Bugsy

DEMO
Back to Marketing
DU

Demo User

demo@acmebank.com

Back to Projects

Data Analytics Pipeline

ETL pipeline processing transaction data for fraud detection models

Project Details

Repository
github.com/acmebank/analytics-pipeline
Framework
Apache Airflow
Languages
PythonSQL
Last Scan
4/16/2024
scanning

Security Findings

1
Critical
2
High
6
Medium
3
Low
12
Total Findings

Security Findings (12 of 12)

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

critical
src/auth/login.ts:15
Injection Attack
77% confidence

Cross-Site Scripting (XSS) in User Profile Display

Rendering unsanitized user input directly into DOM allows script injection attacks. Attackers can steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

high
components/UserProfile.tsx:23
Cross-Site Scripting
84% confidence

Cross-Site Scripting (XSS) in User Profile Display

Rendering unsanitized user input directly into DOM allows script injection attacks. Attackers can steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

high
components/UserProfile.tsx:23
Cross-Site Scripting
91% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
98% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
75% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
82% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
89% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
96% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
73% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

low
src/auth/login.ts:15
Injection Attack
80% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

low
src/auth/login.ts:15
Injection Attack
87% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

low
src/auth/login.ts:15
Injection Attack
94% confidence