security Errors

84 entries

Error Code Domain Category Fix Rate Confidence Tier
Bcrypt accepts password but silently ignores characters beyond 72 bytes — security authentication 88% 90% ai_generated
Unauthorized access to restricted resource — security access_error 82% 86% ai_generated
Certificate pinning check failed — security tls_error 78% 82% ai_generated
XSS attack succeeds via uploaded file because browser sniffs content type instead of respecting Content-Type header — security xss 90% 92% ai_generated
Access-Control-Allow-Origin: * with credentials — security config_error 85% 88% ai_generated
CORS preflight succeeds but subsequent request fails with 403, or auth changes aren't reflected — security cors 85% 88% ai_generated
Access-Control-Allow-Origin cannot be wildcard when credentials flag is true — security config_error 88% 85% ai_generated
CORS request with credentials fails: 'Access-Control-Allow-Origin' cannot be wildcard when credentials flag is true — security cors 92% 95% ai_generated
XSS despite CSP — Content-Security-Policy allows unsafe-inline — security web_security 88% 90% ai_generated
Refused to execute inline script because it violates Content-Security-Policy — security security_error 85% 88% ai_generated
403 Forbidden: CSRF token validation failed — security auth_error 85% 88% ai_generated
CVE found in dependency: high severity — security vulnerability_error 82% 86% ai_generated
ObjectInputStream: deserialization of untrusted data — security vulnerability_error 80% 84% ai_generated
Remote code execution — unsafe deserialization of untrusted data — security deserialization 88% 92% ai_generated
java.io.ObjectInputStream: Deserialization of untrusted data — security security_error 85% 88% ai_generated
Session token stolen via XSS — cookie missing HttpOnly flag — security session_security 90% 92% ai_generated
Warning: Cookie set without HttpOnly flag — security security_warning 92% 90% ai_generated
JWT validation bypassed by changing algorithm to 'none' in token header — security authentication 92% 95% ai_generated
JWT validation bypass: algorithm confusion attack — security auth_error 82% 86% ai_generated
JWT verification failed: algorithm "none" is not allowed — security security_error 90% 88% ai_generated
OAuth2 authorization code can be injected by attacker due to missing state parameter validation — security authentication 92% 95% ai_generated
Unvalidated redirect to external URL — security vulnerability_error 85% 88% ai_generated
Path traversal — ../ sequences bypass file access control — security file_security 90% 92% ai_generated
Security: Path traversal attempt detected: ../../../etc/passwd — security security_error 88% 87% ai_generated
Path traversal: ../../../etc/passwd — security vulnerability_error 85% 88% ai_generated
Rate limit bypassed via header manipulation — security vulnerability_error 80% 84% ai_generated
Session hijacking possible because session ID is not regenerated after login — security session_management 90% 92% ai_generated
Session fixation: session ID not regenerated after login — security auth_error 85% 88% ai_generated
SQL injection detected in user input — security vulnerability_error 88% 90% ai_generated
SQL injection via ORM raw query — parameterization bypassed — security injection 92% 93% ai_generated
SQL injection vulnerability detected in raw query — security security_error 92% 90% ai_generated
SSRF: Request to internal network address blocked — security security_error 85% 87% ai_generated
SSRF attack accesses cloud metadata endpoint (169.254.169.254) via user-supplied URL — security ssrf 92% 95% ai_generated
SSRF: server-side request to internal resource — security vulnerability_error 82% 86% ai_generated
Secret comparison vulnerable to timing attack because regular == leaks information via response time — security cryptography 85% 88% ai_generated
SSL: CERTIFICATE_VERIFY_FAILED - unable to get local issuer certificate, even though cert is valid ERTIFICATE security tls 90% 92% ai_generated
XSS: Unsafe use of innerHTML with user-controlled data — security security_error 90% 88% ai_generated
XSS: reflected user input in HTML response — security vulnerability_error 85% 88% ai_generated
XXE: external entity reference in XML parser — security vulnerability_error 85% 88% ai_generated
Race condition in token revocation allows stale token reuse AUTH_RACE_002 security runtime_error 78% 82% ai_generated
Credential stuffing attack succeeds because rate limiting is bypassed by rotating IP addresses AUTH_RATE_003 security auth_error 75% 85% ai_generated
HSTS header missing 'includeSubDomains' directive allows cookie theft on subdomains SEC_HSTS_004 security config_error 95% 90% ai_generated
SQL injection in stored procedure due to dynamic SQL concatenation SQL_INJ_005 security data_error 92% 87% ai_generated
Insecure Direct Object Reference (IDOR) allows access to another user's data via predictable IDs AUTH_IDOR_006 security auth_error 88% 85% ai_generated
OAuth2 consent page XSS via client application name containing malicious script — security auth_error 88% 85% ai_generated
AWS S3 bucket policy denies access despite correct IAM permissions because of incorrect ARN in policy AccessDenied security config_error 92% 88% ai_generated
