|
Bypassing AccessControl policy via True-Client-IP header
|
Critical |
AccessControl |
Data Validation |
CWE-290
|
|
Connection to the system is not encrypted
|
Critical |
ServiceCallout
MessageLogging
Target |
Data in Transit |
CWE-319
|
|
JWT/JWS is decoded but not verified in the same flow phase
|
Critical |
Step |
Authentication & Authorisation |
CWE-347
|
|
Lack of certificate validation
|
Critical |
ServiceCallout
MessageLogging
Target |
Data in Transit |
CWE-295
|
|
Request content is stringified
|
Critical |
Step |
Data Validation
DoS Protection |
CWE-20
|
|
Sensitive information is in the source code
|
Critical |
Step |
Data at Rest |
CWE-256
CWE-312
|