AutoFix PR#59
Conversation
<style>
.r1 {font-weight: bold; text-decoration: underline}
.r2 {color: #008080; text-decoration-color: #008080; font-weight: bold}
.r3 {font-style: italic}
.r4 {color: #800080; text-decoration-color: #800080; font-weight: bold}
.r5 {color: #008080; text-decoration-color: #008080}
.r6 {color: #808000; text-decoration-color: #808000; font-weight: bold}
.r7 {font-weight: bold}
.r8 {color: #008080; text-decoration-color: #008080; background-color: #000000; font-weight: bold}
body {
color: #000000;
background-color: #ffffff;
}
</style>
|
|
Checking analysis of application
|
| ID | CVSS | Rating | Title |
|---|---|---|---|
| 1_2 | 9.0 | critical | Remote Code Execution: Code Injection Through Attacker-controlled Data via foo in SearchController.doGetSearch |
| Severity rating | Count |
|---|---|
| Critical | 1 |
| High | 0 |
| Medium | 0 |
| Low | 0 |
Allow one OSS or container finding: FAIL
(411 matched vulnerabilities; configured threshold is 1).
First 15 findings:
| ID | CVSS | Rating | CVE | Title |
|---|---|---|---|---|
| 1_128 | 10.0 | critical | CVE-2018-14721 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to… |
| 1_335 | 10.0 | critical | GMS-2022-558 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-beans. |
| 1_364 | 10.0 | critical | GMS-2022-559 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core. |
| 1_375 | 10.0 | critical | GMS-2022-560 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework.boot:spring-boot-starter-web. |
| 1_44 | 9.8 | critical | CVE-2017-5929 | QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderC… |
| 2_47 | 9.8 | critical | CVE-2019-10202 | A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, … |
| 2_10 | 9.0 | critical | CVE-2021-30139 | pkg:pkg/alpine/apk-tools@2.12.3-r0 |
| 2_15 | 9.0 | critical | CVE-2021-36159 | pkg:pkg/alpine/apk-tools@2.12.3-r0 |
| 2_60 | 9.0 | critical | CVE-2022-28391 | CVE-2022-28391 affecting package busybox for versions less than 1.36.1-3. A patched version of the package is available. |
| 2_79 | 9.0 | critical | CVE-2021-3711 | In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this … |
| 3_31 | 9.8 | critical | CVE-2019-10202 | A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, … |
| 3_8 | 9.0 | critical | CVE-2021-30139 | pkg:pkg/alpine/apk-tools@2.12.3-r0 |
| 3_12 | 9.0 | critical | CVE-2021-36159 | pkg:pkg/alpine/apk-tools@2.12.3-r0 |
| 3_57 | 9.0 | critical | CVE-2022-28391 | CVE-2022-28391 affecting package busybox for versions less than 1.36.1-3. A patched version of the package is available. |
| 3_75 | 9.0 | critical | CVE-2021-3711 | In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this … |
| Severity rating | Count |
|---|---|
| Critical | 66 |
| High | 228 |
| Medium | 108 |
| Low | 9 |
| Finding Type | Count |
|---|---|
| Oss_vuln | 210 |
| Container | 201 |
Allow no reachable OSS vulnerability: FAIL
(53 matched vulnerabilities; configured threshold is 0).
First 5 findings:
| ID | CVSS | Rating | CVE | Title |
|---|---|---|---|---|
| 1_272 | 9.8 | critical | CVE-2018-8014 | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insec… |
| 1_281 | 9.8 | critical | CVE-2020-1938 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as ha… |
| 1_284 | 9.8 | critical | CVE-2017-5651 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing.… |
| 1_271 | 9.1 | critical | CVE-2017-5648 | While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.R… |
| 1_261 | 9.0 | critical | CVE-2022-37434 | zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applic… |
| Severity rating | Count |
|---|---|
| Critical | 5 |
| High | 27 |
| Medium | 20 |
| Low | 1 |
| Finding Type | Count |
|---|---|
| Oss_vuln | 51 |
| Container | 2 |
3 rules failed.
