search

MendDemo-josh / easybuggy

Too buggy web application
Apache License 2.0
0 stars 0 forks source link

Code Security Report: 12 high severity findings, 27 total findings #26

Open mend-for-github-com[bot] opened 2 years ago

mend-for-github-com[bot] commented 2 years ago

Code Security Report

Scan Metadata

Latest Scan: 2024-02-08 04:39pm Total Findings: 27 | New Findings: 0 | Resolved Findings: 0 Tested Project Files: 102 Detected Programming Languages: 1 (Java*)

Most Relevant Findings

The list below presents the 10 most relevant findings that need your attention. To view information on the remaining findings, navigate to the Mend Application.

SeverityVulnerability TypeCWEFileData FlowsDate
HighSQL Injection [CWE-89](https://cwe.mitre.org/data/definitions/89.html) [SQLInjectionServlet.java:73](https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java#L73) 12024-02-06 11:43pm
Vulnerable Code https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java#L68-L73
1 Data Flow/s detected
https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java#L28 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java#L28 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java#L28 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java#L45 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java#L60 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java#L73 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java#L73
Secure Code Warrior Training Material ● Training    ▪ [Secure Code Warrior SQL Injection Training](https://portal.securecodewarrior.com/?utm_source=partner-integration:mend&partner_id=mend#/contextual-microlearning/web/injection/sql/java/vanilla) ● Videos    ▪ [Secure Code Warrior SQL Injection Video](https://media.securecodewarrior.com/v2/module_01_sql_injection.mp4) ● Further Reading    ▪ [OWASP SQL Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)    ▪ [OWASP SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection)    ▪ [OWASP Query Parameterization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html)
 
HighExpression Language Injection [CWE-917](https://cwe.mitre.org/data/definitions/917.html) [OGNLExpressionInjectionServlet.java:35](https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/OGNLExpressionInjectionServlet.java#L35) 12023-12-06 01:37pm
Vulnerable Code https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/OGNLExpressionInjectionServlet.java#L30-L35
1 Data Flow/s detected
https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/OGNLExpressionInjectionServlet.java#L31 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/OGNLExpressionInjectionServlet.java#L34 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/OGNLExpressionInjectionServlet.java#L34 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/OGNLExpressionInjectionServlet.java#L34 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/OGNLExpressionInjectionServlet.java#L34 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/OGNLExpressionInjectionServlet.java#L35
Secure Code Warrior Training Material ● Videos ● Further Reading    ▪ [OWASP Top Ten Proactive Controls 2018 C5: Validate All Inputs](https://owasp.org/www-project-proactive-controls/v3/en/c5-validate-inputs)    ▪ [OWASP Injection Prevention Cheat Sheet in Java](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_in_Java_Cheat_Sheet.html)    ▪ [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)    ▪ [OWASP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html)    ▪ [OWASP Top Ten 2021 A03: Injection](https://owasp.org/Top10/A03_2021-Injection/)
 
HighPath/Directory Traversal [CWE-22](https://cwe.mitre.org/data/definitions/22.html) [NullByteInjectionServlet.java:47](https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/NullByteInjectionServlet.java#L47) 12023-12-06 01:37pm
Vulnerable Code https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/NullByteInjectionServlet.java#L42-L47
1 Data Flow/s detected
https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/NullByteInjectionServlet.java#L35 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/NullByteInjectionServlet.java#L40 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/NullByteInjectionServlet.java#L40 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/NullByteInjectionServlet.java#L46 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/NullByteInjectionServlet.java#L46 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/NullByteInjectionServlet.java#L46 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/NullByteInjectionServlet.java#L47
Secure Code Warrior Training Material ● Training    ▪ [Secure Code Warrior Path/Directory Traversal Training](https://portal.securecodewarrior.com/?utm_source=partner-integration:mend&partner_id=mend#/contextual-microlearning/web/injection/pathtraversal/java/vanilla) ● Videos    ▪ [Secure Code Warrior Path/Directory Traversal Video](https://media.securecodewarrior.com/v2/module_196_path_traversal.mp4) ● Further Reading    ▪ [OWASP Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)    ▪ [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)
 
HighCode Injection [CWE-94](https://cwe.mitre.org/data/definitions/94.html) [CodeInjectionServlet.java:65](https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L65) 12023-12-06 01:37pm
Vulnerable Code https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L60-L65
1 Data Flow/s detected
https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L25 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L44 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L44 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L44 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L45 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L45 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L45 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L46 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L46 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L46 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L47 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L61 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L65 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/CodeInjectionServlet.java#L65
Secure Code Warrior Training Material ● Training    ▪ [Secure Code Warrior Code Injection Training](https://portal.securecodewarrior.com/?utm_source=partner-integration:mend&partner_id=mend#/contextual-microlearning/web/injection/code/java/vanilla) ● Videos    ▪ [Secure Code Warrior Code Injection Video](https://media.securecodewarrior.com/v2/Module_28_CODE_INJECTION_v2.mp4) ● Further Reading    ▪ [OWASP Command Injection](https://owasp.org/www-community/attacks/Code_Injection)    ▪ [SEI CERT Oracle Coding Standard for Java - Prevent Code Injection](https://wiki.sei.cmu.edu/confluence/display/java/IDS52-J.+Prevent+code+injection)
 
