<dd id="sga4y"><optgroup id="sga4y"></optgroup></dd>

<nav id="sga4y"><code id="sga4y"></code></nav>

<optgroup id="sga4y"></optgroup>

Security Features

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Contents

ABAP

• Access Control: Database
• Access Control: Missing Authorization Check
• Password Management: Empty Password
• Password Management: Hardcoded Password
• Password Management: Password in Comment
• Privacy Violation

ActionScript

• Access Control: Database
• Password Management
• Password Management: Empty Password
• Password Management: Hardcoded Password
• Password Management: Null Password
• Password Management: Password in Comment
• Password Management: Weak Cryptography
• Privacy Violation

ColdFusion

• Credential Management
• Credential Management: Hardcoded Username
• Insecure Randomness
• Password Management
• Password Management: Empty Password
• Password Management: Hardcoded Password
• Password Management: Password in Comment
• Privacy Violation
• Weak Cryptographic Hash
• Weak Encryption

COBOL

• Access Control: DLI
• Access Control: Database
• Access Control: MQ
• Password Management
• Password Management: Hardcoded Password
• Password Management: Password in Comment
• Password Management: Weak Cryptography
• Privacy Violation

C/C++

• Access Control: Anonymous LDAP Bind
• Access Control: Database
• Access Control: LDAP
• Insecure Randomness
• Key Management: Hardcoded Encryption Key
• Least Privilege Violation
• Password Management
• Password Management: Empty Password
• Password Management: Hardcoded Password
• Password Management: Null Password
• Password Management: Password in Comment
• Password Management: Weak Cryptography
• Privacy Violation
• Weak Cryptographic Hash
• Weak Cryptographic Hash: Hardcoded Salt
• Weak Encryption
• Weak Encryption: Inadequate RSA Padding
• Weak Encryption: Insufficient Key Size

C#/VB.NET/ASP.NET

• ASP.NET Bad Practices: Use of Impersonation Context
• ASP.NET Misconfiguration: Header Checking Disabled(header_checking_disabled)
• ASP.NET Misconfiguration: Missing Error Handling
• ASP.NET Misconfiguration: Persistent Authentication
• ASP.NET Misconfiguration: ViewStateMac Disabled
• ASP.NET Misconfiguration: ViewStateMac Disabled(viewstatemac_disabled)
• Access Control: Anonymous LDAP Bind
• Access Control: Database
• Access Control: LDAP
• Cookie Security: Cookie not Sent Over SSL
• Cookie Security: HTTPOnly not Set
• Cookie Security: Overly Broad Domain
• Cookie Security: Overly Broad Path
• Cookie Security: Persistent Cookie
• HTTP Verb Tampering
• Header Checking Disabled
• Insecure Randomness
• Password Management
• Password Management: Empty Password
• Password Management: Hardcoded Password
• Password Management: Null Password
• Password Management: Password in Comment
• Password Management: Weak Cryptography
• Privacy Violation
• Privacy Violation: Heap Inspection
• Privacy Violation: Image
• WCF Misconfiguration: Weak Class Reference
• Weak Cryptographic Hash
• Weak Encryption
• Weak Encryption: Inadequate RSA Padding
• Weak Encryption: Insufficient Key Size

HTML

• Password Management: Insecure Submission
• Password Management: Password in HTML Form
• Privacy Violation: Autocomplete
• Privacy Violation: Password

