Skip to main content

9.7.7 Resolved Issues List

Notice

  • icon_critical.png = Critical Severity

  • icon_high.png = High Severity

  • icon_medium.png = Medium Severity

  • icon_low.png = Low Severity

All

  • icon_high.png Custom queries error when base query change group.

  • icon_medium.png Revise queries between presets and categories.

  • icon_medium.png Uncategorized Queries for Preset OWASP Mobile Top 10 - 2016.

  • icon_low.png Presets High and Medium (and Low) contains inconsistencies in terms of queries' severity added.

  • icon_low.png Fixed a false positive for Java_Low_Visibility.Log_Forging.

General

  • icon_high.png CPP improvements - Off_by_One_Error query aborts on Front Arena on 9.7.2.

  • icon_medium.png SAST/AI SAST both scan compound-extension files (.aspx.cs) and produce duplicate findings.

  • icon_medium.png SQL/TSQL files not scanned after upgrading to v9.7 HF4+.

  • icon_medium.png Possible Missing Results in ExploitablePath Find_UnresolvedMethods.

  • icon_medium.png Fixed a false positive: Go Absolute_Path_Traversal - invalid sinks.

  • icon_medium.png Missing results from SAST for ExploitablePath.

  • icon_medium.png OS_Access_Violation Python query does not show explanation in the detailed result screen and the report PDF.

  • icon_medium.png Atomic query causing client's code to be printed in the logs.

  • icon_medium.png VbNet_Critical_Risk -> Stored_XSS does not load in the web portal.

  • icon_medium.png Fixed a false negative: Reflected_XSS_All_Clients ResponseBody Return Value Not Identified as Sink.

  • icon_low.png Deprecated obsolete Jelly Queries.

  • icon_low.png PL\SQL Query documentation contains TSQL code snippets.

Apex

  • icon_high.png Fixed a false positive for Apex_Force_com_Serious_Security_Risk.Sharing() on Aura omitted sharing.

  • icon_medium.png Apex Queries with CWE ID 0.

  • icon_low.png Apex_General.Extract_From_SOQL() does not account for Database.queryWithBinds().

CPP

  • icon_high.png Fixed a false positive for CPP_High_Risk.User_After_Free() on queue.erase().

  • icon_medium.png Fixed a false positive for CPP_Medium_Threat.MemoryFree_on_StackVariable.

  • icon_low.png Fixed a false negative for Path_Traversal.

CSharp

  • icon_high.png Fixed a false positive for CSharp_Critical_Risk.SQL_Injection() due to faulty Oracle support.

  • icon_high.png Performance issue in csharp queries.

  • icon_high.png Fixed a false positive for CSharp_Medium_Threat.Missing_HSTS_Header() due to not considering TryAdd.

  • icon_high.png Fixed a false positive for CSRF.

  • icon_high.png Query Timeout Causing Multiple Failures.

  • icon_high.png Fixed a false positive for CSharp_High_Risk.Unsafe_Reflection() due to missing sanitizers.

  • icon_high.png Fixed a false negative for Use_of_Hard_coded_Cryptographic_Key.

  • icon_medium.png Fixed a false positive for CSharp_Medium_Threat.Missing_HSTS_Header due to failed sanitization through General.Check_HSTS_Configuration query.

  • icon_medium.png Fixed a false positive for CSharp_Medium_Threat.Insufficiently_Protected_Credentials() due to non-database writing sinks.

  • icon_medium.png Returning DefaultNamespace in Missing Framing Policy.

  • icon_medium.png Fixed a false negative for CSharp_Medium_Threat.CSRF.

  • icon_medium.png Fixed a false negative for CSharp_Medium_Threat.Use_Of_Broken_Or_Risky_Cryptographic_Algorithm.

  • icon_medium.png Fixed a false positive for CSharp_Medium_Threat.Missing_HSTS_Header() due to limited parameter number consideration.

  • icon_medium.png Fixed a false positive for Stored_Path_Traversal when the project contains a class with the name File.

  • icon_medium.png Fixed a false positive for CSharp_High_Risk.Deserialization_of_Untrusted_Data due to connecting call to wrong override of a method.

  • icon_medium.png Fixed a false positive for CSharp_High_Risk.Connection_String_Injection.

  • icon_medium.png Fixed a false positive for CSharp_Medium_Threat.Buffer_Overflow: no sanitizers considered in the query.

  • icon_low.png Fixed a false negative for CSharp_High_Risk.Reflected_XSS.

GO

  • icon_high.png Fixed a false positive for Go_Medium_Threat.Unsafe_Object_Binding() due to confusing search for ObjectCreateExpr.

  • icon_high.png Fixed a false positive for Stored_Relative_Path_Traversal.

Java

  • icon_high.png Fixed a false positive for SQL_Injection.

  • icon_high.png Fixed a false positive for Java_Medium_Threat.Use_of_Broken_or_Risky_Cryptographic_Algorithm() on RSA/ECB.

  • icon_high.png Fixed a false positive for Open_Redirect.

