CWE: 319 Cleartext Transmission of Sensitive Information BadSource: connect_tcp Read password using an outbound tcp connection GoodSource: Set password to a hardcoded value (one that was not sent over the network) Sinks: kerberosKey GoodSink: Decrypt password before using in KerberosKey() Ba...

CWE: 259 Hard Coded Password BadSource: hardcodedPassword Set data to a hardcoded string GoodSource: Read data from the console using readLine() Sinks: passwordAuth BadSink : data used as password in PasswordAuthentication() Flow Variant: 61 Data flow: data returned from one method to anothe...

CWE: 256 Plaintext Storage of a Password. Read the password from a Properties file or a regular file. In the good case, read the file from the console. BadSource: Read password from a .properties file (from the property named password) GoodSource: Read password from a .properties file (from ...

CWE: 23 Relative Path Traversal BadSource: URLConnection Read data from a web server with URLConnection GoodSource: A hardcoded string Sinks: readFile BadSink : no validation Flow Variant: 45 Data flow: data passed as a private class member variable from one function to another in the same c...

CWE: 209 Information exposure through error message Sinks: printStackTrace GoodSink: Print generic error message to console BadSink : Print stack trace to console Flow Variant: 02 Control flow: if(true) and if(false)

CWE: 197 Numeric Truncation Error BadSource: URLConnection Read data from a web server with URLConnection GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: to_byte BadSink : Convert data to a byte Flow Variant: 81 Data flow: data passed in a parameter to an abstract method

CWE: 197 Numeric Truncation Error BadSource: large Set data to a number larger than Byte.MAX_VALUE GoodSource: A hardcoded non-zero, non-min, non-max, even number BadSink: to_byte Convert data to a byte Flow Variant: 41 Data flow: data passed as an argument from one method to another in the s...

CWE: 197 Numeric Truncation Error BadSource: Environment Read data from an environment variable GoodSource: A hardcoded non-zero, non-min, non-max, even number BadSink: to_byte Convert data to a byte Flow Variant: 02 Control flow: if(true) and if(false)

CWE: 197 Numeric Truncation Error BadSource: random Set data to a random value GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: to_byte BadSink : Convert data to a byte Flow Variant: 61 Data flow: data returned from one method to another in different classes in the same...

CWE: 197 Numeric Truncation Error BadSource: Property Read data from a system property GoodSource: A hardcoded non-zero, non-min, non-max, even number BadSink: to_short Convert data to a short Flow Variant: 03 Control flow: if(5==5) and if(5!=5)

CWE: 197 Numeric Truncation Error BadSource: listen_tcp Read data using a listening tcp connection GoodSource: A hardcoded non-zero, non-min, non-max, even number BadSink: to_byte Convert data to a byte Flow Variant: 12 Control flow: if(IO.staticReturnsTrueOrFalse())

CWE: 197 Numeric Truncation Error BadSource: large Set data to a number larger than Short.MAX_VALUE GoodSource: A hardcoded non-zero, non-min, non-max, even number BadSink: to_short Convert data to a short Flow Variant: 12 Control flow: if(IO.staticReturnsTrueOrFalse())

CWE: 197 Numeric Truncation Error BadSource: File Read data from file (named c:\data.txt) GoodSource: A hardcoded non-zero, non-min, non-max, even number BadSink: to_byte Convert data to a byte Flow Variant: 12 Control flow: if(IO.staticReturnsTrueOrFalse())

CWE: 191 Integer Underflow BadSource: min Set data to the max value for short GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: sub GoodSink: Ensure there will not be an underflow before subtracting 1 from data BadSink : Subtract 1 from data, which can cause an Underflow...

CWE: 191 Integer Underflow BadSource: console_readLine Read data from the console using readLine GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: sub GoodSink: Ensure there will not be an underflow before subtracting 1 from data BadSink : Subtract 1 from data, which can...

CWE: 191 Integer Underflow BadSource: URLConnection Read data from a web server with URLConnection GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: sub GoodSink: Ensure there will not be an underflow before subtracting 1 from data BadSink : Subtract 1 from data, which c...

CWE: 191 Integer Underflow BadSource: listen_tcp Read data using a listening tcp connection GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: multiply GoodSink: Ensure there will not be an underflow before multiplying data by 2 BadSink : If data is negative, multiply by ...

CWE: 191 Integer Underflow BadSource: getParameter_Servlet Read data from a querystring using getParameter() GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: multiply GoodSink: Ensure there will not be an underflow before multiplying data by 2 BadSink : If data is negat...

CWE: 191 Integer Underflow BadSource: getParameter_Servlet Read data from a querystring using getParameter() GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: multiply GoodSink: Ensure there will not be an underflow before multiplying data by 2 BadSink : If data is negat...

CWE: 191 Integer Underflow BadSource: getCookies_Servlet Read data from the first cookie using getCookies() GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: sub GoodSink: Ensure there will not be an underflow before subtracting 1 from data BadSink : Subtract 1 from data...

CWE: 191 Integer Underflow BadSource: Property Read data from a system property GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: multiply GoodSink: Ensure there will not be an underflow before multiplying data by 2 BadSink : If data is negative, multiply by 2, which can...

CWE: 191 Integer Underflow BadSource: PropertiesFile Read data from a .properties file (in property named data) GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: multiply GoodSink: Ensure there will not be an underflow before multiplying data by 2 BadSink : If data is ne...

CWE: 191 Integer Underflow BadSource: rand Set data to result of rand() GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: sub GoodSink: Ensure there will not be an underflow before subtracting 1 from data BadSink : Subtract 1 from data, which can cause an Underflow Flow...

CWE: 191 Integer Underflow BadSource: min Set data to the max value for byte GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: multiply GoodSink: Ensure there will not be an underflow before multiplying data by 2 BadSink : If data is negative, multiply by 2, which can ca...

CWE: 190 Integer Overflow BadSource: random Set data to a random value GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: add GoodSink: Ensure there will not be an overflow before adding 1 to data BadSink : Add 1 to data, which can cause an overflow Flow Variant: 03 Cont...