Skip to content

Code Security Report: 1074 high severity findings, 2626 total findings [master] #29

Open
Open
Code Security Report: 1074 high severity findings, 2626 total findings [master]#29

Description

@mend-developer-platform-dev
mend-developer-platform-dev
bot
opened on Sep 17, 2025

Code Security Report

Scan Metadata

Latest Scan: 2025-09-17 07:59AM
Total Findings: 2626 | New Findings: 0 | Resolved Findings: 0
Tested Project Files: 5549
Detected Programming Languages: 2 (JavaScript / TypeScript*, Java*)

Most Relevant Findings

The list below presents the 10 most relevant findings that need your attention.

Severity
Vulnerability Type
CWE
File
Data Flows
Detected
Violated Workflows
Violation Priority
Violation SLA
High
Command Injection
1
2025-09-17 08:06AM
Code Test
HIGH
2025-10-17
Vulnerable Code

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00006.java

Lines 62 to 71 in 1fd00a7

argList.add("echo " + param);
ProcessBuilder pb = new ProcessBuilder();
pb.command(argList);
try {
Process p = pb.start();
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
} catch (IOException e) {

Data Flows (1 detected)

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00006.java

Line 46 in 1fd00a7

param = request.getHeader("BenchmarkTest00006");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00006.java

Line 50 in 1fd00a7

param = java.net.URLDecoder.decode(param, "UTF-8");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00006.java

Line 62 in 1fd00a7

argList.add("echo " + param);

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00006.java

Line 66 in 1fd00a7

pb.command(argList);
See More

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00006.java

Line 46 in 1fd00a7

param = request.getHeader("BenchmarkTest00006");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00006.java

Line 50 in 1fd00a7

param = java.net.URLDecoder.decode(param, "UTF-8");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00006.java

Line 62 in 1fd00a7

argList.add("echo " + param);

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00006.java

Line 66 in 1fd00a7

pb.command(argList);

Secure Code Warrior Training Material
High
Command Injection
1
2025-09-17 08:06AM
Code Test
HIGH
2025-10-17
Vulnerable Code

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00007.java

Lines 57 to 66 in 1fd00a7

Runtime r = Runtime.getRuntime();
try {
Process p = r.exec(args, argsEnv);
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
} catch (IOException e) {
System.out.println("Problem executing cmdi - TestCase");
response.getWriter()
.println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));

Data Flows (1 detected)

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00007.java

Line 46 in 1fd00a7

param = request.getHeader("BenchmarkTest00007");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00007.java

Line 50 in 1fd00a7

param = java.net.URLDecoder.decode(param, "UTF-8");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00007.java

Line 56 in 1fd00a7

String[] argsEnv = {param};

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00007.java

Line 61 in 1fd00a7

Process p = r.exec(args, argsEnv);

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00007.java

Line 46 in 1fd00a7

param = request.getHeader("BenchmarkTest00007");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00007.java

Line 50 in 1fd00a7

param = java.net.URLDecoder.decode(param, "UTF-8");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00007.java

Line 56 in 1fd00a7

String[] argsEnv = {param};

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00007.java

Line 61 in 1fd00a7

Process p = r.exec(args, argsEnv);

Secure Code Warrior Training Material
High
Command Injection
1
2025-09-17 08:06AM
Code Test
HIGH
2025-10-17
Vulnerable Code

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00017.java

Lines 59 to 68 in 1fd00a7

Runtime r = Runtime.getRuntime();
try {
Process p = r.exec(cmd + param);
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
} catch (IOException e) {
System.out.println("Problem executing cmdi - TestCase");
response.getWriter()
.println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));

Data Flows (1 detected)

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00017.java

Line 45 in 1fd00a7

java.util.Enumeration<String> headers = request.getHeaders("BenchmarkTest00017");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00017.java

Line 48 in 1fd00a7

param = headers.nextElement(); // just grab first element

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00017.java

Line 52 in 1fd00a7

param = java.net.URLDecoder.decode(param, "UTF-8");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00017.java

Line 63 in 1fd00a7

Process p = r.exec(cmd + param);

