Java

File Types

Mend SAST scans these file types:

.jsp

.jspx

.jhtml

.jhtm

.java

.jsf

.jspf

.faces

Vulnerability Types

Mend SAST scans for these vulnerability types:

Vulnerability Type

CWE

Severity

Vulnerability Type

CWE

Severity

SQL Injection

CWE-89

High

Path/Directory Traversal

CWE-22

High

Code Injection

CWE-94

High

Command Injection

CWE-78

High

LDAP Injection

CWE-90

High

XPath Injection

CWE-643

High

Deserialization of Untrusted Data

CWE-502

High

XML External Entity (XXE) Injection

CWE-611

High

Server Pages Execution

CWE-94

High

Server-Side Request Forgery

CWE-918

High

Cross-Site Scripting

CWE-79

High

File Manipulation

CWE-73

High

HTTP Response Splitting

CWE-113

High

Unvalidated/Open Redirect

CWE-601

High

HTTP Header Injection

CWE-113

High

Sleep Denial of Service

CWE-400

High

Regex Denial of Service (ReDoS)

CWE-400

High

Session Poisoning

CWE-20

High

System Properties Change

CWE-20

High

Insufficient Transport Layer Protection

CWE-319

High

Mail Relay

CWE-20

Low

Log Forging

CWE-117

Low

Arbitrary Server Connection

CWE-941

Low

Dangerous File Extensions

CWE-530

Low

File Upload

CWE-434

Low

Cookie Injection

CWE-20

Low

Cookie Without 'HttpOnly' Flag

CWE-1004

Low

Trust Boundary Violation

CWE-501

Low

Hardcoded Password/Credentials

CWE-798

Low

System Properties Disclosure

CWE-497

Low

Heap Inspection

CWE-244

Low

Log Messages Information Leak

CWE-209

Low

Error Messages Information Exposure

CWE-209

Low

Console Output

CWE-209

Low

Hidden HTML Input

CWE-472

Low

Weak Encryption Strength

CWE-326

Low

Weak Hash Strength

CWE-916

Low

Weak Pseudo-Random

CWE-338

Low

Miscellaneous Dangerous Functions

CWE-676

Low

 

Copyright © 2024 Mend.io (White Source Ltd.) | All rights reserved.