Amazon Q
Detector Library
Scala detectors (48/48)
Improper Neutralization of Special Elements in Data QueryCookie Without Http Only FlagEL InjectionAvoid Persistent CookiesOS command injectionImproper AuthenticationArgument InjectionInsecure host name verifierServer-Side Request ForgeryInsecure CryptographyTemplate InjectionExpression Language InjectionInteger OverflowLog InjectionUntrusted data in http sessionLDAP InjectionInsecure LDAP ConfigurationSMTP injectionInsecure connection using unencrypted protocolDeserialization of Untrusted DataHTTP response splittingInsecure servlet handlingIncorrect Permission AssignmentImproper handling of unicode encodingSQL injectionUse of Insufficiently Random ValuesInsecure cookieCode InjectionCRLF InjectionUse Of RSA AlgorithmPath TraversalURL redirection to untrusted siteImproper Validation Of Array IndexHardcoded credentialsInsufficient Protected CredentialsInsecure jax endpoint usageXML External EntityInsecure CORS policyJS evalExternal Access to Files or DirectoriesIncorrect Certificate Hostname VerificationExternally-Controlled Format StringNoSQL injectionImproper privilege managementCross Site Request ForgeryCross-site scriptingImproper Certificate ValidationDisabled HTML autoescape
Hardcoded credentials Critical
Hardcoded credentials can be intercepted by malicious actors. Even after removing them from the code, they may still pose a risk because an attacker might have recorded them to use them at a later point in time.
Detector ID
scala/hardcoded-credentials@v1.0
Category