  • icon_high.png Fixed a false positive for Java_High_Risk.Reflected_XSS() due to limited encodeForHTML detection.

  • icon_high.png Fixed a false positive for Unchecked_Input_for_Loop_Condition.

  • icon_high.png Fixed a false positive for Deserialization_of_Untrusted_Data.

  • icon_high.png Fixed a false positive for Improper_Restriction_of_Stored_XXE_Ref.

  • icon_high.png System.Reflection.TargetInvocationException: Exception.

  • icon_high.png Fixed a false positive for Reflected_XSS.

  • icon_high.png Fixed a false negative for Command_Injection.

  • icon_medium.png Fixed a false negative for Find_Remote_Requests.

  • icon_medium.png Missing description query Access_Specifier_Manipulation.

  • icon_medium.png Fixed a false positive for Java_Low_Visibility.Improper_Exception_Handling. Add global exception handler "ExceptionHandlerController" as sanitizer.

  • icon_medium.png Fixed a false positive for Java_Spring.Spring_Overly_Permissive_Cross_Origin_Resource_Sharing_Policy() due to wrong sinks.

  • icon_medium.png Regression for Stored Log Forging.

  • icon_medium.png Upgrade from 9.6.7 to 9.7.3 Issues.

  • icon_medium.png Fixed a false positive for Java_Android.Keyboard_Cache_Information_Leak.

  • icon_low.png Fixed a false negative for NoSQL_Injection.

  • icon_low.png Missing query description - Java\Best Coding Practices\Potential_SpringShell.

JavaScript

  • icon_high.png Fixed a false positive for JavaScript_Server_Side_Vulnerabilities.SQL_Injection() due to unrecognized safe package.

  • icon_high.png Fixed a false negative for JavaScript_Server_Side_Vulnerabilities.SQL_Injection() due to missing Sqlite3 variables.

  • icon_high.png Fixed a false positive for JavaScript_Server_Side_Vulnerabilities.Insecure_Storage_of_Sensitive_Data() on readFileSync().

  • icon_high.png Fixed a false positive for Reflected_XSS.

  • icon_high.png Fixed a false negative for JavaScript_Server_Side_Vulnerabilities.SQL_Injection.

  • icon_high.png Fixed a false positive for Missing_HSTS_Header.

  • icon_medium.png Fixed a false positive for JavaScript_Medium_Threat.Missing_HSTS_Header() due to flagging of JSON property.

  • icon_medium.png Fixed a false positive for JavaScript_Medium_Threat.Missing_HSTS_Header() on response fetch.

  • icon_medium.png Fixed a false negative for JavaScript_Server_Side_Vulnerabilities.Use_of_Hardcoded_Password() due to removal of strings on associative arrays.

  • icon_medium.png Fixed duplicate results for Unchecked_Input_for_Loop_Condition and Unchecked_Input_For_Loop_Condition.

  • icon_medium.png Minified js files are expanded only when EOL terminator is UNIX style.

  • icon_medium.png Fixed a false positive: JavaScript_Server_Side_Vulnerabilities.Reflected_XSS().

  • icon_low.png Fixed a false negative due to poor support for Node-Sqlite3 support.

  • icon_low.png Fixed a false negative for SQL_Injection.

  • icon_low.png Fixed a false negative for Code Injection vulnerabilities.

  • icon_low.png Fixed a false negative for Reflected_XSS.

Kotlin

  • icon_high.png Fixed a false positive for Reflected_XSS.

  • icon_low.png Fixed a false negative for Kotlin_Android.Sensitive_Information_Exposure_in_Cleartext_Channel.

  • icon_low.png Fixed a false negative for Communication_Over_HTTP.

ObjC

  • icon_medium.png Apple_Secure_Coding_Guide\Unchecked CString Convertion typo.

PHP

  • icon_medium.png Reflected XSS not being detected.

PLSQL

  • icon_high.png FindByName not working on PLSQL_Critical_Risk.SQL_Injection().

Perl

  • icon_medium.png Fixed a false positive for Perl_Low_Visibility.Variables_Outside_The_Scope_of_a_Regex.

Python

  • icon_high.png Fixed a false positive for Python_Critical_Risk.Command_Injection() due to faulty association on Find_Methods_By_Import().

  • icon_high.png Fixed a false positive for Python_Critical_Risk.Command_Injection.

  • icon_high.png System.Reflection.TargetInvocationException: Exception.

  • icon_medium.png Fixed a false negative for Find_SQL_DB_In.

  • icon_medium.png Fixed a false positive for Python_Critical_Risk.SQL_Injection() for non-SQL databases.

Rust

  • icon_low.png Fixed a false negative for Rust_Low_Visibility.JWT_No_Expiration_Time_Validation.

Swift

  • icon_high.png Fixed a false positive for Swift_Medium_Threat.Autocorrection_Keystroke_Logging() due to poor property association.

VB6

  • icon_medium.png Fixed duplicate results for VbNet_Medium_Threat.Insufficiently_Protected_Credentials.

VbNet

  • icon_high.png Fixed a false positive for Path_Traversal.

In this section: