<dd id="sga4y"><optgroup id="sga4y"></optgroup></dd>

<nav id="sga4y"><code id="sga4y"></code></nav>

<optgroup id="sga4y"></optgroup>

Environment

This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms.

Contents

C/C++

• Insecure Compiler Optimization
• Insecure Compiler Optimization: Pointer Arithmetic

C#/VB.NET/ASP.NET

• ASP.NET Misconfiguration: Certificate Validation Disabled
• ASP.NET Misconfiguration: Cookie Protection Disabled
• ASP.NET Misconfiguration: Debug Information
• ASP.NET Misconfiguration: Excessive Session Timeout
• ASP.NET Misconfiguration: Incomplete Cookie Protection
• ASP.NET Misconfiguration: Incomplete Role Protection
• ASP.NET Misconfiguration: Password Protection Disabled
• ASP.NET Misconfiguration: Request Validation Disabled
• ASP.NET Misconfiguration: Request Validation Disabled(request_validation_disabled)
• ASP.NET Misconfiguration: Role Protection Disabled
• ASP.NET Misconfiguration: Session Cookies Disabled
• ASP.NET Misconfiguration: Trace Output
• ASP.NET Misconfiguration: Use of Impersonation Context
• ASP.NET Misconfiguration: Weak Password Protection
• Cookie Security: HTTPOnly not Set on Application Cookie
• Cookie Security: Session Cookie not Sent Over SSL
• External Content: Content Delivery Network
• Password Management: Empty Password in Configuration File
• Password Management: Password in Configuration File
• WCF Misconfiguration: Anonymous Message Client
• WCF Misconfiguration: Anonymous Transport Client
• WCF Misconfiguration: Debug Information
• WCF Misconfiguration: Insecure Transport
• WCF Misconfiguration: Insufficient Audit Failure Handling
• WCF Misconfiguration: Insufficient Logging
• WCF Misconfiguration: MSMQ Anonymous Transport Client
• WCF Misconfiguration: Metadata
• WCF Misconfiguration: Security Not Enabled
• WCF Misconfiguration: Service Enumeration
• WCF Misconfiguration: Throttling Not Enabled
• WCF Misconfiguration: Transport Security Enabled
• WCF Misconfiguration: Unauthorized Access
• WCF Misconfiguration: Unsafe Revocation Mode
• WCF Misconfiguration: Weak Token
• WSE Misconfiguration: Insufficient Encryption
• WSE Misconfiguration: Missing Authorization
• WSE Misconfiguration: Unsigned Fault Timestamp
• WSE Misconfiguration: Unsigned Request Timestamp
• WSE Misconfiguration: Unsigned Response Timestamp

