Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

7-20 request #9

Closed
wants to merge 24 commits into from
Closed

7-20 request #9

wants to merge 24 commits into from

Conversation

apcxtest
Copy link
Owner

No description provided.

@apcxtest apcxtest closed this Jul 20, 2023
@apcxtest apcxtest reopened this Jul 20, 2023
@apcxtest
Copy link
Owner Author

Logo
Checkmarx One – Scan Summary & Details – 1c1f534b-4c49-4ffd-84bd-2c72715e996c

New Issues

Severity Issue Source File / Package Checkmarx Insight
HIGH ALB Listening on HTTP /positive2.tf: 70 AWS Application Load Balancer (alb) should not listen on HTTP
HIGH ALB Listening on HTTP /positive1.tf: 9 AWS Application Load Balancer (alb) should not listen on HTTP
HIGH CVE-2014-0114 Maven-commons-beanutils:commons-beanutils-1.8.0 Vulnerable Package
HIGH CVE-2016-5007 Maven-org.springframework:spring-core-3.2.4.RELEASE Vulnerable Package
HIGH CVE-2016-5007 Maven-org.springframework.security:spring-security-core-3.2.4.RELEASE Vulnerable Package
HIGH CVE-2016-5007 Maven-org.springframework.security:spring-security-config-3.2.4.RELEASE Vulnerable Package
HIGH CVE-2016-9879 Maven-org.springframework.security:spring-security-core-3.2.4.RELEASE Vulnerable Package
HIGH CVE-2017-1000048 Npm-qs-6.0.0 Vulnerable Package
HIGH CVE-2018-1272 Maven-org.springframework:spring-core-3.2.4.RELEASE Vulnerable Package
HIGH CVE-2019-10744 Npm-lodash-4.17.11 Vulnerable Package
HIGH CVE-2019-11272 Maven-org.springframework.security:spring-security-core-3.2.4.RELEASE Vulnerable Package
HIGH CVE-2019-17571 Maven-log4j:log4j-1.2.17 Vulnerable Package
HIGH CVE-2020-7212 Python-urllib3-1.25.7 Vulnerable Package
HIGH CVE-2020-8203 Npm-lodash-4.17.11 Vulnerable Package
HIGH CVE-2021-23337 Npm-lodash-4.17.11 Vulnerable Package
HIGH CVE-2021-28235 Go-go.etcd.io/etcd/server/v3-v3.5.0 Vulnerable Package
HIGH CVE-2021-33503 Python-urllib3-1.25.7 Vulnerable Package
HIGH CVE-2021-4229 Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH CVE-2022-1996 Go-github.com/emicklei/go-restful-v2.9.5 Vulnerable Package
HIGH CVE-2022-21698 Go-github.com/prometheus/client_golang-v1.11.0 Vulnerable Package
HIGH CVE-2022-22965 Maven-org.springframework:spring-beans-3.2.8.RELEASE Vulnerable Package
HIGH CVE-2022-22970 Maven-org.springframework:spring-core-3.2.4.RELEASE Vulnerable Package
HIGH CVE-2022-22970 Maven-org.springframework:spring-beans-3.2.8.RELEASE Vulnerable Package
HIGH CVE-2022-23302 Maven-log4j:log4j-1.2.17 Vulnerable Package
HIGH CVE-2022-23305 Maven-log4j:log4j-1.2.17 Vulnerable Package
HIGH CVE-2022-23307 Maven-log4j:log4j-1.2.17 Vulnerable Package
HIGH CVE-2022-24999 Npm-qs-6.0.0 Vulnerable Package
HIGH CVE-2022-25927 Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH CVE-2022-27191 Go-golang.org/x/crypto-v0.0.0-20211202192323-5770296d904e Vulnerable Package
HIGH CVE-2022-28948 Go-gopkg.in/yaml.v3-v3.0.0-20210107192922-496545a6307b Vulnerable Package
HIGH CVE-2022-32149 Go-golang.org/x/text-v0.3.7 Vulnerable Package
HIGH CVE-2022-41723 Go-golang.org/x/net-v0.0.0-20220225172249-27dd8689420f Vulnerable Package
HIGH CVE-2023-20863 Maven-org.springframework:spring-expression-3.2.8.RELEASE Vulnerable Package
HIGH CVE-2023-2253 Go-github.com/docker/distribution-v0.0.0-20180920194744-16128bbac47f Vulnerable Package
HIGH CVE-2023-30861 Python-Flask-2.0.2 Vulnerable Package
HIGH Cx0a21eeca-49b1 Npm-scs-0.0.1 Vulnerable Package
HIGH Cx0b414307-5d4b Npm-lodash-4.17.11 Vulnerable Package
HIGH Cx0b915a4a-2d97 Npm-scs-0.0.1 Vulnerable Package
HIGH Cx0eb7d3da-c52e Python-azure-powerbiembedded-6969.99.99 Vulnerable Package
HIGH Cx18e041aa-8a63 Npm-node-ipc-9.2.2 Vulnerable Package
HIGH Cx21f588f7-f9cb Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH Cx4ca27ec0-0c96 Npm-scs-0.0.1 Vulnerable Package
HIGH Cx4d89cd75-1e27 Python-azure-powerbiembedded-6969.99.99 Vulnerable Package
HIGH Cx68e4da20-b53a Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH Cx6bee2138-4df0 Npm-flow-dev-tools-99.10.9 Vulnerable Package
