search

Custodela / iGoat-Swift

OWASP iGoat (Swift) - A Damn Vulnerable Swift Application for iOS
https://igoatapp.com/
GNU General Public License v3.0
0 stars 0 forks source link

CX Unscrubbed_Secret @ iGoat-Swift/iGoat-Swift/ThirdParty/YapDatabase/Extensions/FilteredViews/YapDatabaseFilteredViewTransaction.m [master] #31

Open tsunez opened 3 years ago

tsunez commented 3 years ago

Unscrubbed_Secret issue exists @ iGoat-Swift/iGoat-Swift/ThirdParty/YapDatabase/Extensions/FilteredViews/YapDatabaseFilteredViewTransaction.m in branch master

Method - at line 759 of iGoat-Swift\iGoat-Swift\ThirdParty\YapDatabase\Extensions\FilteredViews\YapDatabaseFilteredViewTransaction.m defines passesFilter, which is designated to contain user passwords. However, while plaintext passwords are later assigned to passesFilter, this variable is never cleared from memory.

Severity: Low

CWE:226

Vulnerability details and guidance

Checkmarx

Recommended Fix

Lines: 800 905 1213 1054

Code (Line #800):

    BOOL passesFilter;

Code (Line #905):

    BOOL passesFilter;

Code (Line #1213):

    BOOL passesFilter;

Code (Line #1054):

    BOOL passesFilter;
tsunez commented 3 years ago

Issue still exists.

SUMMARY

Issue has 4 vulnerability/vulnerabilities left to be fixed (Please scroll to the top for more information)

tsunez commented 3 years ago

Issue still exists.

SUMMARY

Issue has 4 vulnerability/vulnerabilities left to be fixed (Please scroll to the top for more information)