Checking analysis of application java-sec-code against 4 build rules.

Using sl version 0.9.1564 (71e48e2df4ba9b1475e0c5109dcc0f6b89c39c62).

Checking findings on scan 16.

Results per rule:

• No critical or high SAST findings: FAIL
  (76 matched vulnerabilities; configured threshold is 0).

  First 5 findings:

  ID	CVSS	Rating	Title
  547	9.0	critical	Directory Traversal: Attacker-controlled Data as File Path via file in FileUpload.singleFileUpload
  548	9.0	critical	Directory Traversal: Attacker-controlled Data as File Path via multifile in FileUpload.uploadPicture
  549	9.0	critical	Directory Traversal: Attacker-controlled Data as File Path via multifile in FileUpload.uploadPicture
  550	9.0	critical	Directory Traversal: Attacker-controlled Data as File Path via filepath in PathTraversal.getImage
  551	9.0	critical	Directory Traversal: Attacker-controlled Data as File Path via filepath in PathTraversal.getImageSec

  Severity rating	Count
  Critical	35
  High	41
  Medium	0
  Low	0

  Category	Count
  Server-Side Request Forgery	21
  XML External Entities	13
  Remote Code Execution	9
  Directory Traversal	9
  Cross-Site Scripting	8
  Sensitive Data Leak	6
  SQL Injection	5
  Deserialization	5

  OWASP 2021 Category	Count
  A03-Injection	22
  A10-Server-Side-Request-Forgery-(Ssrf)	21
  A01-Broken-Access-Control	15
  A05-Security-Misconfiguration	13
  A08-Software-And-Data-Integrity-Failures	5

• Allow 0 secrets: FAIL
  (1 matched vulnerability; configured threshold is 0).

  Finding:

  ID	CVSS	Rating	Title
  597	0.0	none	Hardcoded Sensitive Secrets/Credentials in Config

  Severity rating	Count
  Critical	0
  High	0
  Medium	0
  Low	0

  Category	Count
  User	1
  Password	1
  Secret	1

• No reachable SCA findings: FAIL
  (57 matched vulnerabilities; configured threshold is 0).

  First 10 findings:

  ID	CVSS	Rating	CVE	Title
  247	10.0	critical	CVE-2021-44228	Log4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser.
  35	9.8	critical	CVE-2020-1938	When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as havi…
  47	9.8	critical	CVE-2018-8014	The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecur…
  65	9.8	critical	CVE-2017-5651	The refactoring of the HTTP connectors introduced a regression in the send file processing. If the file processing completed quickly, it is possible for …
  217	9.8	critical	CVE-2017-18349	parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code vi…
  225	9.8	critical	CVE-2020-10683	dom4j before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentatio…
  375	9.8	critical	CVE-2019-10173	It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not…
  415	9.8	critical	CVE-2020-10683	dom4j before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentatio…
  416	9.8	critical	CVE-2022-23640	Prior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues.
  61	9.1	critical	CVE-2017-5648	Some calls to application listeners in Apache Tomcat did not use the appropriate facade object. When running an untrusted application under a SecurityMan…

  Severity rating	Count
  Critical	12
  High	45
  Medium	0
  Low	0

• No critical or high container findings: pass
  (0 matched vulnerabilities; configured threshold is 0).

3 rules failed.