Semgrep Registry
@SemgrepRegistry
Every time a tweet goes out here, a Semgrep Rule gets its wings. Follow this account to find out about the latest rules released in the Semgrep Registry!
You might like
New JavaScript rule in the Registry: 🤖 express-third-party-object-deserialization (ift.tt/rL6pOyw) 📋 The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended…
New JavaScript rule in the Registry: 🤖 express-session-hardcoded-secret (ift.tt/Ux6mC7I) 📋 The "secret" attribute of the express-session third-party package is used to sign session IDs. The secret was found to be hard-coded, which can lead to session hijacking attac…
New JavaScript rule in the Registry: 🤖 express-res-sendfile (ift.tt/YUCihm8) 📋 The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perfo…
New JavaScript rule in the Registry: 🤖 express-open-redirect (ift.tt/LFSpf3D) 📋 The application redirects to a URL specified by user-supplied input ($QUERY) that is not validated. This could redirect users to malicious locations. Consider using an allow-list approac…
New JavaScript rule in the Registry: 🤖 express-libxml-vm-noent (ift.tt/Qk53W06) 📋 Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it.
New JavaScript rule in the Registry: 🤖 express-libxml-noent (ift.tt/0TQCXKr) 📋 The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to se…
New JavaScript rule in the Registry: 🤖 express-sequelize-injection (ift.tt/kWEROGH) 📋 Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent…
New JavaScript rule in the Registry: 🤖 express-third-party-object-deserialization (ift.tt/rL6pOyw) 📋 The following function call $SER.$FUNC accepts user controlled data which can result in Remote Code Execution (RCE) through Object Deserialization. It is recommended…
New JavaScript rule in the Registry: 🤖 express-session-hardcoded-secret (ift.tt/Ux6mC7I) 📋 The "secret" attribute of the express-session third-party package is used to sign session IDs. The secret was found to be hard-coded, which can lead to session hijacking attac…
New JavaScript rule in the Registry: 🤖 express-res-sendfile (ift.tt/YUCihm8) 📋 The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perfo…
New JavaScript rule in the Registry: 🤖 express-open-redirect (ift.tt/LFSpf3D) 📋 The application redirects to a URL specified by user-supplied input ($QUERY) that is not validated. This could redirect users to malicious locations. Consider using an allow-list approac…
New JavaScript rule in the Registry: 🤖 express-libxml-vm-noent (ift.tt/Qk53W06) 📋 Detected use of parseXml() function with the `noent` field set to `true`. This can lead to an XML External Entities (XXE) attack if untrusted data is passed into it.
New JavaScript rule in the Registry: 🤖 express-libxml-noent (ift.tt/0TQCXKr) 📋 The libxml library processes user-input with the `noent` attribute is set to `true` which can lead to being vulnerable to XML External Entities (XXE) type attacks. It is recommended to se…
New ruby rule in the Registry: 🤖 tainted-deserialization (ift.tt/5NS6DLd) 📋 Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code exe…
New java rule in the Registry: 🤖 tainted-url-host (ift.tt/tlX6O38) 📋 User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authori…
New java rule in the Registry: 🤖 tainted-system-command (ift.tt/NQzmeif) 📋 Detected user input entering a method which executes a system command. This could result in a command injection vulnerability, which allows an attacker to inject an arbitrary system command o…
New java rule in the Registry: 🤖 tainted-html-string (ift.tt/Kpv5qx3) 📋 Detected user input flowing into a manually constructed HTML string. You may be accidentally bypassing secure methods of rendering HTML by manually constructing HTML and this could create a cros…
New java rule in the Registry: 🤖 tainted-file-path (ift.tt/AitbVDy) 📋 Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controll…
New ruby rule in the Registry: 🤖 tainted-deserialization (ift.tt/5NS6DLd) 📋 Deserialization of a string tainted by `event` object found. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of `load` can cause remote code exe…
New java rule in the Registry: 🤖 tainted-url-host (ift.tt/tlX6O38) 📋 User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authori…
United States Trends
- 1. Veterans Day 304K posts
- 2. Luka 78.1K posts
- 3. Nico 131K posts
- 4. Mavs 30.4K posts
- 5. Gambit 34.5K posts
- 6. Sabonis 2,844 posts
- 7. Wike 87.4K posts
- 8. Kyrie 7,090 posts
- 9. Pat McAfee 3,122 posts
- 10. Vets 26.8K posts
- 11. Payne 9,544 posts
- 12. #csm220 8,015 posts
- 13. Tomas 20K posts
- 14. Wanda 24.2K posts
- 15. Dumont 24.6K posts
- 16. Bond 69.3K posts
- 17. Jay Rock 2,903 posts
- 18. #MarvelRivals 32.1K posts
- 19. Rogue 45.4K posts
- 20. #MFFL 2,435 posts
Something went wrong.
Something went wrong.