CWE: 319 Cleartext Transmission of Sensitive Information BadSource: connect_tcp Read password using an outbound tcp connection GoodSource: Set password to a hardcoded value (one that was not sent over the network) Sinks: passwordAuth GoodSink: Decrypt password before using in PasswordAuthenti...

CWE: 319 Cleartext Transmission of Sensitive Information BadSource: URLConnection Read password from a web server with URLConnection GoodSource: Set password to a hardcoded value (one that was not sent over the network) Sinks: kerberosKey GoodSink: Decrypt password before using in KerberosKey...

CWE: 319 Cleartext Transmission of Sensitive Information BadSource: URLConnection Read password from a web server with URLConnection GoodSource: Set password to a hardcoded value (one that was not sent over the network) Sinks: kerberosKey GoodSink: Decrypt password before using in KerberosKey...

CWE: 315 Storing plaintext data in a cookie BadSource: Set data to credentials (without hashing or encryption) GoodSource: Set data to a hash of credentials Sinks: GoodSink: Hash data before storing in cookie BadSink : Store data directly in cookie Flow Variant: 45 Data flow: data passed a...

CWE: 253 Incorrect Check of Function Return Value Sinks: GoodSink: Check the return value from FileInputStream.read() and handle possible errors BadSink : Check the return value of FileInputStream.read() for the wrong value Flow Variant: 11 Control flow: if(IO.staticReturnsTrue()) and if(IO.s...

CWE: 197 Numeric Truncation Error BadSource: random Set data to a random value GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: to_byte BadSink : Convert data to a byte Flow Variant: 61 Data flow: data returned from one method to another in different classes in the same...

CWE: 197 Numeric Truncation Error BadSource: database Read data from a database GoodSource: A hardcoded non-zero, non-min, non-max, even number BadSink: to_byte Convert data to a byte Flow Variant: 41 Data flow: data passed as an argument from one method to another in the same class

CWE: 197 Numeric Truncation Error BadSource: File Read data from file (named c:\data.txt) GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: to_byte BadSink : Convert data to a byte Flow Variant: 45 Data flow: data passed as a private class member variable from one functi...

CWE: 197 Numeric Truncation Error BadSource: Property Read data from a system property GoodSource: A hardcoded non-zero, non-min, non-max, even number BadSink: to_short Convert data to a short Flow Variant: 11 Control flow: if(IO.staticReturnsTrue()) and if(IO.staticReturnsFalse())

CWE: 197 Numeric Truncation Error BadSource: large Set data to a number larger than Short.MAX_VALUE GoodSource: A hardcoded non-zero, non-min, non-max, even number BadSink: to_short Convert data to a short Flow Variant: 11 Control flow: if(IO.staticReturnsTrue()) and if(IO.staticReturnsFalse())

CWE: 197 Numeric Truncation Error BadSource: large Set data to a number larger than Short.MAX_VALUE GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: to_byte BadSink : Convert data to a byte Flow Variant: 75 Data flow: data passed in a serialized object from one method t...

CWE: 197 Numeric Truncation Error BadSource: large Set data to a number larger than Short.MAX_VALUE GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: to_byte BadSink : Convert data to a byte Flow Variant: 52 Data flow: data passed as an argument from one method to anothe...

CWE: 197 Numeric Truncation Error BadSource: large Set data to a number larger than Short.MAX_VALUE GoodSource: A hardcoded non-zero, non-min, non-max, even number BadSink: to_byte Convert data to a byte Flow Variant: 07 Control flow: if(privateFive==5) and if(privateFive!=5)

CWE: 197 Numeric Truncation Error BadSource: PropertiesFile Read data from a .properties file (in property named data) GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: to_byte BadSink : Convert data to a byte Flow Variant: 75 Data flow: data passed in a serialized objec...

CWE: 197 Numeric Truncation Error BadSource: PropertiesFile Read data from a .properties file (in property named data) GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: to_byte BadSink : Convert data to a byte Flow Variant: 72 Data flow: data passed in a Vector from one ...

CWE: 193 An array index is 1 off from the max array index Sinks: while GoodSink: restrict max index value BadSink : access array index outside array max Flow Variant: 05 Control flow: if(privateTrue) and if(privateFalse)

CWE: 193 An array index is 1 off from the max array index Sinks: do GoodSink: restrict max index value BadSink : access array index outside array max Flow Variant: 04 Control flow: if(PRIVATE_STATIC_FINAL_TRUE) and if(PRIVATE_STATIC_FINAL_FALSE)

CWE: 191 Integer Underflow BadSource: rand Set data to result of rand() GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: multiply GoodSink: Ensure there will not be an underflow before multiplying data by 2 BadSink : If data is negative, multiply by 2, which can cause a...

CWE: 191 Integer Underflow BadSource: console_readLine Read data from the console using readLine GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: multiply GoodSink: Ensure there will not be an underflow before multiplying data by 2 BadSink : If data is negative, multipl...

CWE: 191 Integer Underflow BadSource: console_readLine Read data from the console using readLine GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: sub GoodSink: Ensure there will not be an underflow before subtracting 1 from data BadSink : Subtract 1 from data, which can...

CWE: 191 Integer Underflow BadSource: getParameter_Servlet Read data from a querystring using getParameter() GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: multiply GoodSink: Ensure there will not be an underflow before multiplying data by 2 BadSink : If data is negat...

CWE: 190 Integer Overflow BadSource: max Set data to the max value for long GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: add GoodSink: Ensure there will not be an overflow before adding 1 to data BadSink : Add 1 to data, which can cause an overflow Flow Variant: 08...

CWE: 190 Integer Overflow BadSource: URLConnection Read data from a web server with URLConnection GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: multiply GoodSink: Ensure there will not be an overflow before multiplying data by 2 BadSink : If data is positive, multipl...

CWE: 190 Integer Overflow BadSource: random Set data to a random value GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: multiply GoodSink: Ensure there will not be an overflow before multiplying data by 2 BadSink : If data is positive, multiply by 2, which can cause an ...

CWE: 190 Integer Overflow BadSource: max Set data to the maximum value for int GoodSource: A hardcoded non-zero, non-min, non-max, even number Sinks: square GoodSink: Ensure there will not be an overflow before squaring data BadSink : Square data, which can lead to overflow Flow Variant: 68...