Java/JSP

• Android Misconfiguration: Debug Information
• Axis 2 Misconfiguration: Debug Information
• Axis 2 Misconfiguration: Insecure Message Security
• Axis 2 Misconfiguration: Insecure Transport Receiver
• Axis 2 Misconfiguration: Insecure Transport Sender
• Axis 2 Service Provider Misconfiguration: Inbound WS-Security Not Enabled
• Axis 2 Service Provider Misconfiguration: Missing Inbound Encryption
• Axis 2 Service Provider Misconfiguration: Missing Inbound Signature
• Axis 2 Service Provider Misconfiguration: Missing Inbound Timestamp
• Axis 2 Service Provider Misconfiguration: Missing Outbound Encryption
• Axis 2 Service Provider Misconfiguration: Missing Outbound Signature
• Axis 2 Service Provider Misconfiguration: Missing Outbound Timestamp
• Axis 2 Service Provider Misconfiguration: Outbound WS-Security Not Enabled
• Axis 2 Service Provider Misconfiguration: Unsigned Inbound Timestamp
• Axis 2 Service Provider Misconfiguration: Unsigned Outbound Timestamp
• Axis 2 Service Provider Misconfiguration: WS-Security Not Enabled
• Axis 2 Service Provider Misconfiguration: Weak Token
• Axis 2 Service Requester Misconfiguration: Inbound WS-Security Not Enabled
• Axis 2 Service Requester Misconfiguration: Missing Inbound Encryption
• Axis 2 Service Requester Misconfiguration: Missing Inbound Signature
• Axis 2 Service Requester Misconfiguration: Missing Inbound Timestamp
• Axis 2 Service Requester Misconfiguration: Missing Outbound Encryption
• Axis 2 Service Requester Misconfiguration: Missing Outbound Signature
• Axis 2 Service Requester Misconfiguration: Missing Outbound Timestamp
• Axis 2 Service Requester Misconfiguration: Outbound WS-Security Not Enabled
• Axis 2 Service Requester Misconfiguration: Plain Text Password
• Axis 2 Service Requester Misconfiguration: Unsigned Inbound Timestamp
• Axis 2 Service Requester Misconfiguration: Unsigned Outbound Timestamp
• Axis 2 Service Requester Misconfiguration: WS-Security Not Enabled
• Axis 2 Service Requester Misconfiguration: Weak Token
• Axis Misconfiguration: Debug Information
• Axis Misconfiguration: Service Enumeration
• Axis Service Provider Misconfiguration: Plain Text Password
• Axis Service Provider Misconfiguration: Weak Token
• Axis Service Requester Misconfiguration: Plain Text Password
• Axis Service Requester Misconfiguration: Weak Token
• Build Misconfiguration: Dynamic Dependency Version Usage
• Build Misconfiguration: External Ant Dependency Repository
• Build Misconfiguration: External Ivy Dependency Repository
• Build Misconfiguration: External Maven Dependency Repository
• Flex Misconfiguration: Debug Information
• J2EE Misconfiguration: Cookies Disabled
• J2EE Misconfiguration: Debug Information
• J2EE Misconfiguration: Direct JSP Access
• J2EE Misconfiguration: Duplicate Security Role
• J2EE Misconfiguration: Duplicate Servlet Mapping
• J2EE Misconfiguration: Excessive Servlet Mappings
• J2EE Misconfiguration: Excessive Session Timeout
• J2EE Misconfiguration: Incomplete Error Handling - (404)
• J2EE Misconfiguration: Incomplete Error Handling - (500)
• J2EE Misconfiguration: Incomplete Error Handling - (throwable)
• J2EE Misconfiguration: Insecure Transport
• J2EE Misconfiguration: Insufficient Session-ID Length
• J2EE Misconfiguration: Invalid Servlet Name
• J2EE Misconfiguration: Missing Authentication Method
• J2EE Misconfiguration: Missing Data Transport Constraint
• J2EE Misconfiguration: Missing Error Handling
• J2EE Misconfiguration: Missing Filter Definition
• J2EE Misconfiguration: Missing Security Role
• J2EE Misconfiguration: Missing Servlet Mapping
• J2EE Misconfiguration: Unsafe Bean Declaration
• J2EE Misconfiguration: Weak Access Permissions
• Password Management: Empty Password in Configuration File
• Password Management: Password in Configuration File
• Struts Misconfiguration: Duplicate Form Bean
• Struts Misconfiguration: Invalid Path
• Struts Misconfiguration: Missing Action Input
• Struts Misconfiguration: Missing Exception Type
• Struts Misconfiguration: Missing Form Bean
• Struts Misconfiguration: Missing Form Bean Name
• Struts Misconfiguration: Missing Form Bean Type
• Struts Misconfiguration: Missing Form Property Type
• Struts Misconfiguration: Missing Forward Name
• Struts Misconfiguration: Missing Forward Path
• Tomcat Configuration: Insecure Transport
• WebSphere Misconfiguration: Missing Nonce
• WebSphere Misconfiguration: Servlets Served By Class Name
• WebSphere Service Provider Misconfiguration: Inbound WS-Security Not Enabled
• WebSphere Service Provider Misconfiguration: Missing Inbound Encryption
• WebSphere Service Provider Misconfiguration: Missing Inbound Signature
• WebSphere Service Provider Misconfiguration: Missing Inbound Timestamp
• WebSphere Service Provider Misconfiguration: Missing Outbound Encryption
• WebSphere Service Provider Misconfiguration: Missing Outbound Signature
• WebSphere Service Provider Misconfiguration: Missing Outbound Timestamp
• WebSphere Service Provider Misconfiguration: Missing Timestamp Expiration
• WebSphere Service Provider Misconfiguration: Outbound WS-Security Not Enabled
• WebSphere Service Provider Misconfiguration: Unsigned Inbound Timestamp
• WebSphere Service Provider Misconfiguration: Unsigned Outbound Timestamp
• WebSphere Service Provider Misconfiguration: Weak Token
• WebSphere Service Requester Misconfiguration: Inbound WS-Security Not Enabled
• WebSphere Service Requester Misconfiguration: Missing Inbound Encryption
• WebSphere Service Requester Misconfiguration: Missing Inbound Signature
• WebSphere Service Requester Misconfiguration: Missing Inbound Timestamp
• WebSphere Service Requester Misconfiguration: Missing Outbound Encryption
• WebSphere Service Requester Misconfiguration: Missing Outbound Signature
• WebSphere Service Requester Misconfiguration: Missing Outbound Timestamp
• WebSphere Service Requester Misconfiguration: Missing Timestamp Expiration
• WebSphere Service Requester Misconfiguration: Outbound WS-Security Not Enabled
• WebSphere Service Requester Misconfiguration: Unsigned Inbound Timestamp
• WebSphere Service Requester Misconfiguration: Unsigned Outbound Timestamp
• WebSphere Service Requester Misconfiguration: Weak Token
• Weblogic Misconfiguration: Missing Timestamp
• Weblogic Misconfiguration: Weak Token