HighCross-Site Scripting [CWE-79](https://cwe.mitre.org/data/definitions/79.html) [AbstractServlet.java:95](https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java#L95) 122023-12-06 01:37pm
Vulnerable Code https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java#L90-L95
12 Data Flow/s detected
View Data Flow 1 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/RoundOffErrorServlet.java#L22 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/RoundOffErrorServlet.java#L30 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/RoundOffErrorServlet.java#L30 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/RoundOffErrorServlet.java#L43 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/RoundOffErrorServlet.java#L43 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/RoundOffErrorServlet.java#L43 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java#L32 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java#L95
View Data Flow 2 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/NetworkSocketLeakServlet.java#L27 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/NetworkSocketLeakServlet.java#L42 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/NetworkSocketLeakServlet.java#L42 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/NetworkSocketLeakServlet.java#L54 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/NetworkSocketLeakServlet.java#L54 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/NetworkSocketLeakServlet.java#L54 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java#L32 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java#L95
View Data Flow 3 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/TruncationErrorServlet.java#L21 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/TruncationErrorServlet.java#L31 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/TruncationErrorServlet.java#L30 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/TruncationErrorServlet.java#L44 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/TruncationErrorServlet.java#L44 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/TruncationErrorServlet.java#L44 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java#L32 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/servlets/AbstractServlet.java#L95
[View more Data Flows](https://saas.mend.io/app/orgs/JoshN-Demo/scans/32d036e7-c88f-46ec-b143-bfd7354416b0/sast?project=a6b0bf3e-02c7-4ef6-826e-73e8b9d39064&findingSnapshotId=68ee7117-c901-4f8c-a07f-29dc4fd13b0d&filtered=yes)
Secure Code Warrior Training Material ● Training    ▪ [Secure Code Warrior Cross-Site Scripting Training](https://portal.securecodewarrior.com/?utm_source=partner-integration:mend&partner_id=mend#/contextual-microlearning/web/xss/reflected/java/vanilla) ● Videos    ▪ [Secure Code Warrior Cross-Site Scripting Video](https://media.securecodewarrior.com/v2/module_73_reflected_cross_site_scripting.mp4)
 
HighPath/Directory Traversal [CWE-22](https://cwe.mitre.org/data/definitions/22.html) [MailHeaderInjectionServlet.java:138](https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/MailHeaderInjectionServlet.java#L138) 12024-02-06 06:40pm
Vulnerable Code https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/MailHeaderInjectionServlet.java#L133-L138
1 Data Flow/s detected
https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/MailHeaderInjectionServlet.java#L125 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/MailHeaderInjectionServlet.java#L125 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/MailHeaderInjectionServlet.java#L125 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/MailHeaderInjectionServlet.java#L125 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/MailHeaderInjectionServlet.java#L125 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/MailHeaderInjectionServlet.java#L127 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L56 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/MailHeaderInjectionServlet.java#L127 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/MailHeaderInjectionServlet.java#L133 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/MailHeaderInjectionServlet.java#L133 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/MailHeaderInjectionServlet.java#L138
Secure Code Warrior Training Material ● Training    ▪ [Secure Code Warrior Path/Directory Traversal Training](https://portal.securecodewarrior.com/?utm_source=partner-integration:mend&partner_id=mend#/contextual-microlearning/web/injection/pathtraversal/java/vanilla) ● Videos    ▪ [Secure Code Warrior Path/Directory Traversal Video](https://media.securecodewarrior.com/v2/module_196_path_traversal.mp4) ● Further Reading    ▪ [OWASP Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)    ▪ [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)
 
HighServer Side Request Forgery [CWE-918](https://cwe.mitre.org/data/definitions/918.html) [NetworkSocketLeakServlet.java:34](https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/NetworkSocketLeakServlet.java#L34) 12023-12-06 01:37pm
Vulnerable Code https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/NetworkSocketLeakServlet.java#L29-L34
1 Data Flow/s detected
https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/NetworkSocketLeakServlet.java#L27 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/NetworkSocketLeakServlet.java#L31 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/NetworkSocketLeakServlet.java#L31 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/troubles/NetworkSocketLeakServlet.java#L34
Secure Code Warrior Training Material ● Training    ▪ [Secure Code Warrior Server Side Request Forgery Training](https://portal.securecodewarrior.com/?utm_source=partner-integration:mend&partner_id=mend#/contextual-microlearning/web/ssrf/generic/java/vanilla) ● Videos    ▪ [Secure Code Warrior Server Side Request Forgery Video](https://media.securecodewarrior.com/v2/module_125_server_side_request_forgery.mp4)
 
HighPath/Directory Traversal [CWE-22](https://cwe.mitre.org/data/definitions/22.html) [MultiPartFileUtils.java:33](https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L33) 32023-12-06 01:37pm
Vulnerable Code https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L28-L33
3 Data Flow/s detected
View Data Flow 1 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/XEEandXXEServlet.java#L141 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/XEEandXXEServlet.java#L148 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L56 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/XEEandXXEServlet.java#L148 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/XEEandXXEServlet.java#L157 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L28 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L33 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L33
View Data Flow 2 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L70 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L71 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L56 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L71 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L80 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L28 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L33 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L33
View Data Flow 3 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedExtensionUploadServlet.java#L69 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedExtensionUploadServlet.java#L76 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L56 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedExtensionUploadServlet.java#L76 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedExtensionUploadServlet.java#L81 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L28 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L33 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L33
Secure Code Warrior Training Material ● Training    ▪ [Secure Code Warrior Path/Directory Traversal Training](https://portal.securecodewarrior.com/?utm_source=partner-integration:mend&partner_id=mend#/contextual-microlearning/web/injection/pathtraversal/java/vanilla) ● Videos    ▪ [Secure Code Warrior Path/Directory Traversal Video](https://media.securecodewarrior.com/v2/module_196_path_traversal.mp4) ● Further Reading    ▪ [OWASP Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)    ▪ [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)
 
HighPath/Directory Traversal [CWE-22](https://cwe.mitre.org/data/definitions/22.html) [UnrestrictedSizeUploadServlet.java:127](https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L127) 12023-12-06 01:37pm
Vulnerable Code https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L122-L127
1 Data Flow/s detected
https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L70 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L71 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L56 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L71 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L84 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L84 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L84 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L84 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L84 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L84 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L111 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L127 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L127 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L127
Secure Code Warrior Training Material ● Training    ▪ [Secure Code Warrior Path/Directory Traversal Training](https://portal.securecodewarrior.com/?utm_source=partner-integration:mend&partner_id=mend#/contextual-microlearning/web/injection/pathtraversal/java/vanilla) ● Videos    ▪ [Secure Code Warrior Path/Directory Traversal Video](https://media.securecodewarrior.com/v2/module_196_path_traversal.mp4) ● Further Reading    ▪ [OWASP Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)    ▪ [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)
 
HighPath/Directory Traversal [CWE-22](https://cwe.mitre.org/data/definitions/22.html) [UnrestrictedSizeUploadServlet.java:114](https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L114) 12023-12-06 01:37pm
Vulnerable Code https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L109-L114
1 Data Flow/s detected
https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L70 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L71 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L56 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L57 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/core/utils/MultiPartFileUtils.java#L59 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L71 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L84 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L84 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L84 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L84 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L84 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L84 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L111 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L114 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L114 https://github.com/MendDemo-josh/easybuggy/blob/de1b57aff59ff6c1ea99b80771390bc76d1c1a2c/src/main/java/org/t246osslab/easybuggy/vulnerabilities/UnrestrictedSizeUploadServlet.java#L114
Secure Code Warrior Training Material ● Training    ▪ [Secure Code Warrior Path/Directory Traversal Training](https://portal.securecodewarrior.com/?utm_source=partner-integration:mend&partner_id=mend#/contextual-microlearning/web/injection/pathtraversal/java/vanilla) ● Videos    ▪ [Secure Code Warrior Path/Directory Traversal Video](https://media.securecodewarrior.com/v2/module_196_path_traversal.mp4) ● Further Reading    ▪ [OWASP Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)    ▪ [OWASP Input Validation Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)

Findings Overview

Severity Vulnerability Type CWE Language Count
High Cross-Site Scripting CWE-79 Java* 1
High Path/Directory Traversal CWE-22 Java* 7
High Expression Language Injection CWE-917 Java* 1
High Code Injection CWE-94 Java* 1
High SQL Injection CWE-89 Java* 1
High Server Side Request Forgery CWE-918 Java* 1
Medium Trust Boundary Violation CWE-501 Java* 5
Medium Readline Denial of Service CWE-400 Java* 1
Medium Error Messages Information Exposure CWE-209 Java* 1
Medium XML External Entity (XXE) Injection CWE-611 Java* 1
Medium Insufficient Transport Layer Protection CWE-319 Java* 1
Low Log Forging CWE-117 Java* 1
Low HTTP Header Injection CWE-113 Java* 1
Low Unvalidated/Open Redirect CWE-601 Java* 4