Amazon QDetector Library Sign in to Amazon Q

Amazon Q

Detector Library

Kotlin detectors (43/43)

Insecure cookie Insecure cryptography Insecure Jwt Parsing Weak Password Encoder Cookie Without Http Only Flag Generation of Predictable IV Improper Certificate Validation Integer Overflow Insecure Tls Version Improper Authentication Cryptographic key generator Weak pseudorandom number generation Misconfigured Concurrency LDAP injection Path traversal Cross-site scripting Reusing Nonce and key in encryption XML External Entity Code Injection Improper export of android app components Resource leak Untrusted Deserialization Server-side request forgery Cross-site request forgery NoSQL injection Log injection Hardcoded credentials Missing Release Of Memory Insecure Socket Enabling and overriding debug feature Null Pointer Dereference Insecure hashing Missing encryption of sensitive data Improper verification of Intent Insecure connection using unencrypted protocol OS Command Injection Sensitive information leak Insecure Bean Validation Cleartext Storage of Sensitive Information Unsafe File Extension SQL injection Incorrect Type Conversion Missing authentication

Weak Password Encoder High

Your code uses a non-standard or weak password encoder, which could allow an attacker to gain access to protected data. To protect your code, use a standard and secure encoder like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, Argon2PasswordEncoder, or SCryptPasswordEncoder. Avoid the use of the following encoders ShaPasswordEncoder, Md5PasswordEncoder, LdapShaPasswordEncoder, Md4PasswordEncoder, MessageDigestPasswordEncoder, NoOpPasswordEncoder, and StandardPasswordEncoder. Using secure password encoders helps ensure that passwords are stored safely and are resistant to common attacks.

Detector ID

kotlin/weak-password-encoder@v1.0

Category

Common Weakness Enumeration (CWE)

Tags