PHP

• CakePHP Misconfiguration: Debug Information
• CakePHP Misconfiguration: Excessive Session Timeout
• Cookie Security: HTTPOnly not Set on Session Cookie
• Cookie Security: Overly Broad Session Cookie Domain
• Cookie Security: Overly Broad Session Cookie Path
• Cookie Security: Persistent Session Cookie
• Cookie Security: Session Cookie not Sent Over SSL
• Cookie Security: Session Cookies Disabled
• PHP Misconfiguration: Missing open_basedir Entry
• PHP Misconfiguration: Missing safe_mode_exec_dir Entry
• PHP Misconfiguration: allow_url_fopen Enabled
• PHP Misconfiguration: allow_url_include Enabled
• PHP Misconfiguration: cgi.force_redirect Disabled
• PHP Misconfiguration: file_uploads Enabled
• PHP Misconfiguration: magic_quotes_gpc Enabled
• PHP Misconfiguration: magic_quotes_runtime Enabled
• PHP Misconfiguration: magic_quotes_sybase Enabled
• PHP Misconfiguration: register_globals Enabled
• PHP Misconfiguration: safe_mode Disabled
• PHP Misconfiguration: session_use_trans_sid Enabled
• Race Condition: PHP Design Flaw
• System Information Leak: PHP Errors
• System Information Leak: PHP Version

Webservices

• Weak WS-SecurityPolicy: Insecure Transport
• Weak WS-SecurityPolicy: Insufficient Supporting Token Protection
• Weak WS-SecurityPolicy: Missing Encryption Token
• Weak WS-SecurityPolicy: Missing Encryption on Message Attachments
• Weak WS-SecurityPolicy: Missing Encryption on Message Body
• Weak WS-SecurityPolicy: Missing Encryption on Message Headers
• Weak WS-SecurityPolicy: Missing Initiator Encryption Token
• Weak WS-SecurityPolicy: Missing Initiator Signature Token
• Weak WS-SecurityPolicy: Missing Recipient Encryption Token
• Weak WS-SecurityPolicy: Missing Recipient Signature Token
• Weak WS-SecurityPolicy: Missing Signature Token
• Weak WS-SecurityPolicy: Missing Signature on Message Attachments
• Weak WS-SecurityPolicy: Missing Signature on Message Body
• Weak WS-SecurityPolicy: Missing Signature on Message Headers
• Weak WS-SecurityPolicy: Missing Timestamp
• Weak WS-SecurityPolicy: Tokens Not Protected
• Weak WS-SecurityPolicy: Weak Token

XML

• Weak XML Schema: Lax Processing
• Weak XML Schema: Type Any
• Weak XML Schema: Unbounded Occurrences
• Weak XML Schema: Undefined Namespace

Copyright 2013 Fortify Software - All rights reserved.
(Generated from version 2013.1.1.0008 of the Fortify Secure Coding Rulepacks)