LDAP injection via user input in search filter allows unauthorized access to directory entries — security data_error 90% 86% ai_generated
Command injection via file upload filename when processed by system shell — security runtime_error 91% 87% ai_generated
OAuth2 refresh token reuse detection failure allows token theft to go unnoticed — security auth_error 87% 84% ai_generated
Kubernetes secret exposed in environment variable via pod spec due to missing encoding or escaping — security config_error 89% 83% ai_generated
OAuth2 authorization code intercepted by reverse proxy due to missing TLS termination at proxy — security auth_error 92% 85% ai_generated
JWT kid parameter allows SQL injection when used to fetch public key from database — security data_error 90% 88% ai_generated
OAuth2 state parameter reuse allows CSRF via replay attack — security auth_error 88% 83% ai_generated
SAML XML signature wrapping attack bypasses signature validation — security protocol_error 85% 87% ai_generated
OAuth2 JWT token issuer mismatch: token was issued by a different identity provider A4002 security auth_error 82% 88% ai_generated
Cookie tampering detected: HMAC signature validation failed for session cookie SEC-3001 security auth_error 85% 85% ai_generated
OAuth2 redirect_uri mismatch: the provided redirect URI does not match any registered callback URL OAuth2-400 security config_error 92% 90% ai_generated
OAuth2 token reuse detected: same authorization code used more than once OAuth2-409 security auth_error 93% 88% ai_generated
TLS certificate hostname mismatch: the certificate's CN or SAN does not match the requested hostname TLS-1002 security tls_error 90% 87% ai_generated
OAuth2 client secret exposed in application log: sensitive credentials written to log file SEC-2001 security config_error 88% 86% ai_generated
OAuth2 redirect_uri path traversal allows open redirect to attacker domain OAUTH2_REDIRECT_URI_PATH_TRAVERSAL security auth_error 78% 85% ai_generated
Missing SRI integrity attribute on script tag allows CDN tampering — security config_error 90% 85% ai_generated
OAuth2 authorization code intercepted via open redirect in redirect_uri AUTH_CODE_INTERCEPTION security protocol_error 80% 85% ai_generated
AWS KMS key deletion failed due to pending deletion without waiting period KMSInvalidStateException security resource_error 92% 88% ai_generated
OAuth2 refresh token rotation failed: refresh token reuse detected invalid_grant security protocol_error 85% 87% ai_generated
Kubernetes secret exposed in environment variable due to missing base64 encoding SecretDecodeError security config_error 95% 90% ai_generated
OAuth2 redirect_uri open redirect allows attacker to intercept authorization code via unvalidated wildcard OAUTH2-003 security auth_error 88% 85% ai_generated
SSRF: AWS metadata endpoint accessed via DNS rebinding bypassing IP-based blocklists SSRF-004 security network_error 78% 82% ai_generated
JWT RS256 public key used as HMAC secret allows token forgery — security auth_error 85% 88% ai_generated
OAuth2 authorization code injection: missing state parameter enables CSRF CSRF_TOKEN_MISSING security auth_error 92% 90% ai_generated
TLS weak cipher suite negotiation: server allows export-grade ciphers enabling downgrade attack SSL_WEAK_CIPHER security protocol_error 88% 87% ai_generated
SSRF bypasses cloud metadata endpoint block via redirect or alternative IP representation SSRF_METADATA_BYPASS security network_error 85% 89% ai_generated
OAuth2 refresh token replay detected: same refresh token used more than once invalid_grant security auth_error 80% 85% ai_generated
JWT issuer mismatch: token 'iss' claim does not match the expected issuer for this application JWT_ISSUER_MISMATCH security auth_error 90% 88% ai_generated
SAML XML signature wrapping attack: attacker injects malicious assertions that bypass signature validation SAML_SIGNATURE_WRAPPING security protocol_error 85% 87% ai_generated
OIDC authorization request missing state parameter allows CSRF attack on callback OIDC_MISSING_STATE security auth_error 95% 90% ai_generated
OAuth2 authorization code reuse detected: same authorization code used more than once invalid_grant security auth_error 90% 88% ai_generated
OAuth2 authorization code injection via missing PKCE OAUTH2_MISSING_PKCE security auth_error 85% 85% ai_generated
XSS via malicious file upload with Content-Disposition bypass XSS_FILE_UPLOAD_CONTENT_DISPOSITION security resource_error 88% 82% ai_generated
OAuth2 refresh token rotation failure allows token theft OAUTH2_REFRESH_TOKEN_ROTATION_FAILURE security auth_error 87% 83% ai_generated
OAuth2 JWT issuer mismatch allows token forgery OAUTH2_JWT_ISSUER_MISMATCH security auth_error 90% 84% ai_generated
OAuth2 redirect_uri mismatch allows callback interception OAUTH2_REDIRECT_URI_MISMATCH security auth_error 92% 86% ai_generated
OAuth2 token reuse detection failure allows replay attack OAUTH2_TOKEN_REUSE_DETECTION_FAILURE security auth_error 89% 81% ai_generated
OAuth2 authorization code can be injected by attacker via open redirector on client OAUTH2-CODE-INJECTION-001 security auth_error 85% 88% ai_generated