Medium
medium.com › javarevisited › security-vulnerabilities-in-java-application-e844bd281ff2
Security Vulnerabilities in Java application | by Srikanth Dannarapu | Javarevisited | Medium
April 9, 2023 - Here are a few examples of common security vulnerabilities and how to fix them: SQL Injection: SQL injection is a vulnerability where an attacker can inject malicious SQL code into a query, potentially allowing ...
Codacy
blog.codacy.com › java-vulnerabilities
11 Common Java Vulnerabilities and How to Avoid Them
March 31, 2026 - In this example, the code uses the Data Encryption Standard (DES) algorithm to encrypt data. DES is considered weak by today's security standards due to its small key size (56 bits), making it susceptible to brute-force attacks. To mitigate this issue, we can replace the DES algorithm with the more secure Advanced Encryption Standard (AES) algorithm, which supports larger key sizes (128, 192, and 256 bits) and is widely accepted as secure. import javax.crypto.Cipher; import javax.crypto.KeyGenerator; import javax.crypto.SecretKey; public class StrongEncryptionExample { public static void main(
Secure Coding Practices in Java Resources
OWASP secure code review guide is good but very long. You can also look at the code review content on pentesterlab and SecureFlag (requires an OWASP membership but absolutely worth it for 50$ for the whole year). More on reddit.com
17
7
April 26, 2024Collection of vulnerable code snippets (updated every friday)
This is gonna be picked up by GitHub Copilot 😂 More on reddit.com
11
214
November 18, 2022The ultimate guide to Java Security Vulnerabilities (CVE)
The ultimate guide somehow fails to mention the best JVM CVE checker: https://github.com/jeremylong/DependencyCheck More on reddit.com
47
87
December 29, 2022Is my Java program vulnerable to remote attack if its uses outdated libraries?
Can we do something about this if the library that we use seems outdated? Well, you can update them to a newer version that fix those issues. Most build systems - like maven - provide you a way to exclude transitive dependencies and use a newer version instead, if the original cannot be swapped for some reason. Also, understanding the vulnerability itself can also help you with the answers. Like if there's an SQL-injection problem in some lib that you use, but your app is not SQL-based, it's not really a problem. Or if a buffer-overflow can happen with inputs >10k bytes (made up value), but your code does not allow any kind of user provided information to reach it, and you only populate the original buffer with your own, sane values, that might also not affect you. More on reddit.com
21
18
May 6, 2024Videos
GitHub
github.com › snoopysecurity › Broken-Vulnerable-Code-Snippets › blob › master › SQL Injection › example.java
Broken-Vulnerable-Code-Snippets/SQL Injection/example.java at master · snoopysecurity/Broken-Vulnerable-Code-Snippets
March 23, 2025 - A small collection of vulnerable code snippets . Contribute to snoopysecurity/Broken-Vulnerable-Code-Snippets development by creating an account on GitHub.
Author snoopysecurity
DZone
dzone.com › refcards › java application vulnerabilities
Java Application Vulnerabilities - DZone Refcards
For each vulnerability type, you ... application security testing (SAST) during the software development process is Unpatched Libraries....
Piazza
piazza.com › class_profile › get_resource › hbse78gzt4m3p8 › hc0xab9j1pb6b9 pdf
Vulnerable Java Code String DRIVER = "com.ora.jdbc.Driver";
Vulnerable Java Code · String DRIVER = "com.ora.jdbc.Driver"; String DataURL = "jdbc:db://localhost:5112/users"; String LOGIN = "admin"; String PASSWORD = "admin123"; Class.forName(DRIVER); //Make connection to DB Connection · connection = DriverManager.getConnection(DataURL, LOGIN, PASSWORD); String Username = request.getParameter("USER"); // From HTTP request · String Password = request.getParameter("PASSWORD"); // From HTTP request · int iUserID = -‐1; String sLoggedUser = ""; String sel = "SELECT User_id, Username FROM USERS WHERE Username = '" +Username + "' AND Password = '" + Pa
Pentesterlab
pentesterlab.com › exercises › java_07
PentesterLab: Java Snippet #07
The Code Review Snippet challenges present vulnerable code snippets for you to inspect and identify flaws. The Serve.java example highlights a directory traversal vulnerability due to improper path validation.
GitHub
github.com › bbossola › vulnerability-java-samples
GitHub - bbossola/vulnerability-java-samples: Sample exploits of common vulnerabilities in Java librarires · GitHub
Sample exploits of common vulnerabilities in Java librarires - bbossola/vulnerability-java-samples
Starred by 27 users
Forked by 80 users
Languages Java 97.2% | Shell 2.8%
arXiv
arxiv.org › pdf › 2203.09009 pdf
Example-Based Vulnerability Detection and Repair in Java Code Ying Zhang
ized ways introduced in Section 3.5, and 9 pairs are defined with · plain Java examples. Within the 19 pairs, 8 pairs, 6 pairs, and 5 pairs ... Two datasets to evaluate pattern application. The first dataset · is a third-party benchmark, consisting of 86 real vulnerabilities
Finitestate
finitestate.io › blog › top-10-java-vulnerabilities
10 Major Java Vulnerability Types that Threaten Your ...
February 19, 2026 - How Finite State protects your Java applications from security vulnerabilities · One of my colleagues worked as a Starbucks barista as a teenager and once told me how baristas would play pranks on each other by “hacking” the drink ordering system. In the late 2000s, if you ordered a drink at Starbucks, your cashier would ring up your order and then call your order to the barista making the drinks.