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00017.java

Line 45 in 1fd00a7

java.util.Enumeration<String> headers = request.getHeaders("BenchmarkTest00017");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00017.java

Line 48 in 1fd00a7

param = headers.nextElement(); // just grab first element

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00017.java

Line 52 in 1fd00a7

param = java.net.URLDecoder.decode(param, "UTF-8");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00017.java

Line 63 in 1fd00a7

Process p = r.exec(cmd + param);

Secure Code Warrior Training Material
High
Command Injection
1
2025-09-17 08:06AM
Code Test
HIGH
2025-10-17
Vulnerable Code

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00176.java

Lines 60 to 69 in 1fd00a7

Runtime r = Runtime.getRuntime();
try {
Process p =
r.exec(cmd + bar, argsEnv, new java.io.File(System.getProperty("user.dir")));
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
} catch (IOException e) {
System.out.println("Problem executing cmdi - TestCase");
response.getWriter()
.println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));

Data Flows (1 detected)

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00176.java

Line 45 in 1fd00a7

param = request.getHeader("BenchmarkTest00176");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00176.java

Line 49 in 1fd00a7

param = java.net.URLDecoder.decode(param, "UTF-8");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00176.java

Line 51 in 1fd00a7

String bar = param;

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00176.java

Line 64 in 1fd00a7

r.exec(cmd + bar, argsEnv, new java.io.File(System.getProperty("user.dir")));

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00176.java

Line 45 in 1fd00a7

param = request.getHeader("BenchmarkTest00176");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00176.java

Line 49 in 1fd00a7

param = java.net.URLDecoder.decode(param, "UTF-8");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00176.java

Line 51 in 1fd00a7

String bar = param;

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00176.java

Line 64 in 1fd00a7

r.exec(cmd + bar, argsEnv, new java.io.File(System.getProperty("user.dir")));

Secure Code Warrior Training Material
High
Command Injection
1
2025-09-17 08:06AM
Code Test
HIGH
2025-10-17
Vulnerable Code

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00407.java

Lines 77 to 86 in 1fd00a7

Runtime r = Runtime.getRuntime();
try {
Process p = r.exec(args, argsEnv);
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
} catch (IOException e) {
System.out.println("Problem executing cmdi - TestCase");
response.getWriter()
.println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));

Data Flows (1 detected)

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00407.java

Line 43 in 1fd00a7

String param = request.getParameter("BenchmarkTest00407");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00407.java

Line 50 in 1fd00a7

valuesList.add(param);

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00407.java

Line 55 in 1fd00a7

bar = valuesList.get(0); // get the param value

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00407.java

Line 68 in 1fd00a7

args = new String[] {a1, a2, cmd, bar};

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00407.java

Line 81 in 1fd00a7

Process p = r.exec(args, argsEnv);

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00407.java

Line 43 in 1fd00a7

String param = request.getParameter("BenchmarkTest00407");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00407.java

Line 50 in 1fd00a7

valuesList.add(param);

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00407.java

Line 55 in 1fd00a7

bar = valuesList.get(0); // get the param value

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00407.java

Line 68 in 1fd00a7

args = new String[] {a1, a2, cmd, bar};

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00407.java

Line 81 in 1fd00a7

Process p = r.exec(args, argsEnv);

Secure Code Warrior Training Material
High
Command Injection
1
2025-09-17 08:06AM
Code Test
HIGH
2025-10-17
Vulnerable Code

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00409.java

Lines 86 to 95 in 1fd00a7

Runtime r = Runtime.getRuntime();
try {
Process p = r.exec(args, argsEnv, new java.io.File(System.getProperty("user.dir")));
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
} catch (IOException e) {
System.out.println("Problem executing cmdi - TestCase");
response.getWriter()
.println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));

Data Flows (1 detected)

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00409.java

Line 43 in 1fd00a7

String param = request.getParameter("BenchmarkTest00409");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00409.java

Line 60 in 1fd00a7

bar = param;

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00409.java

Line 77 in 1fd00a7

args = new String[] {a1, a2, cmd, bar};

