Skip to content

Hcl vulnerability list update #297

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AkashSahai wants to merge 9 commits into
base: main
Choose a base branch
from
+6 −1
Open

Hcl vulnerability list update #297

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
9bdd442
Added more CWE mappings for HCL AppScan
AkashSahai Mar 24, 2026
267c933
Modified mapping of attJavaDeserCodeExec
AkashSahai Mar 24, 2026
6cb1a4a
Modified IAST related vulnerability mappings
AkashSahai Mar 27, 2026
07472f1
Added CodeInjection mapping for IAST
AkashSahai Mar 31, 2026
8d32154
added DeserializationOfUntrustedData as another option for 502 Vulner…
AkashSahai Apr 14, 2026
f838286
Merge remote-tracking branch 'upstream/main' into HCL_Vulnerability_L…
AkashSahai May 5, 2026
8427c95
Removed added MISSING_REFERRER_POLICY_HEADER
AkashSahai May 6, 2026
d0dd080
removed not required code
AkashSahai May 6, 2026
45578ac
removed whitespace
AkashSahai May 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion plugin/src/main/java/org/owasp/benchmarkutils/score/parsers/HCLAppScanIASTReader.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,8 +75,13 @@ private void createVulnerabilitiesMap() {
vulnerabilityToCweNumber.put("attFileUploadXXE", CweNumber.XXE);
vulnerabilityToCweNumber.put("attCrossSiteRequestForgery", CweNumber.CSRF);
vulnerabilityToCweNumber.put("passParamGET", CweNumber.UNPROTECTED_CREDENTIALS_TRANSPORT);
vulnerabilityToCweNumber.put("attJavaDeserCodeExec", CweNumber.COMMAND_INJECTION);
vulnerabilityToCweNumber.put("attJavaDeserCodeExec", CweNumber.INSECURE_DESERIALIZATION);
vulnerabilityToCweNumber.put("DeserializationOfUntrustedData", CweNumber.INSECURE_DESERIALIZATION);
vulnerabilityToCweNumber.put("GV_JSONXSS", CweNumber.XSS);
vulnerabilityToCweNumber.put("attRedirectInURL", CweNumber.OPEN_REDIRECT);
vulnerabilityToCweNumber.put("attReferrerPolicyHeaderExist", CweNumber.DONTCARE);
vulnerabilityToCweNumber.put("DetectedAPIs", CweNumber.DONTCARE);
vulnerabilityToCweNumber.put("attBlindCodeInjection", 94);
}

@Override
Expand Down