toolcodeseverityconfidencefunctionfilelinepositionmessage
semgreppython.flask.security.injection.nan-injection.nan-injectionERRORMEDIUMunknownproyecto/app.py6021Found user input going directly into typecast for bool(), float(), or complex(). This allows an attacker to inject Python's not-a-number (NaN) into the typecast. This results in undefind behavior, particularly when doing comparisons. Either cast to a different type, or add a guard checking for all capitalizations of the string 'nan'.
semgreppython.flask.security.audit.debug-enabled.debug-enabledWARNINGHIGHunknownproyecto/app.py1365Detected Flask app with debug=True. Do not deploy to production with this flag enabled as it will leak sensitive information. Instead, consider using Flask configuration variables or setting 'debug' using system environment variables.
semgreppython.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-queryERRORLOWunknownproyecto/classes/account_manager.py3813Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
semgreppython.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-queryERRORLOWunknownproyecto/classes/account_manager.py5417Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
semgreppython.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-queryERRORLOWunknownproyecto/classes/account_manager.py6017Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
semgreppython.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-queryERRORLOWunknownproyecto/classes/account_manager.py7517Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition, use SQL Expression Language or Schema Definition Language. In most cases, SQLAlchemy ORM will be a better option.
semgreppython.lang.security.audit.subprocess-shell-true.subprocess-shell-trueERRORMEDIUMunknownproyecto/myenv/Lib/site-packages/click/_termui_impl.py41437Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
semgreppython.lang.security.audit.subprocess-shell-true.subprocess-shell-trueERRORMEDIUMunknownproyecto/myenv/Lib/site-packages/click/_termui_impl.py51479Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
semgreppython.lang.security.audit.eval-detected.eval-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/flask/cli.py100513Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
semgreppython.lang.security.audit.exec-detected.exec-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/flask/config.py21217Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/flask/json/tag.py18816Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1WARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/flask/sessions.py28512Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
semgreppython.lang.security.audit.non-literal-import.non-literal-importWARNINGLOWunknownproyecto/myenv/Lib/site-packages/importlib_metadata/__init__.py18318Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.
semgrepgeneric.secrets.security.detected-jwt-token.detected-jwt-tokenERRORLOWunknownproyecto/myenv/Lib/site-packages/itsdangerous-2.2.0.dist-info/METADATA443JWT token detected
semgreppython.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1WARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/itsdangerous/signer.py4512Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
semgreppython.lang.security.deserialization.pickle.avoid-pickleWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/bccache.py417Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.
semgreppython.lang.security.deserialization.pickle.avoid-pickleWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/bccache.py427Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.
semgreppython.lang.security.deserialization.pickle.avoid-pickleWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/bccache.py7320Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.
semgreppython.lang.security.audit.marshal.marshal-usageWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/bccache.py7925The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security
semgreppython.lang.security.deserialization.pickle.avoid-pickleWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/bccache.py899Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.
semgreppython.lang.security.audit.marshal.marshal-usageWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/bccache.py909The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security
semgreppython.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1WARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/jinja2/bccache.py15616Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
semgreppython.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1WARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/jinja2/bccache.py16516Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
semgreppython.lang.security.audit.exec-detected.exec-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/debug.py1459Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
semgreppython.lang.security.audit.exec-detected.exec-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/environment.py12259Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
semgreppython.django.security.audit.xss.html-magic-method.html-magic-methodWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/environment.py15465The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/environment.py154716Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/ext.py17618Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/ext.py19718Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/ext.py21318Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/ext.py23818Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.django.security.audit.xss.html-magic-method.html-magic-methodWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/filters.py399The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/filters.py31514Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/filters.py80714Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/filters.py83821Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/filters.py104312Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/filters.py136412Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.lang.security.audit.non-literal-import.non-literal-importWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/loaders.py2949Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.
semgreppython.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1WARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/jinja2/loaders.py63526Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/nodes.py61920Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/nodes.py109116Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/nodes.py111220Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/runtime.py37520Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/runtime.py38720Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/runtime.py77420Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/runtime.py78518Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.django.security.audit.xss.html-magic-method.html-magic-methodWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/runtime.py9825The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/utils.py39212Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/jinja2/utils.py65712Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.django.security.audit.xss.html-magic-method.html-magic-methodWARNINGLOWunknownproyecto/myenv/Lib/site-packages/markupsafe/__init__.py109The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.
semgreppython.django.security.audit.xss.html-magic-method.html-magic-methodWARNINGLOWunknownproyecto/myenv/Lib/site-packages/markupsafe/__init__.py785The `__html__` method indicates to the Django template engine that the value is 'safe' for rendering. This means that normal HTML escaping will not be applied to the return value. This exposes your application to cross-site scripting (XSS) vulnerabilities. If you need to render raw HTML, consider instead using `mark_safe()` which more clearly marks the intent to render raw HTML than a class with a magic method.
