Bugsy

DEMO
Back to Marketing
DU

Demo User

demo@acmebank.com

Back to Projects

Loan Processing Service

Microservice handling loan applications and credit score analysis

Project Details

Repository
github.com/acmebank/loan-service
Framework
Spring Boot
Languages
JavaSQL
Last Scan
4/15/2024
completed

Security Findings

4
Critical
7
High
8
Medium
6
Low
25
Total Findings

Security Findings (25 of 25)

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

critical
src/auth/login.ts:15
Injection Attack
97% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

critical
src/auth/login.ts:15
Injection Attack
74% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

critical
src/auth/login.ts:15
Injection Attack
81% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

critical
src/auth/login.ts:15
Injection Attack
88% confidence

Cross-Site Scripting (XSS) in User Profile Display

Rendering unsanitized user input directly into DOM allows script injection attacks. Attackers can steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

high
components/UserProfile.tsx:23
Cross-Site Scripting
95% confidence

Cross-Site Scripting (XSS) in User Profile Display

Rendering unsanitized user input directly into DOM allows script injection attacks. Attackers can steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

high
components/UserProfile.tsx:23
Cross-Site Scripting
72% confidence

Cross-Site Scripting (XSS) in User Profile Display

Rendering unsanitized user input directly into DOM allows script injection attacks. Attackers can steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

high
components/UserProfile.tsx:23
Cross-Site Scripting
79% confidence

Cross-Site Scripting (XSS) in User Profile Display

Rendering unsanitized user input directly into DOM allows script injection attacks. Attackers can steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

high
components/UserProfile.tsx:23
Cross-Site Scripting
86% confidence

Cross-Site Scripting (XSS) in User Profile Display

Rendering unsanitized user input directly into DOM allows script injection attacks. Attackers can steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

high
components/UserProfile.tsx:23
Cross-Site Scripting
93% confidence

Cross-Site Scripting (XSS) in User Profile Display

Rendering unsanitized user input directly into DOM allows script injection attacks. Attackers can steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

high
components/UserProfile.tsx:23
Cross-Site Scripting
70% confidence

Cross-Site Scripting (XSS) in User Profile Display

Rendering unsanitized user input directly into DOM allows script injection attacks. Attackers can steal session cookies, perform unauthorized actions, or redirect users to malicious sites.

high
components/UserProfile.tsx:23
Cross-Site Scripting
77% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
84% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
91% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
98% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
75% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
82% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
89% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
96% confidence

Excessive File System Permissions Violate Least Privilege

Permission 777 grants full access to all users, violating DISA STIG APSC-DV-002320 principle of least privilege. This creates unnecessary attack surface and potential for privilege escalation.

medium
scripts/deploy.sh:23
Access Control
73% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

low
src/auth/login.ts:15
Injection Attack
80% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

low
src/auth/login.ts:15
Injection Attack
87% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

low
src/auth/login.ts:15
Injection Attack
94% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

low
src/auth/login.ts:15
Injection Attack
71% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

low
src/auth/login.ts:15
Injection Attack
78% confidence

SQL Injection Vulnerability in User Authentication

Direct string concatenation in SQL queries allows attackers to inject malicious SQL code. This vulnerability could allow complete database compromise including data extraction, modification, or deletion.

low
src/auth/login.ts:15
Injection Attack
85% confidence