Hardcoded_password_in_Connection_String issue exists @ encode.frm in branch master

The application contains hardcoded connection details, ""connection string"", at line 1 of encode.frm. This connection string contains a hardcoded password, which is used in System.Data.SqlClient at line 1 of encode.frm to connect to a database server with open. This can expose the database password, and impede proper password management. 

Severity: Medium

CWE:547

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 67

Code (Line #67):

conn.Open "connection string"

Command_Injection issue exists @ HighRisk/Command_Injection.bas in branch master

Similarity Id: 1488024225

Severity: High

CWE:77

Vulnerability details and guidance

Internal Guidance

Checkmarx

Recommended Fix

Lines: 6

Code (Line #6):

str = window.Text()    

SQL_Injection issue exists @ SQL_Injection/CURSOR/ref_cursor.pls in branch master

Similarity Id: 392555577

Severity: High

CWE:89

Vulnerability details and guidance

Internal Guidance

Checkmarx

Recommended Fix

Lines: 1

Code (Line #1):

CREATE OR REPLACE PROCEDURE GET_OWNER (P_OBJNM VARCHAR) IS 

Hardcoded_password_in_Connection_String issue exists @ VB_3845_112_lines/encode.frm in branch master

Similarity Id: 1613817459

Severity: Medium

CWE:547

Vulnerability details and guidance

Internal Guidance

Checkmarx

Recommended Fix

Lines: 67

Code (Line #67):

conn.Open "connection string"

SQL_Injection issue exists @ SQL_Injection/EXECUTE_IMMEDIATE/tcp.pls in branch master

Similarity Id: -2013539329

Severity: High

CWE:89

Vulnerability details and guidance

Internal Guidance

Checkmarx

Recommended Fix

Lines: 10

Code (Line #10):

         utl_tcp.read_text(cp, data, 256);

Privacy_Violation issue exists @ encode.frm in branch master

Method cmdSafe_Click at line 3 of encode.frm sends user information outside the application. This may constitute a Privacy Violation.

Severity: Medium

CWE:359

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 42 11

Code (Line #42):

    password = txtPassword.Text

Code (Line #11):

    password = Replace$(txtPassword.Text, "'", "''")

SQL_Injection issue exists @ encode.frm in branch master

Method cmdUnsafe_Click at line 34 of encode.frm gets user input from the text element. This element’s value then flows through the code without being properly sanitized or validated, and is eventually used in a database query in method cmdUnsafe_Click at line 34 of encode.frm. This may enable an SQL Injection attack.

Severity: High

CWE:89

Vulnerability details and guidance

Checkmarx

Training
Recommended Fix

Lines: 41 42

Code (Line #41):

    user_name = txtUserName.Text

Code (Line #42):

    password = txtPassword.Text

SQL_Injection issue exists @ /encode.frm in branch master

Similarity Id: 1197064592

Severity: HIGH

CWE:89

Vulnerability details and guidance

Internal Guidance

Recommended Fix

Lines: 41 42

Privacy_Violation issue exists @ VB_3845_112_lines/encode.frm in branch master

Similarity Id: 2038636427, -603017501

Severity: Medium

CWE:359

Vulnerability details and guidance

Internal Guidance

Checkmarx

Recommended Fix

Lines: 42 11

Code (Line #42):

    password = txtPassword.Text

Code (Line #11):

    password = Replace$(txtPassword.Text, "'", "''")

Privacy_Violation issue exists @ /encode.frm in branch master

Similarity Id: 1944286477

Severity: MEDIUM

CWE:359

Vulnerability details and guidance

Internal Guidance

Recommended Fix

Lines: 42 11

SQL_Injection issue exists @ VB_3845_112_lines/encode.frm in branch master

Similarity Id: -1269824577

Severity: High

CWE:89

Vulnerability details and guidance

Internal Guidance

Checkmarx

Recommended Fix

Lines: 42

Code (Line #42):

    password = txtPassword.Text

SQL_Injection issue exists @ SQL_Injection/DBMS_SQL/test.pls in branch master

Similarity Id: -836721838, -775161003, 456162259, 983648529

Severity: High

CWE:89

Vulnerability details and guidance

Internal Guidance

Checkmarx

Recommended Fix

Lines: 66 12

Code (Line #66):

     procedure set_output_table(name_string in varchar2) is

Code (Line #12):

     procedure set_output_table_synonym(name_string in varchar2) is

SQL_Injection issue exists @ SQL_Injection/EXECUTE_IMMEDIATE/execute.pls in branch master

Similarity Id: 2106809557

Severity: High

CWE:89

Vulnerability details and guidance

Internal Guidance

Checkmarx

Recommended Fix

Lines: 1

Code (Line #1):

CREATE OR REPLACE PROCEDURE SP_ProductSearch(Prodname IN VARCHAR2) AS

Hardcoded_password_in_Connection_String issue exists @ /encode.frm in branch master

Similarity Id: -626598861

Severity: MEDIUM

CWE:547

Vulnerability details and guidance

Internal Guidance

Recommended Fix

Lines: 67