toString() or [Symbol.toPrimitive] can return different values on successive evaluations — an allowed name during the hasOwnProperty check and a dangerous key ('__proto__', 'c
A verification loop was found lacking a minimum boundary check on a threshold value. An attacker may manipulate configuration or metadata to set the required signature threshold to 0, which would allow them to bypass the verification loop entirely.
Cosign skips critical bundle validation checks because they are placed after an early successful return for `TrustedMaterial` configurations. Ensure all critical checks like `compareSigs` and `comparePublicKey` are evaluated prior to any successful early returns to avoid validation bypass.
The return value of `DOMNode::C14N()` is not verified. `C14N()` returns `false` on failure, which may be implicitly cast to an empty string. When canonicalized output is used in XML signature verification, missing error checks can lead to empty digest validation and authentication bypass. Always verify that `C14N()` does not return `false` before using or re
HTTP forwarding headers X-Forwarded-For and X-Real-IP are client-controlled values that flow into a security-sensitive operation without trusted proxy validation. Any unauthenticated client can forge these headers to spoof their source IP, poison access logs, and bypass IP-based authorization checks (CVE-2025-66570 / CWE-290). Use the socket-level remote add
The application defaults its main delegate constructor without registering a V8 context snapshot validator. If ASAR integrity measures rely on a clean JavaScript execution environment, failing to validate the initial V8 snapshot allows attackers with local write access to bypass those measures.
An nftables configuration allows established connections or ARP/NDP packets before applying MAC/IP anti-spoofing filters. This improper network rule order permits an inside attacker to effectively spoof ARP or NDP messages and intercept traffic, bypassing required bridge network isolation features. To repair this issue, ensure MAC address authentication filt
Using `/dev/null` directly as a mount source without verifying its device type exposes the system to attacks where an adversary controls `/dev/null`. In a container, it could be a symlink to `/proc/kcore` or other sensitive paths, leading to privilege escalation, host filesystem modification, or container escape. Also avoid dynamically checking `Rdev` agains
The app dynamically loads code from another package using `createPackageContext` with `CONTEXT_IGNORE_SECURITY` without checking if the target package is a verified system application. This allows local privilege escalation via package squatting, enabling untrusted code execution. Verify the package against `ApplicationInfo.FLAG_SYSTEM` or properly check its
The return value of `gcry_md_get_algo_dlen()` is passed directly to a memory management or comparison function without validation. If an invalid or unsupported hash algorithm ID is provided, this function returns 0. When passed to functions like `memcmp`, a 0-byte comparison is performed which always evaluates to zero (0/true), potentially causing authentica
