Amazon Q
Detector Library
Scala detectors (48/48)
Improper Neutralization of Special Elements in Data QueryCookie Without Http Only FlagEL InjectionAvoid Persistent CookiesOS command injectionImproper AuthenticationArgument InjectionInsecure host name verifierServer-Side Request ForgeryInsecure CryptographyTemplate InjectionExpression Language InjectionInteger OverflowLog InjectionUntrusted data in http sessionLDAP InjectionInsecure LDAP ConfigurationSMTP injectionInsecure connection using unencrypted protocolDeserialization of Untrusted DataHTTP response splittingInsecure servlet handlingIncorrect Permission AssignmentImproper handling of unicode encodingSQL injectionUse of Insufficiently Random ValuesInsecure cookieCode InjectionCRLF InjectionUse Of RSA AlgorithmPath TraversalURL redirection to untrusted siteImproper Validation Of Array IndexHardcoded credentialsInsufficient Protected CredentialsInsecure jax endpoint usageXML External EntityInsecure CORS policyJS evalExternal Access to Files or DirectoriesIncorrect Certificate Hostname VerificationExternally-Controlled Format StringNoSQL injectionImproper privilege managementCross Site Request ForgeryCross-site scriptingImproper Certificate ValidationDisabled HTML autoescape
CRLF Injection High
The product incorporates CRLF (carriage return line feed) sequences for specific functions such as line or record separation, but fails to properly sanitize or mishandles CRLF sequences from inputs.
