New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Passwords And Secrets - Generic Password @ /deploy/k8s/base/mongodb/config.yaml #3

Open

AaronZhouYu opened this issue Feb 7, 2023 · 0 comments

Labels

branch:main Checkmarx IaC-Security project:AaronZhouYu/TotallySecureApp

Owner

AaronZhouYu commented Feb 7, 2023 •

edited

Loading

Checkmarx (IaC-Security): Passwords And Secrets - Generic Password
Checkmarx Project: AaronZhouYu/TotallySecureApp
Repository URL: https://github.com/AaronZhouYu/TotallySecureApp
Branch: main
Scan ID: d9fa6dd5-d23b-4436-b75a-41a016305f39

Query to find passwords and secrets in infrastructure code.

Locations:

Result #1:
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
    File: /deploy/k8s/base/mongodb/config.yaml[9,0]
    Expected value: Hardcoded secret key should not appear in source
    Actual value: Hardcoded secret key appears in source
    Review result in Checkmarx One: Passwords And Secrets - Generic Password

AaronZhouYu added IaC-Security project:AaronZhouYu/TotallySecureApp and removed CxKICS labels

This was referenced Sep 18, 2023

Reflected_XSS_All_Clients @ /src/main/webapp/eb/v1/dfi/includable.jsp #2949

Open

Reflected_XSS_All_Clients @ /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/OpenRedirectController.java #2953

Open

Privilege Escalation Allowed @ /deploy/k8s/base/workshop/deployment.yaml #88

Open

Privilege Escalation Allowed @ /deploy/k8s/base/community/deployment.yaml #39

Open

Reflected_XSS_All_Clients @ /src/main/webapp/eb/v1/dt/includable.jsp #2971

Open

Passwords And Secrets - Generic Password @ /deploy/docker/docker-compose.yml #28

Open

Reflected_XSS_All_Clients @ /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/VerboseErrorMessageController.java #2960

Open

Reflected_XSS_All_Clients @ /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/XEEandXXEController.java #3024

Open

Reflected_XSS_All_Clients @ /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/BruteForceController.java #3026

Open

CPU Requests Not Set @ /deploy/k8s/base/community/deployment.yaml #196

Open

NET_RAW Capabilities Not Being Dropped @ /deploy/k8s/base/workshop/deployment.yaml #70

Open

Container Running As Root @ /deploy/k8s/base/workshop/deployment.yaml #87

Open

Container Running As Root @ /deploy/k8s/base/community/deployment.yaml #97

Open

Security Opt Not Set @ /deploy/docker/docker-compose.yml #100

Open

NET_RAW Capabilities Not Being Dropped @ /deploy/k8s/base/community/deployment.yaml #105

Open

Networks Not Set @ /deploy/docker/docker-compose.yml #247

Open

Container Running With Low UID @ /deploy/k8s/base/community/deployment.yaml #175

Open

Healthcheck Not Set @ /deploy/docker/docker-compose.yml #59

Open

Host Namespace is Shared @ /deploy/docker/docker-compose.yml #187

Open

Seccomp Profile Is Not Configured @ /deploy/k8s/base/workshop/deployment.yaml #189

Open

Memory Requests Not Defined @ /deploy/k8s/base/workshop/deployment.yaml #201

Open

Memory Requests Not Defined @ /deploy/k8s/base/community/deployment.yaml #71

Open

CPU Limits Not Set @ /deploy/k8s/base/community/deployment.yaml #209

Open

Cleartext_Submission_of_Sensitive_Information @ /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/VulnerableOIDCRPController.java #3125

Open

Seccomp Profile Is Not Configured @ /deploy/k8s/base/community/deployment.yaml #101

Open

Memory Limits Not Defined @ /deploy/k8s/base/workshop/deployment.yaml #102

Open

Container Running With Low UID @ /deploy/k8s/base/workshop/deployment.yaml #239

Open

This was referenced Sep 18, 2023

Memory Limits Not Defined @ /deploy/k8s/base/community/deployment.yaml #119

Open

No Drop Capabilities for Containers @ /deploy/k8s/base/workshop/deployment.yaml #250

Open

TruffleHog_HighEntropy_Strings @ /src/main/resources/templates/eb/v1/head.html #3139

Open

TruffleHog_HighEntropy_Strings @ /src/main/webapp/eb/v1/dfi/style_bootstrap.html #3088

Open

Pod or Container Without Security Context @ /deploy/k8s/base/community/deployment.yaml #149

Open

Spring_Overly_Permissive_Cross_Origin_Resource_Sharing_Policy @ /src/main/java/org/t246osslab/easybuggy4sb/controller/CxController.java #3122

Open

Pod or Container Without Security Context @ /deploy/k8s/base/workshop/deployment.yaml #167

Open

Serializable_Class_Containing_Sensitive_Data @ /src/main/java/org/t246osslab/easybuggy4sb/core/model/User.java #3163

Open

Unsafe_Use_Of_Target_blank @ /src/main/resources/templates/eb/v1/index.html #2867

Open

Escape_False @ /src/main/webapp/eb/v1/dt/includable.jsp #3151

Open

TruffleHog_HighEntropy_Strings @ /src/main/webapp/eb/v1/dfi/style_google_mdl.html #3169

Open

Image Without Digest @ /deploy/k8s/base/workshop/deployment.yaml #186

Open

Unsynchronized_Access_To_Shared_Data @ /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/VulnerableOIDCRPController.java #3162

Open

Container Capabilities Unrestricted @ /deploy/docker/docker-compose.yml #255

Open

Root Container Not Mounted Read-only @ /deploy/k8s/base/workshop/deployment.yaml #162

Open

Client_Hardcoded_Domain @ /src/main/webapp/eb/v1/dfi/style_bootstrap.html #3194

Open

Spring_Overly_Permissive_Cross_Origin_Resource_Sharing_Policy @ /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/VulnerableOIDCRPController.java #3197

Open

Image Without Digest @ /deploy/k8s/base/community/deployment.yaml #169

Open

Client_Hardcoded_Domain @ /src/main/resources/templates/eb/v1/head.html #3198

Open

Unsynchronized_Access_To_Shared_Data @ /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/VerboseErrorMessageController.java #3202

Open

Unsynchronized_Access_To_Shared_Data @ /src/main/java/org/t246osslab/easybuggy4sb/controller/DefaultLoginController.java #3207

Open

Open_Redirect @ /src/main/java/org/t246osslab/easybuggy4sb/core/filters/AuthenticationFilter.java #2900

Open

Escape_False @ /src/main/webapp/eb/v1/dfi/includable.jsp #3209

Open

Root Container Not Mounted Read-only @ /deploy/k8s/base/community/deployment.yaml #307

Open

No Drop Capabilities for Containers @ /deploy/k8s/base/community/deployment.yaml #184

Open

Client_Hardcoded_Domain @ /src/main/webapp/eb/v1/dfi/style_google_mdl.html #3217

Open

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment