vxunderground / MalwareSourceCode

1. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /Libs/DDoS/VirTool.DDoS.CHARGEN.c:139 100%
2. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /Libs/DDoS/VirTool.DDoS.DNS.c:230 100%
3. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /Libs/DDoS/VirTool.DDoS.GHP.c:243 100%
4. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /Libs/DDoS/VirTool.DDoS.QUAKE3.c:149 100%
5. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /Libs/DDoS/VirTool.DDoS.RUDY.c:294 100%
6. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1822 100%
7. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1634 100%
8. high Semgrep The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. /Libs/DDoS/VirTool.DDoS.ARME.c:341 100%
9. high Semgrep AWS Secret Access Key detected /Python/Trojan-Ransom.Python.Redkeeper.a:20 99%
10. high Semgrep The `strchr` function returns NULL on error and this line dereferences the return value without checking for NULL. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1785 99%
11. high Semgrep The `strchr` function returns NULL on error and this line dereferences the return value without checking for NULL. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1623 99%
12. high Semgrep The `strchr` function returns NULL on error and this line dereferences the return value without checking for NULL. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1478 99%
13. high Semgrep AWS Access Key ID Value detected. This is a sensitive credential and should not be hardcoded here. Instead, read this value from an environment variable or keep it in a separate, private file. /Python/Trojan-Ransom.Python.Redkeeper.a:19 72%
14. medium Semgrep Externally controlled data is used to index a fixed-size array, `lin`. This could lead to an out-of-bounds read or write, triggering memory corruption. /Win32/InternetWorm/I-Worm.PieceByPiece.c:504 100%
15. medium Semgrep Externally controlled data is used to index a fixed-size array, `lin`. This could lead to an out-of-bounds read or write, triggering memory corruption. /Win32/InternetWorm/I-Worm.PieceByPiece.c:498 100%
16. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1695 100%
17. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1687 100%
18. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1890 100%
19. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1899 100%
20. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1349 100%
21. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1366 100%
22. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1455 100%
23. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1461 100%
24. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1483 100%
25. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1489 100%
26. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1525 100%
27. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1533 100%
28. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1699 100%
29. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1708 100%
30. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1102 100%
31. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1112 100%
32. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1320 100%
33. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1333 100%
34. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1362 100%
35. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1370 100%
36. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1395 100%
37. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1401 100%
38. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1423 100%
39. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1431 100%
40. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1602 100%
41. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1611 100%
42. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Win32/InternetWorm/Worm.Win32.Warskype.c:83 100%
43. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Win32/InternetWorm/Worm.Win32.Warskype.c:84 100%
44. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1651 100%
45. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.ARME.c:353 100%
46. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.ARME.c:364 100%
47. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.ARME.c:367 100%
48. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.ARME.c:369 100%
49. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.ARME.c:380 100%
50. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.ARME.c:383 100%
51. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.ARME.c:385 100%
52. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.GHP.c:255 100%
53. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.GHP.c:266 100%
54. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.GHP.c:269 100%
55. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.GHP.c:271 100%
56. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.GHP.c:282 100%
57. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.GHP.c:285 100%
58. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.RUDY.c:306 100%
59. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.GHP.c:287 100%
60. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1645 100%
61. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1623 100%
62. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1617 100%
63. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1528 100%
64. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1511 100%
65. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.RUDY.c:338 100%
66. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.RUDY.c:336 100%
67. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.RUDY.c:333 100%
68. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.RUDY.c:322 100%
69. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.RUDY.c:320 100%
70. medium Semgrep Avoid using 'strtok()'. This function directly modifies the first argument buffer, permanently erasing the delimiter character. Use 'strtok_r()' instead. /Libs/DDoS/VirTool.DDoS.RUDY.c:317 100%
71. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.RUDY.c:316 100%
72. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.RUDY.c:332 100%
73. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.QUAKE3.c:175 100%
74. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.RUDY.c:893 100%
75. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.SACK.c:183 100%
76. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.SSYN.a.c:185 100%
77. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.SSYN.b.c:170 100%
78. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.STCP.c:189 100%
79. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.SUDP.c:161 100%
80. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.SUDP.c:166 100%
81. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.TELNET.c:139 100%
82. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.VSE.c:143 100%
83. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.XACK.c:183 100%
84. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.XSYN.c:183 100%
85. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.ZAP.c:187 100%
86. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.QUAKE3.c:179 100%
87. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.RUDY.c:302 100%
88. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.ACK.c:164 100%
89. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.ARME.c:349 100%
90. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.ARME.c:363 100%
91. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.ARME.c:379 100%
92. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.CHARGEN.c:165 100%
93. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.CHARGEN.c:170 100%
94. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.ESSYN-ACK.c:169 100%
95. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.ESSYN.c:185 100%
96. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.GHP.c:251 100%
97. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.GHP.c:265 100%
98. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.GHP.c:281 100%
99. medium Semgrep Externally controlled data influences the size of an allocation. This can usually lead to overflow or underflow and later trigger an out of bounds conditions. /Libs/DDoS/VirTool.DDoS.DOMINATE.c:167 100%
100. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `request`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1199 100%
101. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `cmdstr`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Win32/Win32.Blaster.cpp:1021 100%
102. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `cmdstr`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Win32/Win32.Blaster.cpp:1017 100%
103. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `cmdstr`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Win32/Win32.Blaster.cpp:995 100%
104. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `myhostname`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Win32/Win32.Blaster.cpp:252 100%
105. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `msg_cmd`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Win32/InternetWorm/Worm.Win32.Warskype.c:86 100%
106. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `msg`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Win32/InternetWorm/Worm.Win32.Warskype.c:43 100%
107. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `tempfile`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /MSDOS/V-Index/Virus.MSDOS.Unknown.vlp1.c:314 100%
108. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `request`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1179 100%
109. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `CleanDevice`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:938 100%
110. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `request`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1178 100%
111. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `request`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1158 100%
112. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `request`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1340 100%
113. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `request`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1320 100%
114. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `parseError`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Libs/DDoS/VirTool.DDoS.RUDY.c:1016 100%
115. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `parseError`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Libs/DDoS/VirTool.DDoS.GHP.c:493 100%
116. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `parseError`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Libs/DDoS/VirTool.DDoS.ARME.c:588 100%
117. medium Semgrep The function `sprintf` does not impose any size limitation to what it writes to `request`. That may lead to a stack buffer overflow if there is no validation on the size of the input. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1159 100%
118. medium Semgrep Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information. /Java/Virus.Java.Cheshire.a/src/main/java/SelfExamine.java:79 99%
119. medium Semgrep Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information. /Java/Virus.Java.Cheshire.a/src/main/java/SelfExamine.java:1451 99%
120. medium Semgrep Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information. /Java/Virus.Java.Cheshire.a/src/main/java/SelfExamine.java:751 99%
121. medium Semgrep Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information. /Java/Virus.Java.Cheshire.a/src/main/java/SelfExamine.java:715 99%
122. medium Semgrep Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information. /Java/Virus.Java.Cheshire.a/src/main/java/SelfExamine.java:476 99%
123. medium Semgrep Possible active debug code detected. Deploying an application with debug code can create unintended entry points or expose sensitive information. /Java/Virus.Java.Cheshire.a/src/main/java/SelfExamine.java:171 99%
124. medium Semgrep Detected a network listener listening on 0.0.0.0 or an empty string. This could unexpectedly expose the server publicly as it binds to all available interfaces. Instead, specify another IP address that is not 0.0.0.0 nor the empty string. /Linux/Linux.BotenaGo.go:2840 77%
125. medium Semgrep Do not use `math/rand`. Use `crypto/rand` instead. /Linux/Linux.BotenaGo.go:13 39%
126. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:373 99%
127. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Linux.RedMenshenBPFDoor.c:683 99%
128. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Trojans/Trojan.Linux.TrojoDaemon.c:84 99%
129. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1506 99%
130. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1505 99%
131. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1504 99%
132. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1503 99%
133. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1502 99%
134. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1501 99%
135. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1500 99%
136. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1499 99%
137. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1498 99%
138. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1497 99%
139. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1496 99%
140. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1495 99%
141. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1494 99%
142. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.yakuza.c:1226 99%
143. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1814 99%
144. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Backdoors/Backdoor.Linux.ShadyShell.c:22 99%
145. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Linux.RedMenshenBPFDoor.c:688 99%
146. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:371 99%
147. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1803 99%
148. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1804 99%
149. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1805 99%
150. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1806 99%
151. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1807 99%
152. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1808 99%
153. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1809 99%
154. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1810 99%
155. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1811 99%
156. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1812 99%
157. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1813 99%
158. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1815 99%
159. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Linux.RedMenshenBPFDoor.c:425 98%
160. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Linux.RedMenshenBPFDoor.c:756 98%
161. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Linux.RedMenshenBPFDoor.c:758 98%
162. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:365 98%
163. low Semgrep Don't call `system`. It's a high-level wrapper that allows for stacking multiple commands. Always prefer a more restrictive API such as calling `execve` from the `exec` family. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:376 98%
164. low Semgrep This call to `memset` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `linebuf` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared. /Linux/Mirai-Family/Mirai.Linux.Eragon2.0.c:1738 97%
165. low Semgrep This call to `memset` may be optimized out by the compiler because the buffer is not accessed later in the function. This could be an issue if `linebuf` contains sensitive data, such as passwords or cryptographic keys. Applications should use functions such as `memset_s` or `memset_explicit` to ensure that the sensitive data is cleared. /Linux/Mirai-Family/Mirai.Linux.eragon.c:1576 97%

No findings match these filters. Clear filters