semgreppython.flask.security.xss.audit.explicit-unescape-with-markup.explicit-unescape-with-markupWARNINGLOWunknownproyecto/myenv/Lib/site-packages/markupsafe/__init__.py19716Detected explicitly unescaped content using 'Markup()'. This permits the unescaped data to include unescaped HTML which could result in cross-site scripting. Ensure this data is not externally controlled, or consider rewriting to not use 'Markup()'.
semgreppython.lang.security.audit.non-literal-import.non-literal-importWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_internal/commands/__init__.py9414Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.
semgreppython.lang.security.use-defused-xmlrpc.use-defused-xmlrpcERRORLOWunknownproyecto/myenv/Lib/site-packages/pip/_internal/commands/search.py51Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead.
semgreppython.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosureWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_internal/network/auth.py5213Detected a python logger call with a potential hardcoded secret "Getting credentials from keyring for %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.
semgreppython.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosureWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_internal/network/auth.py5913Detected a python logger call with a potential hardcoded secret "Getting password from keyring for %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.
semgreppython.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosureWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_internal/network/auth.py12413Detected a python logger call with a potential hardcoded secret "Found credentials in url for %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.
semgreppython.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosureWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_internal/network/auth.py14017Detected a python logger call with a potential hardcoded secret "Found credentials in index url for %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.
semgreppython.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosureWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_internal/network/auth.py14717Detected a python logger call with a potential hardcoded secret "Found credentials in netrc for %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.
semgreppython.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosureWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_internal/network/auth.py16017Detected a python logger call with a potential hardcoded secret "Found credentials in keyring for %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.
semgreppython.lang.security.audit.logging.logger-credential-leak.python-logger-credential-disclosureWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_internal/network/auth.py29813Detected a python logger call with a potential hardcoded secret "401 Error, Credentials not correct for %s" being logged. This may lead to secret credentials being exposed. Make sure that the logger is not logging sensitive information.
semgreppython.django.security.audit.unvalidated-password.unvalidated-passwordWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_internal/network/auth.py31417The password on 'keyring' is being set without validating the password. Call django.contrib.auth.password_validation.validate_password() with validation functions before setting the password. See https://docs.djangoproject.com/en/3.0/topics/auth/passwords/ for more information.
semgreppython.lang.security.use-defused-xmlrpc.use-defused-xmlrpcERRORLOWunknownproyecto/myenv/Lib/site-packages/pip/_internal/network/xmlrpc.py61Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead.
semgreppython.lang.security.use-defused-xmlrpc.use-defused-xmlrpcERRORLOWunknownproyecto/myenv/Lib/site-packages/pip/_internal/network/xmlrpc.py145Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead.
semgreppython.lang.security.audit.insecure-file-permissions.insecure-file-permissionsWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_internal/utils/unpacking.py985These permissions `$BITS` are widely permissive and grant access to more people than may be necessary. A good default is `0o644` which gives read and write access to yourself and read access to everyone else.
semgreppython.lang.security.audit.insecure-transport.requests.request-session-with-http.request-session-with-httpINFOMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_vendor/cachecontrol/_cmd.py2316Detected a request using 'http://'. This request will be unencrypted. Use 'https://' instead.
semgreppython.lang.security.deserialization.pickle.avoid-pickleWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/cachecontrol/serialize.py15022Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.
semgreppython.lang.security.use-defused-xmlrpc.use-defused-xmlrpcERRORLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/distlib/compat.py435Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead.
semgreppython.lang.security.use-defused-xmlrpc.use-defused-xmlrpcERRORLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/distlib/compat.py835Detected use of xmlrpc. xmlrpc is not inherently safe from vulnerabilities. Use defusedxml.xmlrpc instead.
semgreppython.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecatedWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_vendor/distlib/util.py143729'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket.
semgreppython.lang.security.audit.httpsconnection-detected.httpsconnection-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/distlib/util.py156346The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information.
semgreppython.lang.security.audit.non-literal-import.non-literal-importWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/pep517/in_process/_in_process.py8915Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.
semgreppython.lang.security.dangerous-globals-use.dangerous-globals-useWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/pep517/in_process/_in_process.py32512Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
semgreppython.lang.security.dangerous-globals-use.dangerous-globals-useWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/pkg_resources/__init__.py14620Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
semgreppython.lang.security.dangerous-globals-use.dangerous-globals-useWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/pkg_resources/__init__.py14636Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
semgreppython.lang.security.dangerous-globals-use.dangerous-globals-useWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/pkg_resources/__init__.py1539Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
semgreppython.lang.security.dangerous-globals-use.dangerous-globals-useWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/pkg_resources/__init__.py15341Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
semgreppython.lang.security.audit.exec-detected.exec-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/pkg_resources/__init__.py146213Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
semgreppython.lang.security.audit.exec-detected.exec-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/pkg_resources/__init__.py146913Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
semgreppython.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1WARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_vendor/requests/auth.py15424Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
semgreppython.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1WARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_vendor/requests/auth.py19819Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
semgreppython.lang.security.audit.weak-ssl-version.weak-ssl-versionWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py905An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.