<style>
.r1 {font-weight: bold; text-decoration: underline}
.r2 {color: #008080; text-decoration-color: #008080; font-weight: bold}
.r3 {font-style: italic}
.r4 {color: #800080; text-decoration-color: #800080; font-weight: bold}
.r5 {color: #008080; text-decoration-color: #008080}
.r6 {color: #808000; text-decoration-color: #808000; font-weight: bold}
.r7 {font-weight: bold}
.r8 {color: #008080; text-decoration-color: #008080; background-color: #000000; font-weight: bold}
body {
color: #000000;
background-color: #ffffff;
}
</style>
|
|
Checking analysis of application
|
| ID | CVSS | Rating | CVE | Title |
|---|---|---|---|---|
| 1_128 | 10.0 | critical | CVE-2018-14721 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to… |
| 1_335 | 10.0 | critical | GMS-2022-558 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-beans. |
| 1_364 | 10.0 | critical | GMS-2022-559 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework:spring-core. |
| 1_375 | 10.0 | critical | GMS-2022-560 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in org.springframework.boot:spring-boot-starter-web. |
| 1_44 | 9.8 | critical | CVE-2017-5929 | QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderC… |
| 2_47 | 9.8 | critical | CVE-2019-10202 | A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, … |
| 2_10 | 9.0 | critical | CVE-2021-30139 | pkg:pkg/alpine/apk-tools@2.12.3-r0 |
| 2_15 | 9.0 | critical | CVE-2021-36159 | pkg:pkg/alpine/apk-tools@2.12.3-r0 |
| 2_60 | 9.0 | critical | CVE-2022-28391 | CVE-2022-28391 affecting package busybox for versions less than 1.36.1-3. A patched version of the package is available. |
| 2_79 | 9.0 | critical | CVE-2021-3711 | In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this … |
| 3_31 | 9.8 | critical | CVE-2019-10202 | A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, … |
| 3_8 | 9.0 | critical | CVE-2021-30139 | pkg:pkg/alpine/apk-tools@2.12.3-r0 |
| 3_12 | 9.0 | critical | CVE-2021-36159 | pkg:pkg/alpine/apk-tools@2.12.3-r0 |
| 3_57 | 9.0 | critical | CVE-2022-28391 | CVE-2022-28391 affecting package busybox for versions less than 1.36.1-3. A patched version of the package is available. |
| 3_75 | 9.0 | critical | CVE-2021-3711 | In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this … |
| Severity rating | Count |
|---|---|
| Critical | 66 |
| High | 228 |
| Medium | 108 |
| Low | 9 |
| Finding Type | Count |
|---|---|
| Oss_vuln | 210 |
| Container | 201 |
Allow no reachable OSS vulnerability: FAIL
(46 matched vulnerabilities; configured threshold is 0).
First 5 findings:
| ID | CVSS | Rating | CVE | Title |
|---|---|---|---|---|
| 1_272 | 9.8 | critical | CVE-2018-8014 | The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insec… |
| 1_281 | 9.8 | critical | CVE-2020-1938 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as ha… |
| 1_284 | 9.8 | critical | CVE-2017-5651 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing.… |
| 1_271 | 9.1 | critical | CVE-2017-5648 | While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.R… |
| 1_301 | 8.6 | high | CVE-2022-25762 | If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apac… |
| Severity rating | Count |
|---|---|
| Critical | 4 |
| High | 25 |
| Medium | 16 |
| Low | 1 |
2 rules failed.
1 participant
Qwiet AI AutoFix
This PR was created automatically by the Qwiet AI AutoFix tool.
As long as it is open, subsequent scans and generated fixes to this same branch will be added to it as new commits.
Each commit fixes one vulnerability.
Some manual intervention might be required before merging this PR.
Project Information
Fixes
For finding 14: "Insecure Direct Object Reference: Attacker-controlled Data Used Directly to Find Database Entry in
AccountController.getAccountviaaccountId"For finding 2: "Remote Code Execution: Code Injection Through Attacker-controlled Data via
fooinSearchController.doGetSearch"