Java/JSP

• Access Control: Amazon Web Services
• Access Control: Android Provider
• Access Control: Anonymous LDAP Bind
• Access Control: Database
• Access Control: LDAP
• Access Control: SecurityManager Bypass
• Access Control: Weak Security Constraint
• Acegi Misconfiguration: Insecure Channel Mixing
• Acegi Misconfiguration: Run-As Authentication Replacement
• Android Bad Practices: Application Permission Defined
• Android Bad Practices: Just Provider writePermission Defined
• Android Bad Practices: Missing Broadcaster Permission
• Android Bad Practices: Missing Component Permission
• Android Bad Practices: Missing Exported Flag or Component Permission
• Android Bad Practices: Missing Receiver Permission
• Android Bad Practices: Provider permission Defined
• Android Bad Practices: Sticky Broadcast
• Android Bad Practices: Weak Authentication
• Android Bad Practices: normal Permission
• Cookie Security: Cookie not Sent Over SSL
• Cookie Security: Overly Broad Domain
• Cookie Security: Overly Broad Path
• Cookie Security: Persistent Cookie
• HTTP Verb Tampering
• Insecure Randomness
• Insecure SSL: Android Customized Implementation
• Insecure SSL: Android Hostname Verification Disabled
• Insecure SSL: Android Socket
• Missing SecurityManager Check: Cloneable
• Missing SecurityManager Check: Serializable
• Often Misused: Android Permission Check
• Password Management
• Password Management: Empty Password
• Password Management: Hardcoded Password
• Password Management: Null Password
• Password Management: Password in Comment
• Password Management: Password in Redirect
• Password Management: Weak Cryptography
• Privacy Violation
• Privacy Violation: Android Internal Storage
• Privacy Violation: Heap Inspection
• Privacy Violation: Password
• Privilege Management: Amazon Web Services Unchecked Permissions
• Privilege Management: Android Data Storage
• Privilege Management: Android Disable
• Privilege Management: Android Location
• Privilege Management: Android Messaging
• Privilege Management: Android Network
• Privilege Management: Android Telephony
• Privilege Management: Missing API Permission
• Privilege Management: Missing Content Provider Permission
• Privilege Management: Missing Intent Permission
• Privilege Management: Overly Broad Access Specifier
• Privilege Management: Unnecessary Permission
• Weak Cryptographic Hash
• Weak Cryptographic Hash: Hardcoded Salt
• Weak Encryption
• Weak Encryption: Inadequate RSA Padding
• Weak Encryption: Insufficient Key Size
• Weak SecurityManager Check: Overridable Method

Javascript

• Access Control: Database
• HTML5: Easy-to-Guess Database Name
• Insecure Randomness
• Password Management
• Password Management: Empty Password
• Password Management: Hardcoded Password
• Password Management: Null Password
• Password Management: Password in Comment
• Password Management: Weak Cryptography
• Privacy Violation
• Weak Cryptographic Hash
• Weak Encryption
• Weak Encryption: Insufficient Key Size

Objective-C

• Access Control: Database
• Key Management: Hardcoded Encryption Key
• Often Misused: SMS
• Password Management: Empty Password
• Password Management: Hardcoded Password
• Password Management: Null Password
• Privacy Violation
• Privacy Violation: Keyboard Caching
• Privacy Violation: Screen Caching
• Weak Cryptographic Hash
• Weak Encryption
• Weak Encryption: Insufficient Key Size

PHP

• Access Control: Database
• Cookie Security: Cookie not Sent Over SSL
• Cookie Security: HTTPOnly not Set
• Cookie Security: HTTPOnly not Set on Session Cookie
• Cookie Security: Overly Broad Domain
• Cookie Security: Overly Broad Path
• Cookie Security: Overly Broad Session Cookie Domain
• Cookie Security: Overly Broad Session Cookie Path
• Cookie Security: Persistent Cookie
• Cookie Security: Persistent Session Cookie
• Cookie Security: Session Cookie not Sent Over SSL
• Insecure Randomness
• Key Management: Empty Encryption Key
• Key Management: Hardcoded Encryption Key
• Key Management: Null Encryption Key
• Password Management
• Password Management: Empty Password
• Password Management: Hardcoded Password
• Password Management: Null Password
• Password Management: Password in Comment
• Password Management: Weak Cryptography
• Privacy Violation
• Weak Cryptographic Hash
• Weak Cryptographic Hash: Hardcoded Salt
• Weak Encryption
• Weak Encryption: Inadequate RSA Padding

Python

• Insecure Randomness
• Password Management: Hardcoded Password
• Password Management: Password in Comment
• Weak Cryptographic Hash

PLSQL/TSQL

• Access Control: Database
• Insecure Randomness
• Password Management
• Password Management: Empty Password
• Password Management: Hardcoded Password
• Password Management: Null Password
• Password Management: Password in Comment
• Privacy Violation
• Privilege Management: Default Function or Procedure Rights
• Privilege Management: Default Package Rights
• Privilege Management: Overly Broad Grant
• Weak Cryptographic Hash

VisualBasic/VBScript/ASP

• Access Control: Database
• Insecure Randomness
• Password Management
• Password Management: Empty Password
• Password Management: Hardcoded Password
• Password Management: Null Password
• Password Management: Password in Comment
• Password Management: Weak Cryptography
• Privacy Violation
• Weak Cryptographic Hash
• Weak Encryption
• Weak Encryption: Insufficient Key Size

Copyright 2013 Fortify Software - All rights reserved.
(Generated from version 2013.1.1.0008 of the Fortify Secure Coding Rulepacks)