semgreppython.lang.security.audit.weak-ssl-version.weak-ssl-versionWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py9423An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.
semgreppython.lang.security.audit.weak-ssl-version.weak-ssl-versionWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py9723An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.
semgreppython.lang.security.audit.weak-ssl-version.weak-ssl-versionWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_vendor/urllib3/contrib/securetransport.py16326An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.
semgreppython.lang.security.audit.weak-ssl-version.weak-ssl-versionWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_vendor/urllib3/contrib/securetransport.py16826An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.
semgreppython.lang.security.audit.weak-ssl-version.weak-ssl-versionWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_vendor/urllib3/contrib/securetransport.py17326An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.
semgreppython.lang.security.audit.weak-ssl-version.weak-ssl-versionWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_vendor/urllib3/contrib/securetransport.py17826An insecure SSL version was detected. TLS versions 1.0, 1.1, and all SSL versions are considered weak encryption and are deprecated. Use 'ssl.PROTOCOL_TLSv1_2' or higher.
semgreppython.lang.security.audit.ssl-wrap-socket-is-deprecated.ssl-wrap-socket-is-deprecatedWARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/pip/_vendor/urllib3/util/ssl_.py17920'ssl.wrap_socket()' is deprecated. This function creates an insecure socket without server name indication or hostname matching. Instead, create an SSL context using 'ssl.SSLContext()' and use that to wrap a socket.
semgreppython.lang.security.audit.insecure-transport.ssl.no-set-ciphers.no-set-ciphersWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/urllib3/util/ssl_.py2925The 'ssl' module disables insecure cipher suites by default. Therefore, use of 'set_ciphers()' should only be used when you have very specialized requirements. Otherwise, you risk lowering the security of the SSL channel.
semgreppython.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pip/_vendor/webencodings/mklabels.py4736Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.
semgreppython.lang.security.dangerous-globals-use.dangerous-globals-useWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pkg_resources/__init__.py13120Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
semgreppython.lang.security.dangerous-globals-use.dangerous-globals-useWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pkg_resources/__init__.py13136Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
semgreppython.lang.security.dangerous-globals-use.dangerous-globals-useWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pkg_resources/__init__.py1389Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
semgreppython.lang.security.dangerous-globals-use.dangerous-globals-useWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pkg_resources/__init__.py13841Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
semgreppython.lang.security.audit.exec-detected.exec-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pkg_resources/__init__.py144813Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
semgreppython.lang.security.audit.exec-detected.exec-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pkg_resources/__init__.py145513Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
semgreppython.lang.security.audit.non-literal-import.non-literal-importWARNINGLOWunknownproyecto/myenv/Lib/site-packages/pkg_resources/__init__.py22159Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.
semgreppython.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/_distutils/command/register.py8920Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.
semgreppython.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/_distutils/command/upload.py19422Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.
semgreppython.lang.security.audit.exec-detected.exec-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/_distutils/core.py21517Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
semgreppython.lang.security.audit.subprocess-shell-true.subprocess-shell-trueERRORMEDIUMunknownproyecto/myenv/Lib/site-packages/setuptools/_distutils/cygwinccompiler.py39128Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.
semgreppython.lang.security.dangerous-globals-use.dangerous-globals-useWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/_distutils/sysconfig.py50716Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
semgreppython.lang.security.audit.exec-detected.exec-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/build_meta.py1509Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
semgreppython.lang.security.audit.marshal.marshal-usageWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/command/bdist_egg.py37612The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security
semgreppython.lang.security.dangerous-globals-use.dangerous-globals-useWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/command/easy_install.py104716Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
semgreppython.lang.security.dangerous-globals-use.dangerous-globals-useWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/command/easy_install.py105139Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
semgreppython.lang.security.audit.httpsconnection-detected.httpsconnection-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/command/upload_docs.py17020The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information.
semgreppython.lang.security.audit.non-literal-import.non-literal-importWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/config.py42226Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.
semgreppython.lang.security.audit.marshal.marshal-usageWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/depends.py11120The marshal module is not intended to be secure against erroneous or maliciously constructed data. Never unmarshal data received from an untrusted or unauthenticated source. See more details: https://docs.python.org/3/library/marshal.html?highlight=security
semgreppython.lang.security.dangerous-globals-use.dangerous-globals-useWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/depends.py17113Found non static data as an index to 'globals()'. This is extremely dangerous because it allows an attacker to execute arbitrary code on the system. Refactor your code not to use 'globals()'.
