22 Rules
| ID | Name | Severity |
|---|---|---|
| 8240 | Avoid using unsecured cookie |
critical
|
| 1025000 | Avoid second order OS command injection |
critical
|
| 1025002 | Avoid second order XPath injection |
critical
|
| 1025004 | Avoid second order URL redirection to untrusted site |
critical
|
| 1025010 | Avoid second order LDAP injection |
critical
|
| 1025016 | Avoid using cookie without the HttpOnly flag |
critical
|
| 1025018 | Avoid cookie injection |
critical
|
| 1025020 | Avoid data filter injection |
critical
|
| 1025022 | Avoid data filter injection through API requests |
critical
|
| 1025024 | Avoid disabling the expiration time validation of a JWT token |
critical
|
| 1025026 | Avoid disabling the expiration time requirement of a JWT token |
critical
|
| 1025028 | Avoid disabling the signature requirement of a JWT token |
critical
|
| 1025030 | Avoid hard-coded JWT secret keys |
critical
|
| 1025032 | Avoid insecure parameters for PBKDF2 password encoder |
critical
|
| 1025034 | Avoid insecure parameters for BCrypt password encoder |
critical
|
| 1025036 | Avoid insecure parameters for Argon2 password encoder |
critical
|
| 1025038 | Avoid insecure parameters for SCrypt password encoder |
critical
|
| 1025040 | Avoid external control of system or configuration setting |
critical
|
| 1025042 | Avoid external control of system or configuration setting through API requests |
critical
|
| 1025044 | Avoid MVC injection |
critical
|
| 1025046 | Avoid MVC injection through AIP requests |
critical
|
| 1025048 | Avoid hard-coded password in connection string |
critical
|