HIGH Cx6eb8ff4e-c9cf Npm-flow-dev-tools-99.10.9 Vulnerable Package
HIGH Cx7401d0a9-2786 Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH Cx8079a3fb-ff1f Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH Cx8147ddef-ae09 Python-azure-powerbiembedded-6969.99.99 Vulnerable Package
HIGH Cx86e7ca06-a018 Python-not-particularly-2.5.0 Vulnerable Package
HIGH Cx9f739bef-35bb Npm-flow-dev-tools-99.10.9 Vulnerable Package
HIGH Cxa45b0853-bee2 Npm-momnet-2.29.1 Vulnerable Package
HIGH Cxae9d1b09-2adb Npm-scs-0.0.1 Vulnerable Package
HIGH Cxb52dba53-66d2 Python-not-particularly-2.5.0 Vulnerable Package
HIGH Cxb667b900-bec1 Python-azure-powerbiembedded-6969.99.99 Vulnerable Package
HIGH Cxba94c01e-a95d Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH Cxbec87a55-fe55 Npm-node-ipc-9.2.2 Vulnerable Package
HIGH Cxc73fdf59-ac18 Npm-ua-parser-js-0.7.29 Vulnerable Package
HIGH Cxcc09496a-59c8 Npm-js-yaml-3.6.1 Vulnerable Package
HIGH Cxccd8b30c-808c Npm-scs-0.0.1 Vulnerable Package
HIGH Cxd55dbf56-4d06 Npm-scs-0.0.1 Vulnerable Package
HIGH Cxdca8e59f-8bfe Npm-inflight-1.0.6 Vulnerable Package
HIGH Cxec49316b-56df Npm-js-yaml-3.6.1 Vulnerable Package
HIGH Cxfd197ca1-b64b Npm-momnet-2.29.1 Vulnerable Package
HIGH EC2 Instance Has Public IP /negative2.tf: 96 EC2 Instance should not have a public IP address.
HIGH EC2 Instance Has Public IP /negative2.tf: 83 EC2 Instance should not have a public IP address.
HIGH EC2 Instance Has Public IP /positive2.tf: 82 EC2 Instance should not have a public IP address.
HIGH EC2 Instance Has Public IP /negative2.tf: 109 EC2 Instance should not have a public IP address.
HIGH EC2 Instance Has Public IP /positive2.tf: 95 EC2 Instance should not have a public IP address.
HIGH EC2 Instance Has Public IP /positive2.tf: 108 EC2 Instance should not have a public IP address.
HIGH Missing User Instruction /Dockerfile: 1 A user should be specified in the dockerfile, otherwise the image will run as root
MEDIUM ALB Not Dropping Invalid Headers /positive1.tf: 15 It's considered a best practice when using Application Load Balancers to drop invalid header fields
MEDIUM ALB Not Dropping Invalid Headers /negative2.tf: 49 It's considered a best practice when using Application Load Balancers to drop invalid header fields
MEDIUM ALB Not Dropping Invalid Headers /positive2.tf: 49 It's considered a best practice when using Application Load Balancers to drop invalid header fields
MEDIUM ALB Not Dropping Invalid Headers /negative1.tf: 15 It's considered a best practice when using Application Load Balancers to drop invalid header fields
MEDIUM Apt Get Install Pin Version Not Defined /Dockerfile: 5 When installing a package, its pin version should be defined
MEDIUM CVE-2014-3578 Maven-org.springframework:spring-core-3.2.4.RELEASE Vulnerable Package
MEDIUM CVE-2019-3795 Maven-org.springframework.security:spring-security-core-3.2.4.RELEASE Vulnerable Package
MEDIUM CVE-2020-15250 Maven-junit:junit-4.8.1 Vulnerable Package
MEDIUM CVE-2020-26137 Python-urllib3-1.25.7 Vulnerable Package
MEDIUM CVE-2020-28500 Npm-lodash-4.17.11 Vulnerable Package
MEDIUM CVE-2020-5408 Maven-org.springframework.security:spring-security-core-3.2.4.RELEASE Vulnerable Package
MEDIUM CVE-2020-8554 Go-k8s.io/api-v0.23.5 Vulnerable Package
MEDIUM CVE-2021-22060 Maven-org.springframework:spring-core-3.2.4.RELEASE Vulnerable Package
MEDIUM CVE-2021-22096 Maven-org.springframework:spring-core-3.2.4.RELEASE Vulnerable Package
MEDIUM CVE-2021-4104 Maven-log4j:log4j-1.2.17 Vulnerable Package
MEDIUM CVE-2022-22950 Maven-org.springframework:spring-expression-3.2.8.RELEASE Vulnerable Package
MEDIUM CVE-2022-22950 Maven-org.springframework:spring-core-3.2.4.RELEASE Vulnerable Package
MEDIUM CVE-2022-22968 Maven-org.springframework:spring-context-3.2.8.RELEASE Vulnerable Package
MEDIUM CVE-2022-22971 Maven-org.springframework:spring-core-3.2.4.RELEASE Vulnerable Package
