← Workshop

Workshop · Tool

Vulnerability report explainer

Paste a dependency-audit or scanner report. It identifies each finding, explains the vulnerability in plain language, gives an example, and lists how to fix it.

Paste output from a dependency audit or scanner, or a list of findings. Each finding can be a bullet, a numbered item, or a paragraph. Identifiers (CVE, GHSA, CWE) are used to recognise the issue.

4 finding(s): 1 critical · 1 high · 1 medium · 1 low

criticalline 1CVE-2019-12384CWE-502

Insecure deserialization

Report says: Critical: Remote code execution in jackson-databind (CVE-2019-12384, CWE-502)

Package: com.fasterxml.jackson.core:jackson-databind

What it means

The application turns untrusted data back into objects. Crafted data can make the object-building code run attacker-chosen actions, which can lead to remote code execution.

Example

A Java service accepts a serialized object from a request body and deserializes it with ObjectInputStream.

How to fix it

  • Don't deserialize untrusted data with native Java serialization.
  • Use a plain data format such as JSON, with a fixed target type.
  • Upgrade the serialization library, and restrict polymorphic type handling.
highline 5CWE-89

SQL injection

Report says: High: SQL injection in the policy search endpoint (CWE-89)

What it means

The application builds a database query by pasting user input straight into the SQL text. An attacker can type SQL of their own and make the database run it, for example to read or delete other people's data.

Example

The search box sends "Acme' OR '1'='1" and the query becomes WHERE name = 'Acme' OR '1'='1', which matches every row.

How to fix it

  • Use parameterised queries: pass values as parameters, never concatenate them into the SQL string.
  • In Spring Data, use named parameters with @Query or derived methods instead of string building.
  • Validate input length and format, but don't rely on that alone.
mediumline 8CWE-798

Hard-coded credentials

Report says: Medium: Hard-coded database password (CWE-798)

What it means

A password, token or key is written directly into the code or a config file. Anyone who can read the repository, a backup or a build artifact gets the secret, and it's hard to rotate.

Example

application.yml contains password: hunter2, and that file is committed to Git.

How to fix it

  • Read secrets from environment variables or a secret manager, e.g. ${DB_PASSWORD}.
  • Rotate any secret that has ever been committed, even if the repository is private.
  • Add a secret scanner to the commit or CI pipeline.
lowline 11CWE-209

Sensitive information exposure

Report says: Low: Stack trace shown to users on error (CWE-209)

What it means

The application reveals more than it should, such as stack traces, internal paths, versions or user data, in an error message or response. Attackers use these details to plan the next attack.

Example

A 500 error page shows the full Java stack trace, library versions and the database host name.

How to fix it

  • Return generic error messages to users, and log the details on the server with a request ID.
  • Remove debug endpoints and verbose error pages in production.
  • Review API responses for fields the client doesn't need.

Explains known classes of vulnerability; it does not scan your code or look up CVEs online. Explanations are general, so check the official CVE or CWE entry and a security reviewer for anything high severity. Runs entirely in your browser; the report is not sent or stored.