Browse / GitHub Security Lab

GitHub Security Lab

See its reports on the map

What gets reported to GitHub Security Lab

• Other weaknesses85
• Code Execution36
• Server-Side Request Forgery16
• Authentication14
• Cryptography13
• Access Control11

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Java (Maven): Actually fix the use of insecure protocol to download/upload artifacts
   $4,000283 votes
2. [Python] CWE-400: Regular Expression InjectionCode Injection
   $4,50072 votes
3. Initial websocket support for Javascript (SockJS)
   $1,80067 votes
4. Java: CWE-749 Unsafe resource loading in Android WebView leaking to injection attacksInformation Disclosure
   $2,30060 votes
5. [ruby]: ZipSlip/TarSlip vulnerability detection
   57 votes
6. Java/CWE-036: Calling openStream on URLs created from remote source can lead to file disclosureInformation Disclosure
   $1,80052 votes
7. CodeQL query for finding LDAP Injection (CWE-90) vulnerabilities in JavaCode Injection
   $3,00051 votes
8. [CPP]: Add query for CWE-805: Buffer Access with Incorrect Length Value using some functions
   $1,80043 votes
9. [Java] CWE-326: Query to detect weak encryption with an insufficient key size
   $4,50041 votes
10. [Java] CWE-555: Query to detect password in Java EE configuration filesImproper Authentication - Generic
    $1,80038 votes
11. [Python] CWE-090: LDAP Injection Code Injection
    $4,50033 votes
12. Java: Fix NashornScriptEngine detection in ScriptEngine query
    33 votes
13. Java (Maven): Use of insecure protocol to download/upload artifacts
    $2,30033 votes
14. [Java] CWE-079: Query to detect XSS with JavaServer Faces (JSF)Cross-site Scripting (XSS) - Generic
    $1,80031 votes
15. LDAP injection vulnerability in JavaCode Injection
    $2,50029 votes
16. Python : Add query to detect Server Side Template InjectionCode Injection
    29 votes
17. [porcupiney.hairs]: [Python] Add Flask Path injection sinksCode Injection
    28 votes
18. CodeQL query to detect JNDI injectionsCode Injection
    $2,30028 votes
19. Java: Unsafe deserialization with Jackson
    $4,50026 votes
20. Java: Static initialization vector
    $1,80023 votes
21. CPP: Out of order Linux permission dropping without checking return codesImproper Access Control - Generic
    23 votes
22. Java: Query for detecting JEXL injectionsCode Injection
    $4,50020 votes
23. Golang : Hardcoded secret used for signing JWTImproper Authentication - Generic
    19 votes
24. Java: CWE-939 - Address improper URL authorizationImproper Access Control - Generic
    $1,50019 votes
25. [Python] CWE-348: Client supplied ip used in security check
    18 votes
26. New experimental query: Clipboard-based XSSCross-site Scripting (XSS) - Generic
    16 votes
27. [Java] CWE-755: Query to detect Local Android DoS caused by NFEUncontrolled Resource Consumption
    $1,80016 votes
28. [javascript] CWE-020: CodeQL query to detect missing origin validation in cross-origin communication via postMessage
    16 votes
29. C++: Support Pqxx connector to search for sql injections to PostgresSQL Injection
    $4,50015 votes
30. Java: Query for detecting unsafe deserialization with Spring exporters
    $4,50015 votes
31. CPP: Out of order Linux permission dropping without checking return codesImproper Access Control - Generic
    15 votes
32. Netty HTTP Response Splitting (CRLF Injection) due to disabled header validationCRLF Injection
    $1,50014 votes
33. [Ruby]: Server Side Template InjectionCode Injection
    $2,30013 votes
34. Java : CWE-548 - J2EE server directory listing enabled
    $1,80013 votes
35. CodeQL query for SpEL injectionsCode Injection
    $2,30013 votes
36. [Java] JShell InjectionCode Injection
    12 votes
37. [Java] CWE-016: Query to detect insecure configuration of Spring Boot Actuator
    $50012 votes
38. Golang : Improvements to Golang SSRF queryServer-Side Request Forgery (SSRF)
    12 votes
39. [Java] CWE-939 - Address improper URL authorizationImproper Access Control - Generic
    $1,80012 votes
40. [Python]: Timing attack
    $1,80011 votes
41. Golang : Add Query To Detect PAM Authorization BugsImproper Access Control - Generic
    11 votes
42. Java: An experimental query for ignored hostname verification
    $1,80011 votes
43. Golang : Add Email Content Injection queryViolation of Secure Design Principles
    11 votes
44. gagliardetto: Query to detect incorrect conversion between numeric types
    11 votes
45. Java: CWE-532 sensitive info loggingImproper Authentication - Generic
    $50011 votes
46. [Java]: CWE-625 - Query to detect regex dot bypassImproper Access Control - Generic
    $1,00010 votes
47. [Java] CWE-094: Query to detect Groovy Code InjectionsCode Injection
    10 votes
48. Java: CWE-600 Uncaught servlet exception
    $1,80010 votes