GitHub
github.com › dehvCurtis › vulnerable-code-examples
GitHub - dehvCurtis/vulnerable-code-examples: This repo provides vulnerable code examples · GitHub
sql-injection.ts · CWE-89 · 1 · SAST/typescript · xss.ts · CWE-79 · 1 · SAST/typescript · zip-slip.js · CWE-20, CWE-22 · 2 · Total · 9 · Repo: https://github.com/dehvCurtis/vulnerable-code-examples/tree/main/SCA · Location · File · CWE / Exposure · # of Exposures · SCA/java/maven ·
Starred by 18 users
Forked by 88 users
Languages Python 33.3% | PHP 11.6% | HCL 11.5% | C# 11.1% | TypeScript 10.2% | JavaScript 9.1%
Shiftleft
docs.shiftleft.io › ocular › tutorials › java-vuln
Java Vulnerable Lab | ShiftLeft Docs
This tutorial is based on the popular Java project, Java Vulnerable Lab, a benchmarking application for vulnerability discovery tools. The project includes different sample vulnerabilities, such as typical injection vulnerabilities like SQL injection.
ACM Digital Library
dl.acm.org › doi › 10.1145 › 3524610.3527895
Example-based vulnerability detection and repair in Java code | Proceedings of the 30th IEEE/ACM International Conference on Program Comprehension
The Java libraries JCA and JSSE offer cryptographic APIs to facilitate secure coding. When developers misuse some of the APIs, their code becomes vulnerable to cyber-attacks. To eliminate such vulnerabilities, people built tools to detect security-API misuses via pattern matching. However, most tools do not (1) fix misuses or (2) allow users to extend tools' pattern sets. To overcome both limitations, we created Seader---an example...
Snyk Learn
learn.snyk.io › home › security education › what is code injection? | tutorial & examples
What is code injection? | Tutorial & examples | Snyk Learn
October 28, 2025 - This is dangerous as Java methods can be accessed and run from within the ScriptEngine, including the runtime.exec() method that we demonstrated above. In this example, we’re going to look at the Spring Expression Language (SpEL). Spring Framework provides a JSP tag used to evaluate SpEL. If unvalidated expressions are evaluated an attacker may be able to execute their own code. Below is an example of a vulnerable Spring Eval tag:
GuardRails
guardrails.io › blog › java-top-10-security-vulnerabilities
Java Top 10 Security Vulnerabilities - GuardRails.io
June 13, 2023 - Java is lauded for its strict, concise, static typed and minded development paradigm. And it remains a popular language at large organizations where security, and consistency are important for their development teams and security process.
GitHub
github.com › DataDog › vulnerable-java-application
GitHub - DataDog/vulnerable-java-application: This repository contains a sample Java application vulnerable to command injection and server-side request forgery (SSRF). · GitHub
This repository contains a sample application, the "Websites Tester Service", that's vulnerable to a Command Injection and Server-Side Request Forgery (SSRF) vulnerability.
Starred by 23 users
Forked by 144 users
Languages Java 43.1% | HTML 30.4% | JavaScript 14.9% | Smarty 4.9% | Dockerfile 3.7% | Shell 2.6% | Makefile 0.4%
Spectral
spectralops.io › home › top 10 most common java vulnerabilities you need to prevent
Top 10 Most Common Java Vulnerabilities You Need to Prevent - Spectral
January 24, 2021 - Though Twitter doesn’t only use Java in its stack, the cautionary event can be applied to protecting your input forms. The easiest method is to apply input validation with output sanitizing and escaping. This means that any attempts at sending HTML code will be parsed or rejected, depending on what your application is doing. An OS command injection, or also commonly known as a shell injection, is a security vulnerability that allows attackers to execute shell commands on the server that’s running your application.
Virginia Tech
people.cs.vt.edu › nm8247 › publications › ying-icpc-2022-cr.pdf pdf
Example-Based Vulnerability Detection and Repair in Java ...
Associate Professor Computer Science Virginia Tech · Gilbert Place, Room 4311A
SonarSource
rules.sonarsource.com › java › type › vulnerability
Java static code analysis | Vulnerability
Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your JAVA code
CodeSandbox
codesandbox.io › p › github › Undead34 › vulnerable-code-examples
vulnerable-code-examples
CodeSandbox is a cloud development platform that empowers developers to code, collaborate and ship projects of any size from any device in record time.
Security Boulevard
securityboulevard.com › home › cybersecurity › devops › common vulnerabilities in java and how to fix them
Common vulnerabilities in Java and how to fix them - Security Boulevard
November 30, 2021 - 30 vulnerabilities to look out for in Java applications: Arbitrary file writes, directory traversal, deserialization, and more…Photo by Cookie the Pom on UnsplashSecuring applications is not the easiest thing to do. An application has many components: server-side logic, client-side logic, data storage, data transportation, API, and more.