Docs CLI Reference SAST Rules API Docs Sign In GitHub

Getting Started

Overview Homebrew Nix Scoop (Windows) Go Install Direct Download (curl) From Source

CLI Reference

Overview VDB Command Reference Reachability Analysis VDB Quick Start Scan Command Reference License Command Reference SCA Command Reference Shell Completions SAST Command Reference SCA Autofix Secrets Command Reference Containers Command Reference IaC Command Reference

CI / CD

Overview GitHub Actions GitLab CI Bitbucket Pipelines Azure DevOps GHA Command

Enterprise

Overview Corporate Proxy Publishing & Distribution Package Firewall

SAST Rules

Overview Custom rules Placeholder for CWE-114 Placeholder for CWE-122 Placeholder for CWE-315 Placeholder for CWE-337 Placeholder for CWE-339 Placeholder for CWE-363 Placeholder for CWE-91 Placeholder for CWE-93 VNX-1004 – CWE-1004 VNX-1007 – Insufficient Visual Distinction of Homoglyphs Presented to User VNX-1021 – Improper Restriction of Rendered UI Layers VNX-1022 – CWE-1022 VNX-1023 – CWE-1023 VNX-1024 – Comparison of Incompatible Types VNX-1025 – Improper Comparison of User-Supplied Input VNX-1027 – CWE-1027 VNX-1037 – Process Injection VNX-1039 – CWE-1039 VNX-1041 – SQL Injection via External Input VNX-1043 – Non-Thread-Safe Lock VNX-1044 – File Upload without Size Limit VNX-1045 – File Upload without Type Restriction VNX-1046 – Open Redirect to Untrusted Site VNX-1047 – SSRF without Timeout VNX-1048 – Sensitive Data in Referrer VNX-1049 – Excessive Data Query Operations in a Large Data Table VNX-1050 – Excessive Platform Resource Consumption within a Loop VNX-1051 – Initialization with Hard-Coded Network Resource Configuration Data VNX-1052 – Excessive Resource Usage VNX-1053 – Missing Documentation for Design VNX-1054 – GUI Input without Validation VNX-1055 – Multiple Inheritance from Concrete Classes VNX-1056 – Invokable Control Element with Variadic Parameters VNX-1057 – Data Access Operations Outside of Expected Data Manager Component VNX-1058 – Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element VNX-1060 – Excessive Number of Inefficient Server-Side Data Accesses VNX-1062 – Parent Class with References to Child Class VNX-1063 – Creation of Class Instance within a Static Code Block VNX-1064 – Invokable Control Element with Signature Containing an Excessive Number of Parameters VNX-1065 – Runtime Resource Management Control Element in a Component Built to Run on Application Servers VNX-1066 – Missing Serialization Control Element VNX-1067 – Excessive Execution of Sequential Searches of Data Resource VNX-1068 – Inconsistency Between Implementation and Documented Design VNX-1069 – CWE-1069 VNX-1070 – Serializable Data Element Containing non-Serializable Item Elements VNX-1071 – Empty Code Block VNX-1072 – Data Resource Access without Use of Connection Pooling VNX-1073 – Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses VNX-1074 – Class with Excessively Deep Inheritance VNX-1075 – Unconditional Control Flow Transfer outside of Switch Block VNX-1079 – Parent Class without Virtual Destructor Method VNX-1080 – Source Code File with Excessive Number of Lines of Code VNX-1082 – Class Instance Self Destruction Control Element VNX-1083 – Data Access from Outside Expected Data Manager Component VNX-1084 – Invokable Control Element with Excessive File or Data Access Operations VNX-1085 – Invokable Control Element with Excessive Volume of Commented-out Code VNX-1086 – Class with Excessive Number of Child Classes VNX-1087 – Class with Virtual Method without a Virtual Destructor VNX-1089 – Large Data Table with Excessive Number of Indices VNX-1090 – Method Containing Access of a Member Element from Another Class VNX-1092 – Use of Same Invokable Control Element in Multiple Architectural Layers VNX-1094 – Excessive Index Range Scan for a Data Resource VNX-1095 – Loop Condition Value Update within the Loop VNX-1097 – Persistent Storable Data Element without Associated Comparison Control Element VNX-1098 – Data Element containing Pointer Item without Proper Copy Control Element VNX-1099 – Inconsistent Naming Conventions for Identifiers VNX-1100 – Insufficient Isolation of System-Dependent Functions VNX-1101 – Reliance on Runtime Component in Generated Code VNX-1102 – Reliance on Machine-Dependent Data Representation VNX-1103 – Use of Platform-Dependent Third Party Components VNX-1104 – Use of Unmaintained Third Party Components VNX-1105 – Insufficient Encapsulation of Machine-Dependent Functionality VNX-1106 – Insufficient Use of Symbolic Constants VNX-1107 – Insufficient Isolation of Symbolic Constant Definitions VNX-1108 – Excessive Reliance on Global Variables VNX-1109 – Use of Same Variable for Multiple Purposes VNX-1110 – Incomplete Design Documentation VNX-1111 – Incomplete I/O Documentation VNX-1112 – Incomplete Documentation of Program Execution VNX-1113 – Inappropriate Comment Style VNX-1114 – Inappropriate Whitespace Style VNX-1115 – Source Code Element without Standard Prologue VNX-1116 – Inaccurate Source Code Comments VNX-1117 – Callable with Insufficient Behavioral Summary VNX-1118 – Insufficient Documentation of Error Handling Techniques VNX-1119 – Excessive Use of Unconditional Branching VNX-112 – Missing XML Validation VNX-1121 – Excessive McCabe Cyclomatic Complexity VNX-1122 – Excessive Halstead Complexity VNX-1123 – Excessive Use of Self-Modifying Code VNX-1124 – Excessively Deep Nesting VNX-1125 – Excessive Attack Surface VNX-1126 – Declaration of Variable with Unnecessarily Wide Scope VNX-1127 – Compilation with Insufficient Warnings or Errors VNX-115 – Misinterpretation of Input VNX-117 – Improper Output Neutralization for Logs VNX-1173 – Improper Use of Validation Framework VNX-1188 – Initialization of a Resource with an Insecure Default VNX-1204 – Generation of Weak Initialization Vector (IV) VNX-1230 – Exposure of Sensitive Information Through Metadata VNX-1235 – Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations VNX-1236 – Improper Neutralization of Formula Elements in a CSV File VNX-124 – Buffer Underwrite ('Buffer Underflow') VNX-1240 – Use of a Cryptographic Primitive with a Risky Implementation VNX-1241 – Use of Predictable Algorithm in Random Number Generator VNX-125 – Out-of-bounds Read VNX-1254 – CWE-1254 VNX-1265 – Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls VNX-1269 – CWE-1269 VNX-1275 – CWE-1275 VNX-128 – Wrap-around Error VNX-1284 – Improper Validation of Specified Quantity in Input VNX-1285 – Improper Validation of Specified Index, Position, or Offset in Input VNX-1286 – Improper Validation of Syntactic Correctness of Input VNX-1287 – Improper Validation of Specified Type of Input VNX-1288 – Improper Validation of Consistency within Input VNX-1289 – Improper Validation of Unsafe Equivalence in Input VNX-1290 – CWE-1290 VNX-130 – Improper Handling of Length Parameter Inconsistency VNX-1304 – CWE-1304 VNX-1320 – CWE-1320 VNX-1321 – CWE-1321 VNX-1322 – Use of Blocking Code in Single-threaded, Non-blocking Context VNX-1324 – DEPRECATED: Sensitive Information Accessible by Physical Probing of JTAG Interface VNX-1325 – Improperly Controlled Sequential Memory Allocation VNX-1327 – Binding to an Unrestricted IP Address VNX-1335 – Incorrect Bitwise Shift of Integer VNX-1336 – CWE-1336 VNX-1339 – Insufficient Precision or Accuracy of a Real Number VNX-1341 – Multiple Releases of Same Resource or Handle VNX-135 – Incorrect Calculation of Multi-Byte String Length VNX-1389 – Incorrect Parsing of Numbers with Different Radices VNX-1390 – CWE-1390 VNX-1391 – CWE-1391 VNX-1392 – Use of Default Credentials VNX-1393 – CWE-1393 VNX-1395 – CWE-1395 VNX-140 – Improper Neutralization of Delimiters VNX-1427 – Improper Neutralization of Input Used in an Assertion VNX-15 – External Control of System or Configuration Setting VNX-166 – Improper Handling of Missing Special Element VNX-167 – Improper Handling of Additional Special Element VNX-168 – Improper Handling of Inconsistent Special Elements VNX-170 – Improper Null Termination VNX-178 – Improper Handling of Case Sensitivity VNX-179 – Incorrect Behavior Order: Early Validation VNX-182 – Collapse of Data into Unsafe Value VNX-183 – Permissive List of Allowed Inputs VNX-184 – Incomplete List of Disallowed Inputs VNX-186 – Overly Restrictive Regular Expression VNX-191 – Integer Underflow (Wrap or Wraparound) VNX-192 – Integer Coercion Error VNX-193 – Off-by-one Error VNX-194 – Unexpected Sign Extension VNX-20 – CWE-20 VNX-201 – Insertion of Sensitive Information Into Sent Data VNX-204 – Observable Response Discrepancy VNX-205 – Observable Behavioral Discrepancy VNX-209 – Generation of Error Message Containing Sensitive Information VNX-210 – CWE-210 VNX-212 – Improper Removal of Sensitive Information Before Storage or Transfer VNX-213 – Exposure of Sensitive Information Due to Incompatible Policies VNX-214 – Invocation of Process Using Visible Sensitive Information VNX-215 – Insertion of Sensitive Information Into Debugging Code VNX-222 – Truncation of Security-relevant Information VNX-223 – Omission of Security-relevant Information VNX-224 – Obscured Security-relevant Information by Alternate Name VNX-227 – Improper Fulfillment of API Contract VNX-229 – Improper Handling of Values VNX-233 – Improper Handling of Parameters VNX-237 – Improper Handling of Structural Elements VNX-241 – Improper Handling of Unexpected Data Type VNX-242 – Use of Inherently Dangerous Function VNX-243 – Creation of chroot Jail Without Changing Working Directory VNX-244 – Improper Clearing of Heap Memory Before Release VNX-248 – Uncaught Exception VNX-252 – Unchecked Return Value VNX-253 – Incorrect Check of Function Return Value VNX-256 – Plaintext Storage of a Password VNX-257 – Storing Passwords in a Recoverable Format VNX-259 – CWE-259 VNX-260 – Password in Configuration File VNX-261 – Weak Encoding for Password VNX-262 – Not Using Password Aging VNX-263 – Password Aging with Long Expiration VNX-266 – Incorrect Privilege Assignment VNX-267 – Privilege Defined With Unsafe Actions VNX-268 – Privilege Chaining VNX-269 – CWE-269 VNX-270 – Privilege Context Switching Error VNX-272 – Least Privilege Violation VNX-273 – Improper Check for Dropped Privileges VNX-274 – Improper Handling of Insufficient Privileges VNX-276 – Incorrect Default Permissions VNX-277 – Insecure Inherited Permissions VNX-278 – Insecure Preserved Inherited Permissions VNX-279 – Incorrect Execution-Assigned Permissions VNX-280 – Improper Handling of Insufficient Permissions or Privileges VNX-281 – Improper Preservation of Permissions VNX-283 – Unverified Ownership VNX-287 – CWE-287 VNX-289 – Authentication Bypass by Alternate Name VNX-290 – Authentication Bypass by Spoofing VNX-294 – Authentication Bypass by Capture-replay VNX-301 – Reflection Attack in an Authentication Protocol VNX-303 – Incorrect Implementation of Authentication Algorithm VNX-305 – Authentication Bypass by Primary Weakness VNX-306 – Missing Authentication for Critical Function VNX-308 – Use of Single-factor Authentication VNX-309 – Use of Password System for Primary Authentication VNX-319 – Cleartext Transmission of Sensitive Information VNX-321 – CWE-321 VNX-323 – Reusing a Nonce, Key Pair in Encryption VNX-324 – Use of a Key Past its Expiration Date VNX-325 – Missing Cryptographic Step VNX-326 – CWE-326 VNX-327 – CWE-327 VNX-329 – CWE-329 VNX-331 – Insufficient Entropy VNX-334 – Small Space of Random Values VNX-335 – Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) VNX-336 – CWE-336 VNX-338 – Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) VNX-340 – CWE-340 VNX-341 – Predictable from Observable State VNX-342 – Predictable Exact Value from Previous Values VNX-343 – Predictable Value Range from Previous Values VNX-344 – Use of Invariant Value in Dynamically Changing Context VNX-345 – CWE-345 VNX-346 – Origin Validation Error VNX-347 – Improper Verification of Cryptographic Signature VNX-348 – Use of Less Trusted Source VNX-349 – Acceptance of Extraneous Untrusted Data With Trusted Data VNX-350 – CWE-350 VNX-351 – Insufficient Type Distinction VNX-352 – CWE-352 VNX-353 – Missing Support for Integrity Check VNX-354 – Improper Validation of Integrity Check Value VNX-356 – Product UI does not Warn User of Unsafe Actions VNX-357 – Insufficient UI Warning of Dangerous Operations VNX-358 – Improperly Implemented Security Check for Standard VNX-359 – Exposure of Private Personal Information to an Unauthorized Actor VNX-360 – Trust of System Event Data VNX-362 – CWE-362 VNX-364 – Signal Handler Race Condition VNX-366 – Race Condition within a Thread VNX-367 – Time-of-check Time-of-use (TOCTOU) Race Condition VNX-368 – Context Switching Race Condition VNX-369 – Divide By Zero VNX-372 – Incomplete Internal State Distinction VNX-374 – Passing Mutable Objects to an Untrusted Method VNX-375 – Returning a Mutable Object to an Untrusted Caller VNX-378 – Creation of Temporary File With Insecure Permissions VNX-379 – Creation of Temporary File in Directory with Insecure Permissions VNX-384 – CWE-384 VNX-385 – Covert Timing Channel VNX-386 – Symbolic Name not Mapping to Correct Object VNX-390 – Detection of Error Condition Without Action VNX-391 – Unchecked Error Condition VNX-392 – Missing Report of Error Condition VNX-393 – Return of Wrong Status Code VNX-394 – Unexpected Status Code or Return Value VNX-395 – Use of NullPointerException Catch to Detect NULL Pointer Dereference VNX-396 – Declaration of Catch for Generic Exception VNX-397 – Declaration of Throws for Generic Exception VNX-400 – CWE-400 VNX-401 – CWE-401 VNX-403 – Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak') VNX-404 – CWE-404 VNX-408 – Incorrect Behavior Order: Early Amplification VNX-409 – Improper Handling of Highly Compressed Data (Data Amplification) VNX-41 – Improper Resolution of Path Equivalence VNX-410 – Insufficient Resource Pool VNX-412 – Unrestricted Externally Accessible Lock VNX-413 – Improper Resource Locking VNX-414 – Missing Lock Check VNX-415 – CWE-415 VNX-416 – CWE-416 VNX-419 – Unprotected Primary Channel VNX-420 – Unprotected Alternate Channel VNX-421 – Race Condition During Access to Alternate Channel VNX-425 – Direct Request ('Forced Browsing') VNX-426 – Untrusted Search Path VNX-427 – Uncontrolled Search Path Element VNX-428 – Unquoted Search Path or Element VNX-430 – Deployment of Wrong Handler VNX-431 – Missing Handler VNX-432 – CWE-432 VNX-437 – Incomplete Model of Endpoint Features VNX-439 – Behavioral Change in New Version or Environment VNX-440 – Expected Behavior Violation VNX-441 – CWE-441 VNX-444 – Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') VNX-447 – Unimplemented or Unsupported Feature in UI VNX-448 – Obsolete Feature in UI VNX-449 – The UI Performs the Wrong Action VNX-450 – CWE-450 VNX-451 – CWE-451 VNX-453 – CWE-453 VNX-454 – External Initialization of Trusted Variables or Data Stores VNX-455 – Non-exit on Failed Initialization VNX-457 – CWE-457 VNX-459 – Incomplete Cleanup VNX-460 – CWE-460 VNX-462 – CWE-462 VNX-463 – Deletion of Data Structure Sentinel VNX-464 – Addition of Data Structure Sentinel VNX-466 – Return of Pointer Value Outside of Expected Range VNX-468 – Incorrect Pointer Scaling VNX-469 – Use of Pointer Subtraction to Determine Size VNX-470 – Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') VNX-471 – CWE-471 VNX-472 – External Control of Assumed-Immutable Web Parameter VNX-474 – Use of Function with Inconsistent Implementations VNX-475 – Undefined Behavior for Input to API VNX-476 – NULL Pointer Dereference VNX-477 – Use of Obsolete Function VNX-478 – Missing Default Case in Multiple Condition Expression VNX-479 – CWE-479 VNX-480 – Use of Incorrect Operator VNX-481 – CWE-481 VNX-482 – CWE-482 VNX-483 – Incorrect Block Delimitation VNX-484 – Omitted Break Statement in Switch VNX-486 – CWE-486 VNX-487 – Reliance on Package-level Scope VNX-488 – Exposure of Data Element to Wrong Session VNX-491 – CWE-491 VNX-492 – CWE-492 VNX-493 – CWE-493 VNX-495 – CWE-495 VNX-497 – Exposure of Sensitive System Information to an Unauthorized Control Sphere VNX-498 – CWE-498 VNX-499 – CWE-499 VNX-500 – CWE-500 VNX-501 – Trust Boundary Violation VNX-506 – CWE-506 VNX-511 – CWE-511 VNX-514 – CWE-514 VNX-515 – Covert Storage Channel VNX-521 – Weak Password Requirements VNX-522 – CWE-522 VNX-523 – Unprotected Transport of Credentials VNX-524 – Use of Cache Containing Sensitive Information VNX-525 – CWE-525 VNX-532 – CWE-532 VNX-536 – Servlet Runtime Error Message Containing Sensitive Information VNX-538 – Insertion of Sensitive Information into Externally-Accessible File or Directory VNX-539 – CWE-539 VNX-540 – CWE-540 VNX-544 – Missing Standardized Error Handling Mechanism VNX-546 – CWE-546 VNX-547 – Use of Hard-coded, Security-relevant Constants VNX-548 – CWE-548 VNX-549 – Missing Password Field Masking VNX-551 – Incorrect Behavior Order: Authorization Before Parsing and Canonicalization VNX-553 – CWE-553 VNX-554 – CWE-554 VNX-555 – CWE-555 VNX-561 – Dead Code VNX-562 – Return of Stack Variable Address VNX-563 – Assignment to Variable without Use VNX-565 – Reliance on Cookies without Validation and Integrity Checking VNX-566 – CWE-566 VNX-570 – Expression is Always False VNX-571 – Expression is Always True VNX-572 – CWE-572 VNX-573 – CWE-573 VNX-578 – CWE-578 VNX-580 – clone() Method Without super.clone() VNX-581 – Object Model Violation: Just One of Equals and Hashcode Defined VNX-582 – CWE-582 VNX-583 – CWE-583 VNX-584 – Return Inside Finally Block VNX-585 – CWE-585 VNX-586 – Explicit Call to Finalize() VNX-587 – Assignment of a Fixed Address to a Pointer VNX-588 – CWE-588 VNX-589 – CWE-589 VNX-59 – Improper Link Resolution Before File Access ('Link Following') VNX-591 – CWE-591 VNX-594 – CWE-594 VNX-595 – CWE-595 VNX-597 – CWE-597 VNX-598 – CWE-598 VNX-600 – CWE-600 VNX-602 – CWE-602 VNX-603 – Use of Client-Side Authentication VNX-605 – Multiple Binds to the Same Port VNX-606 – Unchecked Input for Loop Condition VNX-607 – CWE-607 VNX-609 – Double-Checked Locking VNX-610 – CWE-610 VNX-614 – CWE-614 VNX-615 – CWE-615 VNX-617 – Reachable Assertion VNX-618 – Exposed Unsafe ActiveX Method VNX-619 – Dangling Database Cursor ('Cursor Injection') VNX-620 – Unverified Password Change VNX-621 – CWE-621 VNX-622 – CWE-622 VNX-624 – Executable Regular Expression Error VNX-625 – Permissive Regular Expression VNX-626 – Null Byte Interaction Error (Null Byte Injection) VNX-627 – CWE-627 VNX-628 – Function Call with Incorrectly Specified Arguments VNX-635 – Weaknesses in OWASP Top Ten (Security TODO/FIXME) VNX-636 – CWE-636 VNX-638 – CWE-638 VNX-639 – Authorization Bypass Through User-Controlled Key VNX-640 – Weak Password Recovery Mechanism for Forgotten Password VNX-641 – Improper Restriction of Names for Files and Other Resources VNX-642 – CWE-642 VNX-643 – CWE-643 VNX-644 – CWE-644 VNX-645 – Overly Restrictive Account Lockout Mechanism VNX-646 – CWE-646 VNX-647 – CWE-647 VNX-648 – Incorrect Use of Privileged APIs VNX-649 – Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking VNX-651 – CWE-651 VNX-652 – CWE-652 VNX-653 – Improper Isolation or Compartmentalization VNX-654 – Reliance on a Single Factor in a Security Decision VNX-656 – Reliance on Security Through Obscurity VNX-657 – CWE-657 VNX-66 – Improper Handling of File Names that Identify Virtual Resources VNX-663 – Use of a Non-reentrant Function in a Concurrent Context VNX-665 – CWE-665 VNX-666 – CWE-666 VNX-667 – CWE-667 VNX-671 – CWE-671 VNX-672 – CWE-672 VNX-673 – CWE-673 VNX-674 – CWE-674 VNX-675 – CWE-675 VNX-676 – Use of Potentially Dangerous Function VNX-680 – CWE-680 VNX-681 – Incorrect Conversion between Numeric Types VNX-682 – CWE-682 VNX-683 – CWE-683 VNX-685 – CWE-685 VNX-686 – CWE-686 VNX-687 – CWE-687 VNX-688 – CWE-688 VNX-690 – CWE-690 VNX-694 – Use of Multiple Resources with Duplicate Identifier VNX-695 – Use of Low-Level Functionality VNX-697 – CWE-697 VNX-698 – Execution After Redirect (EAR) VNX-703 – CWE-703 VNX-704 – CWE-704 VNX-706 – CWE-706 VNX-708 – Incorrect Ownership Assignment VNX-710 – CWE-710 VNX-73 – External Control of File Name or Path VNX-732 – CWE-732 VNX-733 – Compiler Optimization Removal or Modification of Security-critical Code VNX-749 – Exposed Dangerous Method or Function VNX-754 – CWE-754 VNX-755 – CWE-755 VNX-756 – Missing Custom Error Page VNX-757 – CWE-757 VNX-759 – CWE-759 VNX-76 – Improper Neutralization of Equivalent Special Elements VNX-760 – CWE-760 VNX-761 – CWE-761 VNX-762 – CWE-762 VNX-763 – Release of Invalid Pointer or Reference VNX-764 – Multiple Locks of a Critical Resource VNX-765 – Multiple Unlocks of a Critical Resource VNX-766 – Critical Data Element Declared Public VNX-767 – Access to Critical Private Variable via Public Method VNX-768 – CWE-768 VNX-769 – CWE-769 VNX-770 – Allocation of Resources Without Limits or Throttling VNX-771 – Missing Reference to Active Allocated Resource VNX-772 – Missing Release of Resource after Effective Lifetime VNX-775 – CWE-775 VNX-776 – Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') VNX-777 – Regular Expression without Anchors VNX-778 – Insufficient Logging VNX-779 – Logging of Excessive Data VNX-780 – CWE-780 VNX-781 – Improper Address Validation in IOCTL VNX-783 – Operator Precedence Logic Error VNX-784 – CWE-784 VNX-785 – CWE-785 VNX-786 – Access of Memory Location Before Start of Buffer VNX-788 – Access of Memory Location After End of Buffer VNX-789 – CWE-789 VNX-791 – Incomplete Filtering of Special Elements VNX-792 – CWE-792 VNX-793 – CWE-793 VNX-796 – CWE-796 VNX-799 – CWE-799 VNX-804 – Guessable CAPTCHA VNX-805 – Buffer Access with Incorrect Length Value VNX-806 – CWE-806 VNX-807 – Reliance on Untrusted Inputs in a Security Decision VNX-820 – Missing Synchronization VNX-821 – Incorrect Synchronization VNX-822 – Untrusted Pointer Dereference VNX-823 – Use of Out-of-range Pointer Offset VNX-824 – Access of Uninitialized Pointer VNX-825 – Expired Pointer Dereference VNX-826 – Premature Release of Resource During Expected Lifetime VNX-827 – CWE-827 VNX-828 – Signal Handler with Functionality that is not Asynchronous-Signal-Safe VNX-831 – Signal Handler for Multiple Signals VNX-832 – Unlock of a Resource that is not Locked VNX-833 – Deadlock VNX-835 – Loop with Unreachable Exit Condition ('Infinite Loop') VNX-836 – Use of Password Hash Instead of Password for Authentication VNX-837 – Improper Enforcement of a Single, Unique Action VNX-838 – Inappropriate Encoding for Output Context VNX-839 – Numeric Range Comparison Without Minimum Check VNX-840 – CWE-840 VNX-841 – Improper Enforcement of Behavioral Workflow VNX-842 – Placement of User into Incorrect Group VNX-843 – Access of Resource Using Incompatible Type ('Type Confusion') VNX-862 – CWE-862 VNX-863 – CWE-863 VNX-908 – Use of Uninitialized Resource VNX-909 – Missing Initialization of Resource VNX-910 – Use of Expired File Descriptor VNX-911 – Improper Update of Reference Count VNX-912 – Hidden Functionality (Backdoor) VNX-913 – CWE-913 VNX-914 – Improper Control of Dynamically-Identified Variables VNX-915 – Improperly Controlled Modification of Dynamically-Determined Object Attributes VNX-918 – Server-Side Request Forgery (SSRF) VNX-920 – Improper Restriction of Power Consumption VNX-924 – Improper Enforcement of Message Integrity During Transmission in a Communication Channel VNX-925 – CWE-925 VNX-926 – CWE-926 VNX-927 – CWE-927 VNX-928 – CWE-928 VNX-929 – CWE-929 VNX-930 – CWE-930 VNX-931 – CWE-931 VNX-932 – CWE-932 VNX-933 – CWE-933 VNX-935 – CWE-935 VNX-936 – CWE-936 VNX-937 – CWE-937 VNX-938 – CWE-938 VNX-939 – Improper Authorization in Handler for Custom URL Scheme VNX-94 – Code Injection VNX-940 – Improper Verification of Source of a Communication Channel VNX-941 – Incorrectly Specified Destination in a Communication Channel VNX-942 – CWE-942 VNX-943 – CWE-943 VNX-95 – Template Injection (Eval Injection) VNX-98 – PHP Remote File Inclusion VNX-ANDROID-001 – Android Insecure Manifest Configuration VNX-ANDROID-002 – Android WebView JavaScript Enabled VNX-ANDROID-003 – Android Exported Component Without Permission Check VNX-ANDROID-004 – Android SharedPreferences Used for Sensitive Data Storage VNX-ANDROID-005 – Android Network Security Config Allows Plaintext HTTP Traffic VNX-ANDROID-006 – Android Hardcoded API Key in strings.xml VNX-ANDROID-007 – Android Weak Cryptography Using AES in ECB Mode VNX-BASH-001 – eval with Potentially User-Controlled Input VNX-BASH-002 – curl or wget Output Piped Directly to Shell