Knowledge Base - Issues
Our knowledge-base provides a comprehensive collection of information on vulnerabilities related to cyber security.IPA symbol table (CWE-200) is a type of IT vulnerability that is associated with the usage of platforms such as iOS and mobile apps. This type of vulnerability allows attackers to gain access to sensitive information by using the symbol table of an iOS application. The symbol table contains information...
Ability to Forge Requests is a vulnerability in Web and API applications that can allow attackers to send requests with forged data to the application. This vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) in the Common Weakness Enumeration (CWE) directory and is identified as a Business Logic vulnerability...
Abuse of Mobile Network Connection is a configuration management vulnerability, which can occur in Android, iOS, and Mobile App applications. According to the CWE directory, this vulnerability occurs when the application connects to a mobile network to access services, but the data is not properly protected, allowing an attacker to...
Account Provisioning is an IT vulnerability of the category Identity Management, which occurs in Web and API. This vulnerability involves the ability to create and manage user accounts, allowing malicious actors to gain unauthorized access. According to the Common Weakness Enumeration (CWE) directory, Account Provisioning is a vulnerability that involves...
AddJavaScriptInterface Remote Code Execution is a vulnerability in Android and mobile application that allows attackers to execute arbitrary code on the device. It is a type of Input Validation vulnerability, identified by the Common Weakness Enumeration (CWE) directory as CWE-494. It is also included in the OWASP Testing Guide, which...
Address Space Layout Randomization (ASLR) is a computer security technique enforced by the operating system that randomizes the memory layout of a program. It is used to prevent malicious code from exploiting known address locations of a program in order to cause the program to crash or execute arbitrary code....
Admin account(s) which do not have the flag "this account is sensitive and cannot be delegated" is an IT vulnerability that falls within the category of Identity Management. This vulnerability occurs in Infrastructure when an administrator account is created without the sensitive flag, allowing users to access the account and...
Admin interface identified is a vulnerability related to information gathering. It is categorized under CWE-200 and is classified as an ‘Incomplete Information’ type vulnerability. This vulnerability arises when an attacker is able to identify and access the administrative interface of a web application or API without the user’s authorization. This...
Ajax request header manipulation (CWE-20) is a type of client side vulnerability in web and API applications that can be exploited by manipulating the request headers sent from the client. This attack can be used to gain access to restricted resources, bypass authentication or authorization mechanisms, or modify data stored...
Android Class Load Hijacking is a vulnerability that enables an attacker to gain control of a mobile application's runtime environment by exploiting the application's class loader. This vulnerability is identified in the Common Weakness Enumeration (CWE) directory as CWE-427 and is also described in the OWASP Testing Guide as a...
Android Class Loading Hijacking (CWE-919) is a vulnerability that affects the authorization process in Android and mobile app development. It is a type of vulnerability in which an attacker is able to exploit an application's class loading procedure to inject malicious code into the application. This malicious code can then...
Apache Solr local parameter injection is an input validation vulnerability (CWE-20) which occurs when user input is not properly sanitized and validated. This vulnerability can be exploited to inject local parameters into the application, which can then be used to execute malicious code on the server. This vulnerability is most...
APK files list is an Information Gathering vulnerability (CWE-200) that occurs in Mobile App and Android. It is a vulnerability that allows an attacker to view the list of installed applications on a user's device. This can be used in a variety of ways to gain further access to the...
Application checks rooted device is an IT vulnerability that allows attackers to root a mobile device and gain access to the device. This vulnerability is classified as CWE-716: Create a User with Unrestricted Privileges. According to the OWASP Testing Guide, this vulnerability can occur in Android, iOS, and Mobile App...
Application implements anti-debug techniques (CWE-16) is a resiliency vulnerability that occurs when an application implements measures to detect when it is being debugged or reverse-engineered. This vulnerability is often found in mobile apps, specifically on iOS devices where the application can detect when a debugger is attached and can take...
Application signed with an expired certificate is an authentication vulnerability that occurs when an application, such as an app on Android, iOS, or a Mobile App, is signed with an expired certificate, allowing users to execute a malicious application. This vulnerability has been identified in the Common Weakness Enumeration (CWE)...
Arbitrary Jump with Function Type Variable is a vulnerability of category Smart Contract, which affects Solidity-based Smart Contracts (SWC). This vulnerability is defined by Common Weakness Enumeration (CWE-427) as "Uncontrolled Search Path Element". The OWASP Testing Guide describes the vulnerability as a "failure to properly validate the contents of function...
