High Critical Step Flow AccessControl
Name Severity Scopes Tags Links
Bypassing AccessControl policy via True-Client-IP header Critical AccessControl Data Validation CWE-290
JWT/JWS is decoded but not verified in the same flow phase Critical Step Authentication & Authorisation CWE-347
Request content is stringified Critical Step Data Validation DoS Protection CWE-20
Sensitive information is in the source code Critical Step Data at Rest CWE-256 CWE-312
Cache is accessed without prior authentication High Step Authentication & Authorisation CWE-306
Confidential data is used as a cache key High Step Data at Rest CWE-256 CWE-312
Flow accepts confidential data as URL parameters High Flow PreFlow Data in Transit CWE-598
Insecure Quota configuration High Step Code Quality Data Validation CWE-770
JSONThreatProtection policy is not applied to a request body with JSON type High Flow Data Validation CWE-502 CWE-20
Open Redirect High Step Data Validation CWE-601 CWE-20
Policy sets confidential data in URL parameters High Step Data in Transit CWE-598
Request content is tainted by user input High Step Data Validation CWE-20 CWE-116
Target URL is tainted by user input High Step Data Validation CWE-22 CWE-233 CWE-918 CWE-20
Unsafe regular expression High Step Data Validation CWE-1333
Unsafe variable is used to define host High Step Data Validation CWE-20
User-controlled data in ServiceCallout High Step Data Validation CWE-233 CWE-20