Interpreter VNX-BASH-003 – Missing set -euo pipefail in Bash Script VNX-BASH-004 – Unquoted Variable Used in Command or Test VNX-BASH-005 – Hardcoded Secret or Password in Shell Script VNX-BASH-006 – Global IFS Reassignment in Shell Script VNX-BASH-007 – Unquoted Command Substitution in Shell Script VNX-C-001 – Use of Unbounded String Copy Function (strcpy/strcat/gets) VNX-C-002 – Format String Injection via Non-Literal Format Argument VNX-C-003 – OS Command Injection via system() or popen() with Non-Literal Argument VNX-C-004 – Use-After-Free: Pointer Used After free() VNX-C-005 – Integer Overflow in malloc/calloc Size Arithmetic VNX-C-006 – Use of alloca() for Dynamic Stack Allocation VNX-CRYPTO-001 – MD5 Usage Detected VNX-CRYPTO-002 – SHA-1 Usage Detected VNX-CRYPTO-003 – AES in ECB Mode VNX-CRYPTO-004 – Broken or Obsolete Cipher VNX-CRYPTO-005 – TLS Certificate Validation Disabled VNX-CRYPTO-006 – Weak RSA Key Size VNX-CRYPTO-007 – Weak Password Hashing (Insufficient Iterations or Missing KDF) VNX-CRYPTO-008 – Timing Attack via Direct Comparison of Secrets VNX-CRYPTO-009 – Use of Cryptographically Weak PRNG (rand/srand/random in C/C++) VNX-CRYPTO-010 – Hardcoded IV, Nonce, or Salt in Cryptographic Operation VNX-CS-001 – C# SQL Injection via String Concatenation in SqlCommand VNX-CS-002 – C# Command Injection via Process.Start with User Input VNX-CS-003 – C# XXE via XmlDocument with XmlResolver Enabled VNX-CS-004 – C# Insecure Deserialization via BinaryFormatter or SoapFormatter VNX-CS-005 – C# Missing ValidateAntiForgeryToken on State-Changing MVC Actions VNX-CS-006 – C# Insecure Random Number Generator (System.Random for Security) VNX-CS-007 – C# Path Traversal via Path.Combine with User Input VNX-CS-008 – C# SSRF via WebClient or HttpClient with User-Supplied URL VNX-CS-009 – C# Use of Weak Cryptographic Algorithm (MD5, SHA1, DES, RC2, 3DES) VNX-CS-010 – C# Hardcoded Connection String with Credentials VNX-DOCKER-001 – Dockerfile Missing USER Directive VNX-DOCKER-002 – Dockerfile FROM :latest Tag VNX-DOCKER-003 – Secret in Dockerfile ARG or ENV VNX-DOCKER-004 – Dockerfile ADD with Remote URL VNX-DOCKER-005 – Dockerfile Privileged Container Flag VNX-DOCKER-006 – Dockerfile Uses ADD Instead of COPY for Local Files VNX-DOCKER-007 – Dockerfile Missing HEALTHCHECK Instruction VNX-DOCKER-008 – Dockerfile Package Manager Install Without Version Pinning VNX-GO-001 – Missing go.sum VNX-GO-002 – Command Injection via exec.Command VNX-GO-003 – SQL Injection via fmt.Sprintf VNX-GO-004 – TLS InsecureSkipVerify Enabled VNX-GO-005 – Go Open Redirect VNX-GO-006 – Go Server-Side Request Forgery VNX-GO-007 – Go Path Traversal VNX-GO-008 – Go Weak PRNG for Security VNX-GO-009 – Go text/template Used for HTML VNX-GO-010 – Go Weak Cipher Usage VNX-GO-011 – Go gob Deserialization from HTTP Request Body VNX-GO-012 – Go HTTP Response Header Injection (CRLF) VNX-GO-013 – Go Zip/Tar Slip via Archive Entry Name VNX-GO-014 – sync.Mutex Lock() Without Deferred Unlock() VNX-GO-015 – sync.WaitGroup.Add() Called Inside Goroutine VNX-GO-016 – Integer Downcast After strconv.Atoi/ParseInt/ParseUint VNX-GO-017 – Go SQL Injection via fmt.Sprintf in Database Call VNX-GO-018 – Go Arbitrary File Write via User-Controlled Path VNX-GO-019 – Go Server Binding to All Interfaces (0.0.0.0) VNX-GO-020 – Use of template.HTML with potential user input VNX-GO-021 – Potential XSS via fmt.Fprintf with HTML tags VNX-GO-022 – Use of eval() or dynamic code execution VNX-GO-023 – SQL injection via string concatenation VNX-GO-024 – Missing input validation on HTTP request parameters VNX-GO-025 – Potential open redirect via HTTP redirect VNX-GO-026 – Missing file type validation on upload VNX-GO-027 – Potential path traversal via file path construction VNX-GO-028 – Use of weak cryptographic hash for password hashing VNX-GO-029 – Hardcoded weak or default password VNX-GO-030 – Missing Secure flag on cookie VNX-GO-031 – Missing signature validation on JWT VNX-GO-032 – JWT missing expiration validation VNX-GO-033 – JWT missing audience validation VNX-GO-034 – OAuth redirect URI without validation against allowlist VNX-GO-035 – Missing HttpOnly flag on cookie VNX-GO-036 – Use of ECB block mode VNX-GO-037 – Missing security headers in HTTP response VNX-GO-038 – Potential mass assignment via struct binding VNX-GO-039 – Missing rate limiting on login endpoint VNX-GO-040 – Logging of sensitive data VNX-GO-041 – Use of deprecated TLS version VNX-GQL-001 – GraphQL Introspection Enabled in Production VNX-GQL-002 – GraphQL Query Batching or No Depth Limit (DoS) VNX-GQL-003 – GraphQL Query String Injection via String Concatenation VNX-GQL-004 – GraphQL Field Suggestion Disclosure Enabled VNX-HTML-001 – Use of Jinja2 |safe filter VNX-JAVA-001 – Command Injection via Runtime.exec() VNX-JAVA-002 – Spring Actuator Endpoints Exposed VNX-JAVA-003 – SQL Injection via String Concatenation VNX-JAVA-004 – XML External Entity (XXE) Injection VNX-JAVA-005 – Insecure Deserialization VNX-JAVA-006 – Insecure TLS Trust Manager VNX-JAVA-007 – Java Open Redirect VNX-JAVA-008 – Java Server-Side Request Forgery (SSRF) VNX-JAVA-009 – Java Path Traversal VNX-JAVA-010 – Spring CSRF Protection Disabled VNX-JAVA-011 – Java Expression Language Injection VNX-JAVA-012 – Java LDAP Injection VNX-JAVA-013 – Java XPath Injection VNX-JAVA-014 – Java Zip Slip via ZipEntry getName() VNX-JAVA-015 – Java JPQL/HQL Injection via String Concatenation VNX-JAVA-016 – Java Weak PRNG (java.util.Random) Used for Security-Sensitive Value VNX-JAVA-017 – Java HTTP Response Splitting via Unsanitised Header Value VNX-JAVA-018 – Java RSA cipher without OAEP padding VNX-JAVA-019 – Java hardcoded cryptographic key literal VNX-JAVA-020 – Java static IV reuse in block cipher VNX-JAVA-021 – Java Sensitive Data Logged VNX-JAVA-022 – Java Insecure Temporary File Creation VNX-JAVA-023 – Java Unrestricted File Upload VNX-JAVA-024 – Java XML Entity Expansion (Billion Laughs) VNX-JAVA-025 – Java Hardcoded Password or Credential VNX-JAVA-026 – Java Spring File Serving Without Access Control VNX-JAVA-027 – Java Spring Security Headers Disabled VNX-JAVA-028 – SQL injection via string concatenation in Java VNX-JAVA-029 – XML External Entity (XXE) via DocumentBuilderFactory VNX-JWT-001 – JWT Signature Verification Disabled VNX-JWT-002 – JWT Token Signed Without Expiration VNX-JWT-003 – JWT Signing with Hardcoded Secret VNX-JWT-004 – JWT Algorithm Explicitly Set to 'none' VNX-JWT-005 – Sensitive Credential Data Stored in JWT Payload VNX-JWT-006 – JWT Missing Audience or Issuer Verification VNX-KOTLIN-001 – Kotlin ECB Cipher Mode VNX-KOTLIN-002 – Kotlin RSA Key Smaller Than 2048 Bits VNX-KOTLIN-003 – Kotlin Cookie Missing HttpOnly Flag VNX-KOTLIN-004 – Kotlin Unencrypted Plain Socket VNX-KOTLIN-005 – Kotlin MD5 or SHA-1 Used as Cryptographic Hash VNX-LLM-001 – LLM Prompt Injection via User-Controlled Input VNX-LLM-002 – LLM Output Passed to Code Execution (RCE) VNX-LLM-003 – Hardcoded LLM API Key VNX-LLM-004 – User Input Directly in LLM System Prompt VNX-LLM-005 – LangChain Arbitrary Code Execution Tool VNX-LLM-006 – LLM Output Interpolated into SQL Query VNX-LLM-007 – torch.load() Without weights_only=True VNX-NODE-001 – Missing npm Lock File VNX-NODE-002 – eval() or new Function() in JavaScript VNX-NODE-003 – Command Injection via child_process VNX-NODE-004 – Express App Without Helmet VNX-NODE-005 – innerHTML or dangerouslySetInnerHTML Usage VNX-NODE-006 – Prototype Pollution via Merge VNX-NODE-007 – Node.js SQL Injection VNX-NODE-008 – Node.js Open Redirect VNX-NODE-009 – Node.js Server-Side Request Forgery VNX-NODE-010 – Node.js Path Traversal VNX-NODE-011 – Node.js Server-Side Template Injection VNX-NODE-012 – Client-Side XSS via innerHTML or v-html VNX-NODE-013 – Node.js Command Injection via child_process VNX-NODE-014 – NoSQL Injection in MongoDB VNX-NODE-015 – WebSocket Server Without Origin Verification (CSWSH) VNX-NODE-016 – ReDoS via User-Controlled Regular Expression VNX-NODE-017 – Deserialization of Untrusted Data via node-serialize or serialize-to-js VNX-NODE-018 – JWT Decoded Without Signature Verification VNX-NODE-019 – Hardcoded JWT or Session Secret VNX-NODE-020 – Deprecated crypto.createCipher/createDecipher Without IV VNX-NODE-021 – XXE via libxmljs with noent:true VNX-NODE-022 – Shell injection via shelljs exec() VNX-NODE-023 – Unsafe YAML.load() with untrusted input VNX-NODE-024 – postMessage without origin validation (CSWSH/XSS) VNX-NODE-025 – Insecure express-session or cookie-session configuration VNX-NODE-026 – Child process spawn with shell:true enables command injection VNX-NODE-027 – Assignment to innerHTML without sanitization VNX-NODE-028 – Missing Content-Security-Policy header VNX-NODE-029 – Missing HttpOnly flag on cookie VNX-NODE-030 – TURN server allowing reserved IP addresses VNX-NODE-031 – Logging of sensitive data VNX-PHP-001 – Missing composer.lock VNX-PHP-002 – Dangerous Function in PHP VNX-PHP-003 – PHP File Inclusion with Variable Path VNX-PHP-004 – PHP Open Redirect VNX-PHP-005 – PHP Server-Side Request Forgery VNX-PHP-006 – PHP Object Injection via unserialize() VNX-PHP-007 – PHP extract() on Superglobal VNX-PHP-008 – PHP phpinfo() Exposure VNX-PHP-009 – PHP preg_replace() with /e Modifier VNX-PHP-010 – PHP Type Juggling in Comparison VNX-PHP-011 – PHP SQL injection via string concatenation VNX-PHP-012 – PHP reflected XSS via echo/print of user input VNX-PHP-013 – PHP XXE via LIBXML_NOENT or LIBXML_DTDLOAD flag VNX-PHP-014 – PHP Session Fixation via User-Controlled Session ID VNX-PHP-015 – PHP Unrestricted File Upload via move_uploaded_file VNX-PHP-016 – PHP weak hash function (md5/sha1) VNX-PHP-017 – PHP LDAP injection via user-controlled filter VNX-PHP-018 – PHP sensitive debug output disclosure VNX-PHP-019 – PHP insecure cipher mode (AES-CBC) VNX-PHP-020 – PHP curl SSL certificate verification disabled VNX-PHP-021 – Laravel mass assignment via empty guarded array VNX-PHP-022 – PHP open redirect via non-literal redirect destination VNX-PHP-023 – PHP anonymous LDAP bind without password VNX-PHP-024 – PHP mb_ereg_replace with variable options enabling eval modifier VNX-PHP-025 – PHP deprecated mcrypt encryption functions VNX-PHP-026 – PHP session poisoning via user-controlled session key VNX-PY-001 – Missing Python Lock File VNX-PY-002 – eval() / exec() Usage VNX-PY-003 – Insecure Deserialization with pickle VNX-PY-004 – yaml.load() Without SafeLoader VNX-PY-005 – Weak PRNG for Security Operations VNX-PY-006 – Django DEBUG=True in Production VNX-PY-007 – subprocess with shell=True VNX-PY-008 – Flask Debug Mode Enabled VNX-PY-009 – Jinja2 Autoescape Disabled VNX-PY-010 – SSL Certificate Verification Disabled in requests VNX-PY-011 – Python SQL Injection VNX-PY-012 – Server-Side Template Injection (SSTI) VNX-PY-013 – ML/AI Insecure Deserialization VNX-PY-014 – Python XML External Entity (XXE) Injection VNX-PY-015 – Python ReDoS via User-Controlled Regex VNX-PY-016 – Django Mass Assignment via Request Data Unpacking VNX-PY-017 – MD5 or SHA1 Used as Password Hash VNX-PY-018 – Insecure Temporary File Creation via tempfile.mktemp() VNX-PY-019 – Paramiko Implicit Host Key Trust VNX-PY-020 – tarfile.extractall() Without Path Validation (Zip Slip) VNX-PY-021 – Weak or Deprecated SSL/TLS Protocol Version VNX-PY-022 – SQL injection via string concatenation in Python VNX-RUBY-001 – Missing Gemfile.lock VNX-RUBY-002 – eval() or system() in Ruby VNX-RUBY-003 – Insecure Deserialization in Ruby VNX-RUBY-004 – Ruby SQL Injection VNX-RUBY-005 – Ruby XSS via html_safe or raw VNX-RUBY-006 – Ruby Mass Assignment VNX-RUBY-007 – YAML.load() Insecure Deserialization VNX-RUBY-008 – Open3.pipeline with Dynamic Command VNX-RUBY-009 – Dynamic Method Dispatch via send with User-Controlled Method Name VNX-RUBY-010 – OpenSSL Certificate Verification Disabled (VERIFY_NONE) VNX-RUST-001 – Missing Cargo.lock VNX-RUST-002 – Rust unwrap May Panic VNX-RUST-003 – Rust Unsafe Block or Function VNX-RUST-004 – Rust Command Injection via process::Command VNX-RUST-005 – panic!() or unwrap()/expect() in a Result-Returning Function VNX-RUST-006 – Integer Truncation or Sign-Change Cast After Parsing VNX-RUST-007 – Integer Arithmetic Overflow Without Checked Arithmetic VNX-RUST-008 – Path Traversal in Actix-web or Axum File-Serving Handler VNX-SEC-001 – AWS Access Key ID VNX-SEC-002 – Private Key Committed VNX-SEC-003 – AWS Secret Access Key VNX-SEC-004 – GitHub or GitLab Token VNX-SEC-005 – GCP API Key VNX-SEC-006 – Stripe Secret Key VNX-SEC-007 – Slack Token or Webhook VNX-SEC-008 – Database Connection String with Credentials VNX-SEC-009 – SendGrid API Key VNX-SEC-010 – Package Registry Token VNX-SEC-011 – Hardcoded JWT Token VNX-SEC-012 – CORS Wildcard or Origin Reflection VNX-SEC-013 – Insecure Cookie Configuration VNX-SEC-014 – Hardcoded Password in Variable VNX-SEC-015 – JWT Algorithm None Attack VNX-SEC-016 – TLS Verification Disabled in Shell Command VNX-SEC-017 – Plaintext Protocol URL VNX-SEC-018 – AI Provider API Key VNX-SEC-019 – GCP Service Account Key VNX-SEC-020 – GitLab Access Token VNX-SEC-021 – Twilio API Credentials VNX-SEC-022 – Sensitive Data in Log Statement VNX-SEC-023 – GitHub Actions Expression Injection VNX-SEC-024 – OAuth Token Stored in localStorage VNX-SEC-025 – Azure Storage Account Key Hardcoded VNX-SEC-026 – DigitalOcean Personal Access Token Hardcoded VNX-SEC-027 – Hugging Face API Token Hardcoded VNX-SEC-028 – npm Access Token Hardcoded VNX-SEC-029 – PyPI Upload Token Hardcoded VNX-SEC-030 – Google OAuth Client Secret Hardcoded VNX-SEC-031 – Mailgun API Key Hardcoded VNX-SEC-032 – PGP Private Key Block Hardcoded VNX-SWIFT-001 – Swift Hardcoded API Key or Secret in Source VNX-SWIFT-002 – Swift NSLog with Potentially Sensitive Data VNX-SWIFT-003 – Swift Insecure Data Storage via UserDefaults for Sensitive Values VNX-SWIFT-004 – Swift TLS Certificate Validation Disabled in URLSession or Alamofire VNX-SWIFT-005 – Swift WKWebView JavaScript Auto-Open-Windows Enabled VNX-SWIFT-006 – Swift Insecure Random Number Generator Used in Security-Sensitive Context VNX-TF-001 – Terraform AWS S3 Bucket with Public ACL VNX-TF-002 – Terraform AWS Security Group with Unrestricted Ingress (0.0.0.0/0) VNX-TF-003 – Terraform AWS RDS Instance Publicly Accessible VNX-TF-004 – Terraform IAM Policy with Wildcard Action (*) VNX-TF-005 – Terraform AWS EBS Volume Unencrypted VNX-TF-006 – Terraform AWS EC2 Instance Metadata Service v1 (IMDSv1) Enabled VNX-TF-007 – Terraform AWS EKS Cluster Public API Endpoint Enabled VNX-TF-008 – Terraform AWS Provider with Hardcoded Static Credentials

Vulnetix CLI

Categories

© 2026 Vulnetix vulnetix.com VDB GitHub Terms