ASP.NET debugging enabled is a configuration management vulnerability (CWE-534) that occurs in web and API applications. It occurs when ASP.NET debugging is enabled in a production environment, allowing attackers to access debugging information and potentially exploit the web application. According to the OWASP Testing Guide, "Debugging information can provide an...
ASP.NET tracing enabled is a vulnerability in web and API applications that can allow attackers to gain access to sensitive information stored in the application. This vulnerability is described in the Common Weakness Enumeration (CWE) directory as CWE-611: Improper Restriction of Excessive Authentication Attempts. It can also be found in...
ASP.NET ViewState without MAC enabled is a cryptography vulnerability, classified under CWE-352, that occurs in web and API applications. It occurs when the application does not properly validate the ViewState data transmitted between the client and the server, enabling malicious users to tamper with the contents of the ViewState. This...
Assert Violation is a vulnerability that occurs in smart contracts and is categorized as CWE-613. It occurs when an assertion is made in a smart contract and is not enforced. OWASP defines this type of vulnerability as "failure to properly enforce an assertion that has been made". This leads to...
Attribute hasFragileUserData not set is a vulnerability for Mobile App and Android applications found in the Common Weakness Enumeration (CWE) directory. It is categorized as a Platform Usage vulnerability. This vulnerability occurs when an application does not explicitly declare a sensitive user data attribute (e.g. username, password, etc.) so that...
Attribute requestLegacyExternalStorage set is a Configuration Management vulnerability, which usually occurs in Android and mobile applications. It is defined in the Common Weakness Enumeration (CWE) directory as "CWE-732: Incorrect Permission Assignment for Critical Resource". This means that the application does not assign the correct permissions to sensitive or critical resources,...
Attribute usesCleartextTraffic set is a type of IT vulnerability that is classified as a Network Communication vulnerability. This vulnerability is present in both Android and Mobile App systems, as well as in other similar systems. According to the CWE/SANS TOP 25 Most Dangerous Software Errors directory, this vulnerability occurs when...
Authentication Bypass by Capture-replay is a class of vulnerability found in web and API applications that allows an attacker to bypass authentication mechanisms by replaying credentials or authentication tokens that were previously captured (CWE-287). The attack is usually executed by intercepting the authentication traffic via man-in-the-middle or by sniffing the...
Authentication Bypass by Spoofing is a type of vulnerability which occurs when an attacker is able to bypass the authentication process by providing false or incorrect credentials. This vulnerability is categorized under Authentication in the [Common Weakness Enumeration (CWE)](https://cwe.mitre.org/data/definitions/287.html) directory and is applicable to Web and API applications. It is...
Authentication Bypass Using an Alternate Path or Channel (CWE-287) is a vulnerability that can occur when authentication is not properly enforced, or when an alternate path or channel is used to bypass authentication. In web and API applications, this can occur when an attacker can gain access to an application...
Authorization through tx.origin is an IT vulnerability in the category of Smart Contract, which occurs in the Solidity programming language (SWC). This vulnerability allows an attacker to bypass authorization checks as the tx.origin parameter appears to be trusted by the Smart Contract. According to the Common Weakness Enumeration (CWE) directory,...
Automatic Reference Counting (ARC) not enforced is a type of Configuration Management vulnerability (CWE-822) that occurs in mobile applications and iOS. It is an issue where a reference count is not correctly enforced and allows memory to be accessed even when the reference count is 0 or less. This can...
Backdoors are authentication vulnerabilities that allow attackers to bypass authentication mechanisms and gain access to systems, applications, or other resources. This type of vulnerability is defined in the Common Weakness Enumeration (CWE) directory as CWE-798: Use of Hard-coded Credentials. It affects web and API applications as well as infrastructure components...
Backup file is an authorization vulnerability that occurs when an application does not properly restrict access to backup files, such as database backups. This type of vulnerability allows an attacker to gain access to sensitive data, such as passwords and personal information, which can be used to gain further access...
Backup mode disabled is a vulnerability within the Configuration Management category of the Common Weakness Enumeration (CWE-16). It is related to a lack of secure configuration management, where the configuration of a system is not set up correctly. This can lead to the system becoming vulnerable to attack. Specifically, the...
Base64-encoded data in parameter is a type of cryptography vulnerability that occurs in Web and API applications. According to Common Weakness Enumeration (CWE) directory, it is classified as CWE-344: Improper Insufficient Cryptographic Validation. This vulnerability is caused when an application fails to validate or restrict the unverified Base64- encoded data...
Block values as a proxy for time (CWE-843) is a type of vulnerability that is present in Smart Contracts, particularly those generated in programming languages such as Solidity and Vyper. This vulnerability arises when the time value of a block is used as a proxy for an application's time value....
Broadcast receiver dynamic registration is a type of authorization vulnerability that occurs in mobile applications and Android operating systems. This vulnerability occurs when an application registers a broadcast receiver dynamically, and does not properly control the intent filters (CWE-284). This can lead to an attacker sending a malicious intent to...
Browser Cache Weaknesses is a type of authentication vulnerability, commonly found in Web and API applications, as classified by the Common Weakness Enumeration (CWE) directory. This vulnerability occurs when a browser stores credentials and other sensitive information in the browser cache, and this information can be accessed by an attacker,...
Browser cross-site scripting filter disabled (CWE-79) is a configuration management vulnerability that falls under Web and API category. This vulnerability allows malicious code to be executed in the user’s browser, as the cross-site scripting filter is not enabled. According to the OWASP Testing Guide, cross-site scripting filters are used to...
Browser Storage is a type of Client Side Vulnerability (CWE-79) which permits unvalidated data to be stored on the browser. This vulnerability is most commonly found in web and API applications, where it can be exploited by a malicious attacker to extract sensitive user data, such as passwords, session tokens,...
Bypassing Authorization Schema is an authorization vulnerability that occurs in web and API applications. It is categorized under CWE-285 (Improper Authorization) in the Common Weakness Enumeration (CWE) directory. According to the Open Web Application Security Project (OWASP) Testing Guide, this type of attack occurs when an attacker manages to access...
Cacheable HTTPS response, CWE-315, occurs when a web server or API responds to an HTTPS request with a response that is marked as cacheable. This can lead to the response being stored in an unencrypted form, exposing sensitive data to anyone with access to the cache. According to the OWASP...
Call to dynamic code loading API is a type of authorization vulnerability that affects Android, iOS and Mobile Apps. This vulnerability allows attackers to bypass authentication measures, such as user accounts, by loading code into the application dynamically. This type of attack is classified as CWE-285 (Improper Authorization) according to...
With DFS, a WiFi in the 5Ghz range can perform an automatic channel change if another device is detected on the channel used. This is particularly intended to prevent weather radar systems operating in this frequency range from being disturbed by WiFis. To detect other systems, the channel must be...
Circumvention of Work Flows, also known as CWE-20, is a type of Business Logic vulnerability which allows attackers to bypass established workflow procedures. This vulnerability can occur in both web-based and API-based applications. According to the Common Weakness Enumeration (CWE) directory, the vulnerability is defined as “the ability to bypass...
Cleartext storage of sensitive information in cookie is a vulnerability that occurs when an application stores sensitive information in a cookie without any encryption or hashing. This can make it easy for an attacker to access the stored information. This vulnerability is classified as CWE-312 and is listed in the...
Description
Cleartext submission of password is a vulnerability classified under CWE-259: Use of Hard-coded Password. It occurs when a password is transmitted in a non-encrypted form during authentication processes over an open network like the internet. This is a high risk vulnerability as unencrypted data can be easily intercepted by malicious...
Clickjacking (UI Redressing) is a type of attack that occurs when an attacker uses multiple transparent or opaque layers to deceive a user into clicking on a button or link on another page when they were expecting to click on the top level page. This attack can be used to...
Client-side HTTP parameter pollution (CWE-20) is a type of web application vulnerability that occurs when user-supplied parameters are used to manipulate the intended logic of a web application. The attacker can inject additional HTTP parameters into a single HTTP request, which can be used to manipulate the application's behaviour. By...
Description
Client-side JSON injection (DOM-based) is a type of vulnerability that occurs when a malicious user is able to inject JSON directly into a web page, usually through a browser, allowing malicious code to be executed within the browser. This vulnerability is categorized as a Client Side Vulnerability according to the...
Client-side Resource Manipulation (CWE-502) is one of the most critical client-side vulnerabilities that can occur in web and API applications. It is described in the [Common Weakness Enumeration (CWE)](https://cwe.mitre.org/data/definitions/502.html) directory as the ability to manipulate resources in the client-side before they are used by the application. This vulnerability can be...
Client-side SQL injection (DOM-based) is a type of injection attack that is classified as a Client Side Vulnerability (CWE-79). It occurs when a web application allows user-supplied input to be executed as part of a SQL query without proper validation or sanitization. According to the OWASP Testing Guide, DOM-based SQL...
Showing entries 1 to 50 of 403 entries.