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00409.java

Line 90 in 1fd00a7

Process p = r.exec(args, argsEnv, new java.io.File(System.getProperty("user.dir")));

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00409.java

Line 43 in 1fd00a7

String param = request.getParameter("BenchmarkTest00409");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00409.java

Line 60 in 1fd00a7

bar = param;

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00409.java

Line 77 in 1fd00a7

args = new String[] {a1, a2, cmd, bar};

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00409.java

Line 90 in 1fd00a7

Process p = r.exec(args, argsEnv, new java.io.File(System.getProperty("user.dir")));

Secure Code Warrior Training Material
High
Command Injection
1
2025-09-17 08:06AM
Code Test
HIGH
2025-10-17
Vulnerable Code

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00412.java

Lines 60 to 69 in 1fd00a7

this.getClass().getClassLoader());
String[] argsEnv = {bar};
Runtime r = Runtime.getRuntime();
try {
Process p = r.exec(cmd, argsEnv, new java.io.File(System.getProperty("user.dir")));
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
} catch (IOException e) {
System.out.println("Problem executing cmdi - TestCase");
response.getWriter()
.println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));

Data Flows (1 detected)

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00412.java

Line 43 in 1fd00a7

String param = request.getParameter("BenchmarkTest00412");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00412.java

Line 50 in 1fd00a7

valuesList.add(param);

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00412.java

Line 55 in 1fd00a7

bar = valuesList.get(1); // get the last 'safe' value

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00412.java

Line 61 in 1fd00a7

String[] argsEnv = {bar};

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00412.java

Line 64 in 1fd00a7

Process p = r.exec(cmd, argsEnv, new java.io.File(System.getProperty("user.dir")));

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00412.java

Line 43 in 1fd00a7

String param = request.getParameter("BenchmarkTest00412");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00412.java

Line 50 in 1fd00a7

valuesList.add(param);

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00412.java

Line 55 in 1fd00a7

bar = valuesList.get(1); // get the last 'safe' value

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00412.java

Line 61 in 1fd00a7

String[] argsEnv = {bar};

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00412.java

Line 64 in 1fd00a7

Process p = r.exec(cmd, argsEnv, new java.io.File(System.getProperty("user.dir")));

Secure Code Warrior Training Material
High
Command Injection
1
2025-09-17 08:06AM
Code Test
HIGH
2025-10-17
Vulnerable Code

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00499.java

Lines 58 to 67 in 1fd00a7

String[] argsEnv = {"Foo=bar"};
Runtime r = Runtime.getRuntime();
try {
Process p = r.exec(cmd + bar, argsEnv);
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
} catch (IOException e) {
System.out.println("Problem executing cmdi - TestCase");
response.getWriter()
.println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));

Data Flows (1 detected)

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00499.java

Line 43 in 1fd00a7

java.util.Map<String, String[]> map = request.getParameterMap();

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00499.java

Line 46 in 1fd00a7

String[] values = map.get("BenchmarkTest00499");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00499.java

Line 47 in 1fd00a7

if (values != null) param = values[0];

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00499.java

Line 50 in 1fd00a7

String bar = param;

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00499.java

Line 62 in 1fd00a7

Process p = r.exec(cmd + bar, argsEnv);

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00499.java

Line 43 in 1fd00a7

java.util.Map<String, String[]> map = request.getParameterMap();

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00499.java

Line 46 in 1fd00a7

String[] values = map.get("BenchmarkTest00499");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00499.java

Line 47 in 1fd00a7

if (values != null) param = values[0];

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00499.java

Line 50 in 1fd00a7

String bar = param;

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00499.java

Line 62 in 1fd00a7

Process p = r.exec(cmd + bar, argsEnv);

Secure Code Warrior Training Material
High
Command Injection
1
2025-09-17 08:06AM
Code Test
HIGH
2025-10-17
Vulnerable Code

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00500.java

Lines 64 to 73 in 1fd00a7

Runtime r = Runtime.getRuntime();
try {
Process p =
r.exec(cmd + bar, argsEnv, new java.io.File(System.getProperty("user.dir")));
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
} catch (IOException e) {
System.out.println("Problem executing cmdi - TestCase");
response.getWriter()
.println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));