semgreppython.lang.security.audit.exec-detected.exec-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/launch.py325Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
semgreppython.lang.security.audit.non-literal-import.non-literal-importWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/monkey.py14915Untrusted user input in `importlib.import_module()` function allows an attacker to load arbitrary code. Avoid dynamic values in `importlib.import_module()` or use a whitelist to prevent running untrusted code.
semgreppython.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/package_index.py109616Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.
semgreppython.lang.security.audit.exec-detected.exec-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/sandbox.py465Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
semgreppython.lang.security.deserialization.pickle.avoid-pickleWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/sandbox.py10820Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.
semgreppython.lang.security.deserialization.pickle.avoid-pickleWARNINGLOWunknownproyecto/myenv/Lib/site-packages/setuptools/sandbox.py10840Avoid using `pickle`, which is known to lead to code execution vulnerabilities. When unpickling, the serialized data could be manipulated to run arbitrary code. Instead, consider serializing the relevant data as JSON or a similar text-based serialization format.
semgreppython.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1WARNINGMEDIUMunknownproyecto/myenv/Lib/site-packages/werkzeug/http.py95612Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.
semgreppython.lang.security.audit.httpsconnection-detected.httpsconnection-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/werkzeug/middleware/http_proxy.py15127The HTTPSConnection API has changed frequently with minor releases of Python. Ensure you are using the API for your version of Python securely. For example, Python 3 versions prior to 3.4.3 will not verify SSL certificates by default. See https://docs.python.org/3/library/http.client.html#http.client.HTTPSConnection for more information.
semgrepjavascript.lang.security.detect-insecure-websocket.detect-insecure-websocketERRORLOWunknownproyecto/myenv/Lib/site-packages/werkzeug/routing/rules.py42765Insecure WebSocket Detected. WebSocket Secure (wss) should be used for all WebSocket connections.
semgreppython.lang.security.audit.exec-detected.exec-detectedWARNINGLOWunknownproyecto/myenv/Lib/site-packages/werkzeug/routing/rules.py7279Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
semgrepjavascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexpWARNINGLOWunknownproyecto/reportes/class.js9742RegExp() called with a `b` function argument, this might allow an attacker to cause a Regular Expression Denial-of-Service (ReDoS) within your application as RegExP blocks the main thread. For this reason, it is recommended to use hardcoded regexes instead. If your regex is run on user-controlled input, consider performing input validation or use a regex checking/sanitization library such as https://www.npmjs.com/package/recheck to verify that the regex does not appear vulnerable to ReDoS.
semgrepjavascript.browser.security.insecure-document-method.insecure-document-methodERRORLOWunknownproyecto/reportes/class.js1739User controlled data in methods like `innerHTML`, `outerHTML` or `document.write` is an anti-pattern that can lead to XSS vulnerabilities
semgrepgeneric.secrets.security.detected-sonarqube-docs-api-key.detected-sonarqube-docs-api-keyERRORLOWunknownproyecto/sonar-project.properties51SonarQube Docs API Key detected
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/conversion.html95This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/conversion.html625This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/conversion.html635This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/conversion.html645This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/conversion_resultado.html95This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/conversion_resultado.html395This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/conversion_resultado.html405This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/conversion_resultado.html415This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/cotizar.html95This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/cotizar.html625This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/cotizar.html635This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/cotizar.html645This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/cotizar_resultado.html95This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/cotizar_resultado.html365This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/cotizar_resultado.html375This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/cotizar_resultado.html385This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/dashboard.html95This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/dashboard.html805This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/dashboard.html815This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/dashboard.html825This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/historial.html95This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/historial.html565This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/historial.html575This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/historial.html585This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/login.html85This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgreppython.django.security.django-no-csrf-token.django-no-csrf-tokenWARNINGMEDIUMunknownproyecto/templates/login.html2925Manually-created forms in django templates should specify a csrf_token to prevent CSRF attacks.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/login.html475This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/login.html485This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.
semgrephtml.security.audit.missing-integrity.missing-integrityWARNINGLOWunknownproyecto/templates/login.html495This tag is missing an 'integrity' subresource integrity attribute. The 'integrity' attribute allows for the browser to verify that externally hosted files (for example from a CDN) are delivered without unexpected manipulation. Without this attribute, if an attacker can modify the externally hosted resource, this could lead to XSS and other types of attacks. To prevent this, include the base64-encoded cryptographic hash of the resource (file) you’re telling the browser to fetch in the 'integrity' attribute for all externally hosted files.