Skip to content

Conversation

@jeff-cycode
Copy link
Contributor

No description provided.

@@ -1 +1 @@
password = 'fjdkf7GG@9ikDF5!nZzzz'
password = 'fjdkf7GG@9ikDF5!nZzXz'

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cycode: Secret of type: 'Generic Password' was found.
Severity: Medium
Confidence Score: 99%

Description

A generic secret or password is an authentication token used to access a computer or application and is assigned to a password variable.

Tell us what how you wish to proceed using one of the following commands:

Tag Short Description
#cycode_secret_ignore_here Applies to this request only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

@endorlabs
Copy link

endorlabs bot commented Nov 18, 2024

Warning

Endor Labs detected 1 policy violations associated with this pull request.

Please review the findings that caused the policy violations.

📋 Policy: Critical Not Test (3 findings)

📥 Package mvn://com.endor.webapp:endor-java-webapp-demo@4.0-SNAPSHOT

⤵️ Dependency: mvn://com.mchange:c3p0@0.9.5.2
🚩 GHSA-q485-j897-qc27: XML External Entity Reference in mchange:c3p0

Details

  • Severity: Critical
  • Tags: Direct Normal Potentially Reachable Function Potentially Reachable Dependency Fix Available Blocker
  • Categories: Security Vulnerability
  • Summary: com.mchange:c3p0@0.9.5.2 has a critical vulnerability identified by GHSA-q485-j897-qc27: XML External Entity Reference in mchange:c3p0. This vulnerability was fixed in version 0.9.5.3.
    com.mchange:c3p0@0.9.5.2 is a direct dependency of com.endor.webapp:endor-java-webapp-demo@4.0-SNAPSHOT.
  • Remediation: Update com.endor.webapp:endor-java-webapp-demo@4.0-SNAPSHOT to use com.mchange:c3p0 version 0.9.5.3 (current: 0.9.5.2, latest: 0.10.1).
⤵️ Dependency: mvn://org.apache.commons:commons-text@1.9
🚩 GHSA-599f-7c49-w659: Arbitrary code execution in Apache Commons Text

Details

  • Severity: Critical
  • Tags: Direct Normal Potentially Reachable Function Potentially Reachable Dependency Fix Available Blocker
  • Categories: Security Vulnerability
  • Summary: org.apache.commons:commons-text@1.9 has a critical vulnerability identified by GHSA-599f-7c49-w659: Arbitrary code execution in Apache Commons Text. This vulnerability was fixed in version 1.10.0.
    org.apache.commons:commons-text@1.9 is a direct dependency of com.endor.webapp:endor-java-webapp-demo@4.0-SNAPSHOT.
  • Remediation: Update com.endor.webapp:endor-java-webapp-demo@4.0-SNAPSHOT to use org.apache.commons:commons-text version 1.10.0 (current: 1.9, latest: 1.12.0).
⤵️ Dependency: mvn://org.slf4j:slf4j-ext@1.7.2
🚩 GHSA-w77p-8cfg-2x43: Improper Access Control in SLF4J

Details

  • Severity: Critical
  • Tags: Transitive Normal Potentially Reachable Function Potentially Reachable Dependency Fix Available Blocker
  • Categories: Security Vulnerability
  • Summary: org.slf4j:slf4j-ext@1.7.2 has a critical vulnerability identified by GHSA-w77p-8cfg-2x43: Improper Access Control in SLF4J. This vulnerability was fixed in version 1.7.26.
    org.slf4j:slf4j-ext@1.7.2 is a transitive dependency of com.endor.webapp:endor-java-webapp-demo@4.0-SNAPSHOT via external direct dependency org.jboss.weld:weld-core@1.1.33.Final.
  • Remediation: No newer versions of org.jboss.weld:weld-core (current: 1.1.33.Final, latest: 3.0.0.Alpha6) require org.slf4j:slf4j-ext 1.7.26 or higher. Consider other options to upgrade org.slf4j:slf4j-ext to 1.7.26 (current: 1.7.2, latest: 2.1.0-alpha1).

This comment was automatically generated by Endor Labs.
Scanned @ 11-18-2024 21:57:29 UTC

@@ -1 +1 @@
password = 'fjdkf7GG@9ikDF5!nZzzz'
password = 'fjdkf7GG@9ikDF5!nZzXz'

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cycode: Secret of type: 'Generic Password' was found.
Severity: Medium
Confidence Score: 99%
SHA: a25167b495

Description

A generic secret or password is an authentication token used to access a computer or application and is assigned to a password variable.

Company Remediation Guideline

Please see http://www.espn.com for more info

Tell us what how you wish to proceed using one of the following commands:

Tag Short Description
#cycode_secret_false_positive <reason> Applies to this secret value for all repos in your organization
#cycode_secret_revoked Applies to this secret value for all repos in your organization
#cycode_secret_ignore_everywhere <reason> Applies to this secret value for all repos in your organization
#cycode_secret_ignore_here <reason> Applies to this request only

⚠️ When commenting on Github, you may need to refresh the page to see the latest updates.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants