Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Exposing pprof debug routes directly on a router without authentication or conditional checks may allow unauthorized actors to access sensitive profiling data such as process command-line arguments, environment variables, or memory dumps.
Go has a built in profiling service that is enabled by starting an HTTP server with `net/http/pprof` imported. The `/debug/pprof` endpoint does not require any authentication and can be accessed by anonymous users. This profiling endpoint can leak sensitive information and should not be enabled in production. To remediate this, remove the `net/http/pprof` im
GoCWE-489The Flask application is running with `debug=True` configured. By enabling this option, certain exceptions or errors could cause sensitive information to be leaked in HTTP responses. Additionally, it is not recommended to run a Flask application using `Flask.run(...)` in production. Instead, a WSGI server such as [gunicorn](https://flask.palletsprojects.com/
PythonCWE-489Remote WebView debugging is enabled.This can introduce security risks as it allows remote debugging tools, such as Chrome DevTools, to inspect and manipulate the WebView content. This can potentially expose sensitive information, including user data, session tokens, and other confidential data, to unauthorized parties. To fix this security issue, you should
KotlinCWE-489Remote WebView debugging is enabled. This allows an attacker with debugging access to interact with the webview and steal or corrupt data. To fix these security issues, it is recommended to disable remote debugging and restrict file access in the WebView. Here's how you can do it: ``` WebView webView = new WebView(context); // Disable remote debugging if (Bu
JavaCWE-489