Vulnerabilities Atlas

Unsanitized user content executes in browser context and can steal sessions or perform actions as the victim.

Endpoints fail to enforce ownership or role checks, allowing privilege escalation and unauthorized data access.

Application fetch features can be abused to reach internal services and cloud metadata endpoints.

Deserializing attacker-controlled objects can trigger unintended code paths and remote code execution.

User-supplied paths are not normalized, letting attackers read files outside intended directories.

Insecure defaults, verbose errors, and missing hardening settings expose attack surface and sensitive information.

Untrusted, outdated, or compromised dependencies introduce exploitable vulnerabilities into the application.

Weak algorithms, bad key management, or improper encryption handling can expose sensitive data.

Weak authentication controls allow attackers to impersonate users and take over accounts.

Insufficient logging and alerting reduce visibility, delaying detection and response to attacks.

Untrusted input reaches interpreters without proper validation or encoding, enabling command or query manipulation.

Lack of integrity verification for software updates or data flows enables tampering and malicious changes.

Unsanitized input in LDAP queries allows attackers to manipulate directory lookups and bypass authentication.

User input passed to system commands without sanitization allows arbitrary command execution on the server.

Direct references to internal objects without access checks let attackers access unauthorized resources.

Unvalidated redirect URLs allow attackers to send users to malicious sites, enabling phishing attacks.

Missing frame-busting protections allow attackers to overlay invisible UI elements and trick users into unintended actions.

Incorrect assumptions about application workflows allow attackers to exploit processes for unintended outcomes.

Injecting carriage return and line feed characters into headers allows response splitting and header manipulation.

Concurrent execution of critical operations without proper synchronization leads to unexpected or insecure states.

Sessions that do not expire or lack proper timeout controls increase the window for session hijacking.

Unvalidated XML input allows attackers to alter document structure, potentially leading to data exposure or code execution.

Untrusted input reaches a code-generation or evaluation mechanism, allowing an attacker to execute instructions in the application's runtime.

Ambiguous HTTP headers between front-end and back-end servers allow attackers to desynchronize connections and intercept responses.

Manipulating JavaScript object prototypes through crafted input affects all objects inheriting from the polluted prototype.

Maliciously crafted input triggers catastrophic backtracking in vulnerable regex patterns, exhausting CPU resources.

Rapid DNS record changes allow attacker-controlled domains to resolve to internal IPs, bypassing same-origin policy.

Manipulating cache key inputs causes servers to store and serve malicious responses to other users.

Missing origin validation, lack of encryption, and improper message handling in WebSocket connections enable interception and injection.

Complex GraphQL queries bypass authorization, enable depth-based DoS, or extract sensitive data through introspection.

Weak JWT validation, algorithm confusion, or exposed secrets allow attackers to forge tokens and impersonate users.

Dangling DNS records pointing to unclaimed cloud resources allow attackers to register those resources and serve malicious content.

Use of predictable or non-cryptographic random number generators for security-sensitive operations enables guessing and replay attacks.

Automatic binding of user input to internal model properties allows attackers to modify fields they should not control.

Overly permissive CORS policies allow unauthorized cross-origin requests, enabling data theft from authenticated sessions.

Unsanitized input in email headers allows attackers to inject additional recipients, modify subjects, or append message bodies.

IoT devices expose web-based management interfaces with weak authentication, default credentials, or XSS vulnerabilities that allow remote device takeover.

IoT firmware contains hardcoded usernames, passwords, API keys, or cryptographic keys that are identical across all shipped devices.

IoT devices run network services (Telnet, FTP, UPnP, MQTT) with no authentication or encryption, exposing device control and data to attackers on the local network.

Firmware updates are delivered over unencrypted HTTP, lack digital signature verification, or accept unsigned images, allowing attackers to push malicious firmware to devices.

IoT devices, mobile apps, and cloud backends communicate over unencrypted channels, exposing API keys, telemetry, and device commands to interception and manipulation.

A kiosk application restricted to a single purpose can be escaped through UI manipulation, keyboard shortcuts, help dialogs, file pickers, or browser address bar access, exposing the underlying OS or unauthorized applications.

IoT devices and kiosks store sensitive data such as credentials, session tokens, or personal information in cleartext on the device filesystem or unprotected databases.

Unrestricted USB, Bluetooth, or NFC interfaces on kiosk devices allow attackers to inject malicious input, mount bootable drives, or exfiltrate data from the system.

Lack of centralized device management, missing audit logging, and inability to remotely revoke compromised device credentials leave IoT fleets unmonitored and unresponsive to security incidents.

CI/CD pipelines store credentials, API keys, or secrets in plaintext environment variables, pipeline configuration files, or build logs, enabling attackers with pipeline access to exfiltrate production credentials.

Terraform, CloudFormation, or Kubernetes manifests deploy resources with overly permissive security groups, missing encryption, public access, or privileged containers due to unvalidated IaC templates.

