Step Flow JavaScript
Name Scopes Tags Links
Critical
JWT/JWS is decoded but not verified in the same flow phase Step Authentication & Authorisation CWE-347
Request content is stringified Step Data Validation DoS Protection CWE-20
Sensitive information is in the source code Step Data at Rest CWE-256 CWE-312
High
Cache is accessed without prior authentication Step Authentication & Authorisation CWE-306
Confidential data is used as a cache key Step Data at Rest CWE-256 CWE-312
Flow accepts confidential data as URL parameters Flow PreFlow Data in Transit CWE-598
Insecure Quota configuration Step Code Quality Data Validation CWE-770
JSONThreatProtection policy is not applied to a request body with JSON type Flow Data Validation CWE-502 CWE-20
Open Redirect Step Data Validation CWE-601 CWE-20
Policy sets confidential data in URL parameters Step Data in Transit CWE-598
Request content is tainted by user input Step Data Validation CWE-20 CWE-116
Target URL is tainted by user input Step Data Validation CWE-22 CWE-233 CWE-918 CWE-20
Unsafe regular expression Step Data Validation CWE-1333
Unsafe variable is used to define host Step Data Validation CWE-20
Use of weak hash algorithms AssignMessage HMAC JavaScript Secure Configuration CWE-327
User-controlled data in ServiceCallout Step Data Validation CWE-233 CWE-20
Medium
Condition has undefined variables Step RouteRule Flow Code Quality CWE-570 CWE-571
Error flow variable is set but not checked in request phase Step Error Handling CWE-390
Flow accepts requests with any method Flow Data Validation CWE-749
Flow doesn't limit HTTP methods correctly Flow Data Validation CWE-749