49. Java: CWE-522 Insecure basic authenticationImproper Authentication - Generic
    $2,30010 votes
50. Java: CWE-798 - Hardcoded AWS credentials
    $1,00010 votes
51. CPP: Add query for CWE-243 Creation of chroot Jail Without Changing Working DirectoryUncontrolled Resource Consumption
    $1,0009 votes
52. Java: Regex injectionCode Injection
    $1,0009 votes
53. [Java] CWE-598: Use of GET Request Method with Sensitive Query StringsInformation Disclosure
    $1,8009 votes
54. [Java] CWE-312: Query to detect cleartext storage of sensitive information using Android SharedPreferencesInformation Disclosure
    $4,5009 votes
55. Java: CWE-297 Insecure JavaMail SSL configurationCryptographic Issues - Generic
    $1,8009 votes
56. CodeQL query to detect insecure MaxLengthRequest values in ASP.NET applications
    $1,0009 votes
57. PYTHON: CWE-079 - Add query for email injectionCode Injection
    $4,5008 votes
58. Python : Add query to detect PAM authorization bypass Improper Access Control - Generic
    8 votes
59. [Java]: Flow sources and steps for JMS and RabbitMQ
    $1,8008 votes
60. [Java] CWE-327: Add more broken crypto algorithmsCryptographic Issues - Generic
    $1,8008 votes
61. CodeQL query to detect Server-Side Template Injections (JavaScript)Code Injection
    8 votes
62. CodeQL query for unsafe TLS versionsCryptographic Issues - Generic
    $1,8008 votes
63. CodeQL query to detect open Spring Boot actuator endpoints
    $1,8008 votes
64. [Go]: Add Beego.Input.RequestBody source to Beego framework
    7 votes
65. [CPP]Add query to detect bugs like CVE-2017-5123
    $1,0007 votes
66. [CPP]: Add query for CWE-125 Out-of-bounds Read with different interpretation of the string when use mbtowc Memory Corruption - Generic
    $1,0007 votes
67. CPP: Pam Authorization BypassImproper Access Control - Generic
    7 votes
68. [cpp] CWE-787: query to detect unsigned integer to signed integer conversions used in pointer arithmetics
    $4,5007 votes
69. [Java] CWE-502: Unsafe deserialization with three JSON frameworks
    $1,8007 votes
70. [Java] CWE-1004: Query to check sensitive cookies without the HttpOnly flag set Misconfiguration
    $1,0007 votes
71. [Java] CWE-297: Insecure LDAP endpoint configuration
    $1,8007 votes
72. Java: Detect remote source from Android intent extra
    $1,8007 votes
73. Java: CWE-273 Unsafe certificate trustCryptographic Issues - Generic
    $1,8007 votes
74. [Python] Unsafe unpacking using shutil.unpack_archive() query and tests
    6 votes
75. [python]: Zip Slip Vulnerability
    $1,0006 votes
76. [Python]: Add Server-side Request Forgery sinksServer-Side Request Forgery (SSRF)
    6 votes
77. [GO]: [CWE-090: LDAP Injection All For One]Code Injection
    6 votes
78. [Java]: Add XXE sinksXML External Entities (XXE)
    6 votes
79. [Java]: CWE-665 Insecure environment during RMI/JMX Server initialisation - All for one bounty
    $1,8006 votes
80. [Java] CWE-918: Added URLClassLoader and WebClient SSRF sinksServer-Side Request Forgery (SSRF)
    6 votes
81. ihsinme:CPP Add query for CWE-415 Double FreeMemory Corruption - Generic
    $1,8006 votes
82. Python: Add support of clickhouse-driver package
    $1,8006 votes
83. [GO]: CWE-326: Insufficient key size
    $1,8006 votes
84. [Java] CWE-094: Rhino code injectionCode Injection
    $1,8006 votes
85. porcupiney.hairs : Java/Android - Insecure Loading of a Dex File
    6 votes
86. ihsinme: CPP add query for CWE-788 Access of memory location after the end of a buffer using strlen.
    $1,0006 votes
87. [codeql-go]: Add query to find use of constant state parameter in Oauth2 flowImproper Authentication - Generic
    6 votes
88. C/C++: Command injection via wordexpCode Injection
    $4,5005 votes
89. CPP: Add query for CWE-377 Insecure Temporary File
    $1,0005 votes
90. [Java]: Add JDBC connection SSRF sinksServer-Side Request Forgery (SSRF)
    5 votes
91. Python: CWE-338 insecureRandomness
    $1,8005 votes
92. CPP: Add query for CWE-266 Incorrect Privilege Assignment
    $1,8005 votes
93. ihsinme: CPP Add a query to find incorrectly used exceptions.
    $1,0005 votes
94. C# : Add query to detect Server Side Request ForgeryServer-Side Request Forgery (SSRF)
    5 votes
95. ihsinme: CPP Add query for CWE-783 Operator Precedence Logic Error When Use Bool TypeBusiness Logic Errors
    $1,8005 votes
96. [GO] CWE-1004: Sensitive cookie without HttpOnlyMisconfiguration
    $1,0005 votes
97. Java: JSONP InjectionCode Injection
    5 votes
98. ihsinme: CPP Add query for CWE-691 Insufficient Control Flow Management When Using Bit Operations
    $1,0005 votes
99. [Java] CWE-759: Query to detect password hash without a saltImproper Authentication - Generic
    $1,0005 votes
100. ihsinme: CPP Add query for CWE-570 detect and handle memory allocation errors.
     $1,8005 votes