Leaderboard

Directly reading the Kubernetes ServiceAccount token from '/var/run/secrets/kubernetes.io/serviceaccount/token' can expose cluster credentials if the token is transmitted in outbound requests. Use a scoped token with a restricted audience instead.

Configuration value is passed directly to an OS command execution function without proper escaping or validation. An attacker with configuration modification privileges could inject arbitrary commands.

Schedule status is updated based on stream key lookup without verifying that the stream key belongs to the schedule or playlist owner. This can allow unauthorized users to modify or cancel scheduled broadcasts.

Route-bound model is updated directly from generic Request input without explicit authorization or FormRequest validation, potentially allowing IDOR or unauthorized modifications.

State-changing API action is executed while same-domain checks are explicitly bypassed without validating the HTTP request method or request origin, leading to CSRF.

Deserialization of data using ObjectInputStream without an ObjectInputFilter allowlist can allow remote code execution via gadget chains (CWE-502). Configure an ObjectInputFilter via setObjectInputFilter() before calling readObject() or readUnshared().

ARM CMSE non-secure callable entry function receives pointer '$PTR' from untrusted Non-Secure world without verifying memory attribution via cmse_check_address_range() or equivalent validation. This allows Non-Secure callers to pass pointers targeting Secure memory.

Session pointer obtained from `tee_ta_get_session` is used in `tee_ta_invoke_command` without checking if it is NULL. An invalid or unallocated session ID can result in a NULL pointer dereference and DoS.