Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
Checking resource parentage or identity by testing substring presence in a Pulumi URN (e.g. `urn.includes(...)`) is susceptible to spoofing. Parse and validate the URN structure explicitly.
Naive URN prefix matching using split('$')[0] and startsWith can lead to policy validation bypasses due to crafted resource names. Parse URN type hierarchies structurally and enforce property-level value bindings.
Unescaped regex escape sequence '\s' in SQL string fragment. In Elixir string literals, '\s' evaluates to a single space character (0x20) instead of the SQL regex whitespace class '\\s'. This causes REGEXP_REPLACE or regex operators to match only literal spaces rather than all whitespace characters.
Multiple `osdCustom` validation rules are applied separately to the same schema instance. In Joi schema extensions, subsequent rules with the same name overwrite earlier rules rather than combining them, causing validation checks to be silently dropped. Consolidate validations into a single rule.
Cache lookup or write in object fetch method keys cache using only table and value without scoping by query column or method identifier, which can cause cache key collisions across different query fields (e.g. ID vs authentication token).
Using a substring match to find a dictionary key can lead to insecure matching (e.g., when checking hostnames, URLs or registry names), allowing an attacker to spoof configurations by registering a similar name (like an overlapping substring). Prefer exact matches (`===`) or proper parsing.
Inverted `memcmp` comparison: `memcmp` returns 0 when buffers are equal and non-zero when they differ. Using `!!memcmp(...)` to set a match or validation flag treats mismatches as valid and matching data as invalid, which can lead to TLS certificate validation bypass.
The code incorrectly checks for an IPv6 loopback literal (e.g., checking if byte 15 is 1) before checking whether the address is an IPv4-mapped IPv6 address. Mapped IPv4 loopback addresses (like `::ffff:127.0.0.1`) also end with a 1 (from `.1`) and will prematurely match the IPv6 literal check, failing loopback validation. Ensure `IN6_IS_ADDR_V4MAPPED` is ch
Checking an `escapeshellarg` or `escapeshellcmd` escaped string with filesystem functions like `is_executable` or `file_exists` is logically flawed. The escaped string includes shell quote characters, causing the check to fail. If this failed check unexpectedly alters control flow (e.g., falling back to unescaped input), it can result in vulnerabilities like
Using `isSet()` to check a boolean configuration option or feature toggle checks parameter presence rather than its boolean value. If the parameter is set to 'false', `isSet()` returns true, leading to improper bypass of security controls. Use `isOptionEnabled()` or an equivalent boolean value accessor instead.
Using `strings.Contains` to check an identifier like an Image or Name for exclusion can lead to evasion bypasses, as an attacker can craft names that contain the target substring. Use exact equality (`==`) or `strings.HasPrefix` instead.
Simultaneously checking sequence number and message type (e.g. handshake type) to identify duplicate packets in a queue loop is unsafe. This pattern ignores duplicate sequence numbers that have mismatched types, leading to unstable packet sorting or Denial of Service (DoS) when invalid duplicated packets are improperly queued. Separate the conditions to chec
Django ORM expression `Lower(...)` is used in a string membership check (`in` / `not in`). `Lower(...)` returns an ORM expression object rather than a lowercased string, causing comparison against string containers to always fail. Use `key.lower()` instead.
Validating a path using `startsWith` without ensuring a trailing path separator can allow sandbox bypasses. A path traversal attack could construct a path that resolves to a sibling directory sharing the sandbox directory's name as a prefix (e.g., escaping `/path/memories` to `/path/memories_backup`). Append `path.sep` to the root path and also verify exact
A payment channel voucher amount is checked using `<` against a maximum of spent and settled funds. This may allow an attacker to submit a voucher exactly equal to the settled amount, bypassing the requirement to commit new funds. Establish a dedicated check that ensures the voucher is strictly greater than the settled funds, rather than using a loose ternar
Evaluating AST node properties using truthiness checks (e.g., `if (node.text)`) rather than nullish checks (`!= null`) can allow an empty string (`""`) to bypass safety mechanisms. Execution then falsely falls through to evaluate unsafe downstream properties (like `raw` or `html`) on the same node, leading to XSS or logic bypass. Update property checks to us
Django's database expression `Lower(...)` was used in a Python membership test instead of `str.lower()`. `Lower(...)` returns an Expression object, causing membership checks against string collections to always evaluate incorrectly.
Loose equality comparison (`==` or `!=`) used on authentication token or key variable. In PHP, loose comparisons can lead to type juggling issues and authentication bypass. Use strict comparison (`===` or `!==`) or `hash_equals()` instead.
Using `matches!` or `assert_matches!` with a simple lowercase identifier as the pattern evaluates to `true` unconditionally (or always passes the assertion). In Rust, lowercase identifiers in patterns act as irrefutable variable bindings, bypassing any intended value comparison. This can lead to severe security vulnerabilities if used for validation. If you
Chaining 'orWhere' with multiple 'where' clauses without closure grouping causes SQL operator precedence issues (AND binds tighter than OR), potentially bypassing tenant scoping or authorization filters.
A signed/unsigned comparison vulnerability exists when validating the LZSS sliding window size. `(mask + 1)` is implicitly evaluated as a signed integer, which causes security checks against `dictionary_size` to fail if `mask + 1` becomes negative or has representation mismatches. Cast the signed operand to `unsigned int` to fix the issue.
A logical precedence error allows short-circuiting of `is_uploaded_file` checks. The condition evaluates an `||` operator where the right side contains the `is_uploaded_file` security check. Due to short-circuiting, if the left side of `||` is true, the `is_uploaded_file` check is entirely skipped, allowing an attacker to supply a malicious local or arbitrar
When comparing an expected token or digest against user-provided input using `strncmp()`, dynamically calculating the comparison length using an input string size minus an offset (e.g., `input.size() - offset`) creates an authentication bypass vulnerability. An attacker can provide a shorter input or empty credentials that match a prefix of the expected toke
Zero-padding lookup table slots implicitly introduces a (0, 0) entry. This undermines the soundness of the zero-knowledge proof by allowing a malicious prover to prove f(0) = 0 for any lookup table. To fix, pad unused slots with a valid lookup table entry (e.g., the first element).