Kubernetes pods run with privileged security context, hostNetwork, or root user, enabling container escape, host compromise, and lateral movement across the cluster.

Kubernetes service accounts or users have overly permissive RBAC roles granting cluster-admin, wildcard permissions, or access to secrets across namespaces, enabling privilege escalation.

Container runtime vulnerabilities, misconfigured capabilities, or kernel exploits allow attackers to break out of container isolation and gain access to the host system.

Build artifacts (container images, binaries, packages) lack integrity verification or signing, allowing attackers to inject malicious code during build, storage, or distribution.

Cloud storage buckets (S3, Azure Blob, GCS) are misconfigured with public read or write access, exposing sensitive data, backups, or configuration files to unauthorized access.

Cloud IAM policies grant wildcard (*) actions or resources, providing excessive permissions that enable privilege escalation, unauthorized data access, or resource manipulation.

Cloud workloads store API keys, database credentials, or secrets in plaintext environment variables or configuration files, exposing credentials to unauthorized access through container inspection or logs.

Cloud VPCs have overly permissive security groups, public subnets for workloads, missing network ACLs, or exposed management interfaces, enabling unauthorized network access.

Cloud audit logging (CloudTrail, Activity Log, Audit Logs) is disabled or not forwarded to centralized storage, preventing detection of unauthorized access, privilege escalation, or security incidents.

Cloud cross-account IAM trust policies grant excessive permissions to external accounts, enabling unauthorized access, data exfiltration, or privilege escalation across organizational boundaries.

Cross-site request forgery tokens are predictable, missing, or not validated server-side, allowing attackers to forge authenticated requests on behalf of users.

Applications trust the HTTP Host header without validation, enabling cache poisoning, password reset poisoning, and open redirect attacks.

Links opened with target=_blank without rel=noopener allow the new page to redirect the original tab to a phishing site via window.opener.

Unsanitized user input reflected in error messages or page content allows attackers to craft misleading content that deceives users into performing unintended actions.

User input containing CRLF sequences is injected into HTTP response headers, enabling response splitting, cache poisoning, and cross-site scripting.

API endpoints automatically bind client-supplied parameters to internal object properties, allowing attackers to modify privileged fields such as role or account status.

API endpoints fail to verify that the authenticated user has permission to invoke a specific function or administrative action, enabling privilege escalation.

API responses return full data objects relying on the client to filter sensitive fields, exposing internal data such as PII, tokens, or system metadata.

Attacker-controlled input merges into server-side JavaScript objects, polluting Object.prototype to alter application logic, bypass auth checks, or achieve remote code execution.

Supplying duplicate HTTP parameters causes unpredictable backend behavior, allowing attackers to bypass input validation, trigger errors, or manipulate application logic.

IoT devices ship with well-known default usernames and passwords that are never forced to change, allowing attackers to remotely authenticate and control devices at scale.

IoT devices do not verify firmware integrity during boot, allowing attackers with physical access to flash modified firmware and gain persistent control of the device.

IoT devices transmit sensitive telemetry, credentials, or commands over unencrypted or weakly encrypted channels, enabling man-in-the-middle interception and replay attacks.

IoT devices expose debug interfaces such as JTAG, UART, or SWD without protection, allowing attackers with physical access to extract firmware, credentials, or gain shell access.

Kiosk browsers expose or fail to properly restrict the address bar, allowing users to navigate to arbitrary URLs, access local files, or launch external applications.

Kiosk applications fail to reset or clear user sessions after inactivity, allowing the next user to access the previous user's authenticated session or sensitive data.

Kiosk systems accept input from unauthorized peripherals such as keyboards, barcode scanners, or USB HID devices, enabling attackers to inject commands or bypass application restrictions.

CI/CD pipelines triggered by webhooks fail to validate payload signatures, allowing attackers to inject malicious parameters or trigger builds with attacker-controlled code references.

CI/CD build agents run with excessive privileges, shared workspaces, or persistent state between jobs, enabling cross-pipeline credential leakage and build environment poisoning.

Misconfigured or missing Kubernetes admission controllers allow deployment of privileged pods, host-mounted volumes, or containers from untrusted registries without policy enforcement.

The Docker daemon socket is mounted into containers or exposed over TCP without authentication, allowing any process with access to create privileged containers and escape to the host.

Helm charts from untrusted repositories contain malicious templates, post-install hooks, or overly permissive RBAC rules that execute arbitrary code or escalate privileges upon deployment.

Serverless functions incorporate untrusted input into runtime code evaluation or system commands, enabling remote code execution within the cloud function execution environment.

Cloud instances using IMDSv1 allow unauthenticated HTTP requests to the metadata endpoint, enabling SSRF-based extraction of IAM credentials and instance identity documents.

Attackers compromise or assume cloud service-linked roles through misconfigured trust policies, gaining unauthorized control over managed services and their associated resources.