Data Flows (1 detected)

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00500.java

Line 43 in 1fd00a7

java.util.Map<String, String[]> map = request.getParameterMap();

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00500.java

Line 46 in 1fd00a7

String[] values = map.get("BenchmarkTest00500");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00500.java

Line 47 in 1fd00a7

if (values != null) param = values[0];

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00500.java

Line 54 in 1fd00a7

if ((500 / 42) + num > 200) bar = param;

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00500.java

Line 68 in 1fd00a7

r.exec(cmd + bar, argsEnv, new java.io.File(System.getProperty("user.dir")));

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00500.java

Line 43 in 1fd00a7

java.util.Map<String, String[]> map = request.getParameterMap();

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00500.java

Line 46 in 1fd00a7

String[] values = map.get("BenchmarkTest00500");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00500.java

Line 47 in 1fd00a7

if (values != null) param = values[0];

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00500.java

Line 54 in 1fd00a7

if ((500 / 42) + num > 200) bar = param;

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00500.java

Line 68 in 1fd00a7

r.exec(cmd + bar, argsEnv, new java.io.File(System.getProperty("user.dir")));

Secure Code Warrior Training Material
High
Command Injection
1
2025-09-17 08:06AM
Code Test
HIGH
2025-10-17
Vulnerable Code

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00741.java

Lines 66 to 75 in 1fd00a7

String[] argsEnv = {"Foo=bar"};
Runtime r = Runtime.getRuntime();
try {
Process p = r.exec(cmd + bar, argsEnv);
org.owasp.benchmark.helpers.Utils.printOSCommandResults(p, response);
} catch (IOException e) {
System.out.println("Problem executing cmdi - TestCase");
response.getWriter()
.println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage()));

Data Flows (1 detected)

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00741.java

Line 43 in 1fd00a7

String[] values = request.getParameterValues("BenchmarkTest00741");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00741.java

Line 45 in 1fd00a7

if (values != null && values.length > 0) param = values[0];

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00741.java

Line 52 in 1fd00a7

valuesList.add(param);

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00741.java

Line 57 in 1fd00a7

bar = valuesList.get(1); // get the last 'safe' value

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00741.java

Line 70 in 1fd00a7

Process p = r.exec(cmd + bar, argsEnv);

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00741.java

Line 43 in 1fd00a7

String[] values = request.getParameterValues("BenchmarkTest00741");

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00741.java

Line 45 in 1fd00a7

if (values != null && values.length > 0) param = values[0];

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00741.java

Line 52 in 1fd00a7

valuesList.add(param);

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00741.java

Line 57 in 1fd00a7

bar = valuesList.get(1); // get the last 'safe' value

BenchmarkJava/src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00741.java

Line 70 in 1fd00a7

Process p = r.exec(cmd + bar, argsEnv);

Secure Code Warrior Training Material

Findings Overview

Severity Vulnerability Type CWE Language Count
High Cross-Site Scripting CWE-79 Java* 343
High SQL Injection CWE-89 Java* 332
High Path/Directory Traversal CWE-22 Java* 173
High Command Injection CWE-78 Java* 134
High Unsafe Format String CWE-134 Java* 72
High XPath Injection CWE-643 Java* 19
High DOM Based Cross-Site Scripting CWE-79 JavaScript / TypeScript* 1
Medium Weak Pseudo-Random CWE-338 Java* 436
Medium Error Messages Information Exposure CWE-209 Java* 253
Medium Insecure Cryptographic Algorithm CWE-327 Java* 227
Medium Trust Boundary Violation CWE-501 Java* 99
Medium LDAP Injection CWE-90 Java* 36
Medium Loop Denial of Service CWE-400 Java* 23
Medium Hardcoded Password/Credentials CWE-798 Java* 3
Low Cookie Without 'HttpOnly' Flag CWE-1004 Java* 252
Low Weak Hash Strength CWE-328 Java* 113
Low HTTP Header Injection CWE-113 Java* 61
Low Missing Cryptographic Step CWE-325 Java* 49

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions