MS

Omitting a break statement so that one may fall through is often indistinguishable from an error, and therefore should not be used. (from TCCLASP-5_6_15_10)

Tainted input allows arbitrary files to be read and written.

Tainted input allows arbitrary files to be read and written. (fixed version)

Two file operations are performed on a filename, allowing a filename race condition to occur.

The credentials for connecting to the database are hard-wired into the sourcecode.

An exception leaks internal path information to the user.

An exception leaks internal path information to the user. (fixed version)

Tainted output allows log entries to be forged.

Tainted output allows log entries to be forged. (fixed version)

Tainted output allows log entries to be forged.