Cloud functions are triggered by publicly accessible endpoints or unauthenticated event sources, allowing attackers to invoke functions, exhaust quotas, or trigger unintended downstream actions.

Insufficient logical isolation between tenants in shared cloud infrastructure allows one tenant to access another tenant's data, compute resources, or network traffic.

Application returns detailed error messages that reveal internal implementation details, stack traces, or sensitive configuration information.

HTTP responses lack recommended security headers such as X-Content-Type-Options, X-Frame-Options, or Referrer-Policy.

Password policy allows weak passwords that don't meet minimum complexity requirements, increasing brute force risk.

Cookies lack Secure, HttpOnly, or SameSite attributes, potentially exposing session tokens to interception or XSS.

Application uses outdated dependencies with known vulnerabilities that have available patches but haven't been updated.

User input is embedded into server-side templates without proper sanitization, allowing execution of arbitrary template expressions and potentially remote code execution.

XML parsers process external entity references in user-supplied XML, enabling file disclosure, SSRF, or denial of service through entity expansion.

Untrusted input is interpreted as a server-side include directive, allowing file disclosure or command execution on vulnerable servers.

Attacker-controlled spreadsheet cells begin with formula operators and execute dangerous functions when exported data is opened in a spreadsheet application.

A crafted URL causes a shared cache to store a personalized response as a public static resource, exposing sensitive content to other users.

Attackers steal or predict session identifiers through XSS, network sniffing, or session fixation, gaining unauthorized access to authenticated user sessions.

Attackers exploit vulnerabilities to gain higher privileges than intended, such as escalating from regular user to administrator or accessing restricted system resources.

A resource changes between a security check and its later use, allowing an attacker to invalidate the assumption established by the check.

Password reset flows use guessable tokens, weak identity verification, or unsafe delivery and disclosure patterns that enable account takeover.

Application fails to properly validate TLS/SSL certificates, accepting self-signed, expired, or mismatched certificates, enabling man-in-the-middle attacks.

Files are accepted without type, content, or size validation, allowing web shells or malware to be uploaded and executed.

Client-side JavaScript writes attacker-controlled data from the URL or storage into dangerous sinks like innerHTML.

APIs expose or accept object properties the caller should not read or modify, such as internal flags or other users' data.

Missing limits on request rate, payload size, pagination, or costly operations let attackers exhaust resources or run up costs.

Deprecated, debug, or undocumented API versions remain reachable without the security controls applied to current versions.

Data from integrated third-party APIs is trusted without validation, letting a compromised provider inject malicious content.

Privileged API keys are embedded in mobile apps or frontend bundles where anyone can extract and abuse them.

Passwords, tokens, or personal data are written to application logs that have broader access and longer retention than the source data.

Credentials or personal data travel over HTTP or unencrypted internal channels where they can be intercepted.

Encryption or signing keys are embedded in source code or binaries, so anyone with the code can decrypt data or forge tokens.

Passwords are stored with fast or unsalted hashes like MD5 or SHA-1, making offline cracking of leaked hashes practical.

The application keeps the same session ID after login, letting an attacker who planted the ID hijack the authenticated session.

Loose redirect URI matching lets attackers receive authorization codes or tokens at a domain they control.

Multi-factor checks can be skipped through alternate login flows, response manipulation, or unprotected recovery endpoints.

Build tools resolve internal package names from public registries, installing attacker-published packages with malicious install scripts.

Pipelines reference third-party actions by mutable tags, so a compromised upstream tag can run malicious code with pipeline secrets.

Disk or database snapshots are shared publicly or with unknown accounts, exposing full copies of production data.

Browser history, form data, cookies, or downloaded files from one kiosk user remain available to the next user.

Untrusted input reaches document-database queries as operators such as $ne, $gt, or $where, letting attackers bypass login checks or read other users' records.

User input is concatenated into XPath expressions, allowing attackers to change query logic and read or authenticate against XML data they should not reach.

Values written to logs without neutralising newlines or control characters let attackers forge entries, hide activity, or attack the tools used to view logs.

User input passed as arguments to programs such as git, curl, or tar can add options like --output or --upload-pack that change what the program does, even without a shell.

Archive entries with names like ../../app/config.js are extracted outside the target folder, overwriting application files or planting code.

A .git or .svn directory deployed to the web root lets attackers download source code, commit history, and any secrets committed along the way.

Debug consoles or management endpoints, such as framework actuators or heap dumps, are reachable in production and leak secrets or allow remote control.

Login, OTP, or password reset endpoints accept unlimited attempts, so attackers can brute force passwords and short codes.

Different error messages, status codes, or response times for valid and invalid usernames reveal which accounts exist, feeding targeted attacks.

Databases, backups, or file stores holding sensitive data are not encrypted, so stolen disks, snapshots, or backups expose the data directly.

Memory-unsafe parsing code in firmware writes past buffer boundaries when handling crafted packets or files, enabling crashes or remote code execution.