MEDIUM CVE-2022-22976 Maven-org.springframework.security:spring-security-core-3.2.4.RELEASE Vulnerable Package
MEDIUM CVE-2022-29526 Go-golang.org/x/sys-v0.0.0-20211216021012-1d35b9e2eb4e Vulnerable Package
MEDIUM CVE-2022-41717 Go-golang.org/x/net-v0.0.0-20220225172249-27dd8689420f Vulnerable Package
MEDIUM CVE-2023-20861 Maven-org.springframework:spring-expression-3.2.8.RELEASE Vulnerable Package
MEDIUM CVE-2023-32082 Go-go.etcd.io/etcd/server/v3-v3.5.0 Vulnerable Package
MEDIUM Cx3bb8deb1-b4c0 Npm-scs-0.0.1 Vulnerable Package
MEDIUM Cx3cf24ca3-dd23 Npm-ua-parser-js-0.7.29 Vulnerable Package
MEDIUM Cx65afcea4-5e85 Npm-event-pubsub-5.0.3 Vulnerable Package
MEDIUM Cx743605c8-a95e Npm-momnet-2.29.1 Vulnerable Package
MEDIUM Cxa29f6cb5-3c84 Python-azure-powerbiembedded-6969.99.99 Vulnerable Package
MEDIUM Cxba768ce4-aa4e Npm-node-ipc-9.2.2 Vulnerable Package
MEDIUM Cxc09edd5e-4a9e Npm-strong-type-0.1.6 Vulnerable Package
MEDIUM Cxf7a33198-8ff8 Npm-node-ipc-9.2.2 Vulnerable Package
MEDIUM VPC Without Network Firewall /positive2.tf: 26 VPC should have a Network Firewall associated
MEDIUM VPC Without Network Firewall /negative2.tf: 26 VPC should have a Network Firewall associated
LOW ALB Deletion Protection Disabled /negative1.tf: 15 Application Load Balancer should have deletion protection enabled
LOW ALB Deletion Protection Disabled /positive2.tf: 49 Application Load Balancer should have deletion protection enabled
LOW ALB Deletion Protection Disabled /positive1.tf: 15 Application Load Balancer should have deletion protection enabled
LOW ALB Deletion Protection Disabled /negative2.tf: 49 Application Load Balancer should have deletion protection enabled
LOW Cx786c6ee9-1022 Go-github.com/opencontainers/image-spec-v1.0.1 Vulnerable Package
LOW EC2 Instance Using Default Security Group /negative2.tf: 97 EC2 instances should not use default security group(s)
LOW EC2 Instance Using Default Security Group /negative2.tf: 110 EC2 instances should not use default security group(s)
LOW EC2 Instance Using Default Security Group /positive2.tf: 109 EC2 instances should not use default security group(s)
LOW EC2 Instance Using Default Security Group /negative2.tf: 84 EC2 instances should not use default security group(s)
LOW EC2 Instance Using Default Security Group /positive2.tf: 83 EC2 instances should not use default security group(s)
LOW EC2 Instance Using Default Security Group /positive2.tf: 96 EC2 instances should not use default security group(s)
LOW Healthcheck Instruction Missing /Dockerfile: 1 Ensure that HEALTHCHECK is being used. The HEALTHCHECK instruction tells Docker how to test a container to check that it is still working
LOW IAM Access Analyzer Not Enabled /negative1.tf: 1 IAM Access Analyzer should be enabled and configured to continuously monitor resource permissions
LOW Shield Advanced Not In Use /negative1.tf: 15 AWS Shield Advanced should be used for Amazon Route 53 hosted zone, AWS Global Accelerator accelerator, Elastic IP Address, Elastic Load Balancing,...
LOW Shield Advanced Not In Use /positive1.tf: 15 AWS Shield Advanced should be used for Amazon Route 53 hosted zone, AWS Global Accelerator accelerator, Elastic IP Address, Elastic Load Balancing,...
LOW Shield Advanced Not In Use /positive2.tf: 49 AWS Shield Advanced should be used for Amazon Route 53 hosted zone, AWS Global Accelerator accelerator, Elastic IP Address, Elastic Load Balancing,...
LOW Shield Advanced Not In Use /negative2.tf: 49 AWS Shield Advanced should be used for Amazon Route 53 hosted zone, AWS Global Accelerator accelerator, Elastic IP Address, Elastic Load Balancing,...
LOW VPC FlowLogs Disabled /negative2.tf: 26 Every VPC resource should have an associated Flow Log
LOW VPC FlowLogs Disabled /positive2.tf: 26 Every VPC resource should have an associated Flow Log

@apcxtest apcxtest closed this Sep 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
1 participant
@apcxtest