I received a report from the security team today. The report contains the below mentioned vulnerabilities and description:

1) Poor Error Handling: Overly Broad Throws

The methods in program1.java throws a generic exception making it harder for callers to do a good job of error handling and recovery.

2) Poor Error Handling: Overly Broad Catch

The catch block at EXAMPLE1.java line 146 handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.

3) Poor Error Handling: Empty Catch Block

The method SomeMethod() in somefile.java ignores an exception on line 33, which could cause the program to overlook unexpected states and conditions.

After reading above Impacts, There are few questions are raised in my mind

Questions:

1. How are these related to security? According to my understanding it seems like the above issues are code quality issues.

2. If those are real security threats, then how can an attacker exploit this?

3. What kind of protection controls are need to mitigate above issues?

I received a report from the security team today. The report contains the below mentioned vulnerabilities and descriptions:

1) Poor Error Handling: Overly Broad Throws

The methods in program1.java throws a generic exception making it harder for callers to do a good job of error handling and recovery.

2) Poor Error Handling: Overly Broad Catch

The catch block at EXAMPLE1.java line 146 handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.

3) Poor Error Handling: Empty Catch Block

The method SomeMethod() in somefile.java ignores an exception on line 33, which could cause the program to overlook unexpected states and conditions.

After reading the report above, a few questions are raised in my mind:

1. How are these related to security? According to my understanding it seems like the above issues are code quality issues.

2. If those are real security threats, then how can an attacker exploit this?

3. What kind of protection controls are need to mitigate above issues?

I received a report from the security team today. The report contains the below mentioned vulnerabilities and description:

1) Poor Error Handling: Overly Broad Throws

The methods in program1.java throws a generic exception making it harder for callers to do a good job of error handling and recovery.

2) Poor Error Handling: Overly Broad Catch

The catch block at EXAMPLE1.java line 146 handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.

3) Poor Error Handling: Empty Catch Block

The method SomeMethod() in somefile.java ignores an exception on line 33, which could cause the program to overlook unexpected states and conditions.

4) Trust Boundary Violation

The method posasasdrt() in TEST.java commingles trusted and untrusted data in the same data structure, which encourages programmers to mistakenly trust unvalidated data.

5) Denial of Service: StringBuilder

The call to append() in CollectionsExcelZipper.java on line 224 appends untrusted data to a StringBuilder instance initialized with the default backing-array size (16). This can cause the JVM to over-consume heap memory space.

After reading above Impacts, There are few questions are raised in my mind

Questions:

1. How are these related to security? According to my understanding it seems like the above issues are code quality issues.

2. If those are real security threats, then how can an attacker exploit this?

3. What kind of protection controls are need to mitigate above issues?

I received a report from the security team today. The report contains the below mentioned vulnerabilities and description:

1) Poor Error Handling: Overly Broad Throws

The methods in program1.java throws a generic exception making it harder for callers to do a good job of error handling and recovery.

2) Poor Error Handling: Overly Broad Catch

The catch block at EXAMPLE1.java line 146 handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.

3) Poor Error Handling: Empty Catch Block

The method SomeMethod() in somefile.java ignores an exception on line 33, which could cause the program to overlook unexpected states and conditions.

After reading above Impacts, There are few questions are raised in my mind

Questions:

1. How are these related to security? According to my understanding it seems like the above issues are code quality issues.

2. If those are real security threats, then how can an attacker exploit this?

3. What kind of protection controls are need to mitigate above issues?

I received one report in these mornings from the security team. That report contains below mentioned Vulnerability with Description:

1) Poor Error Handling: Overly Broad Throws

The methods in program1.java throws a generic exception making it harder for callers to do a good job of error handling and recovery.

2) Poor Error Handling: Overly Broad Catch

The catch block at EXAMPLE1.java line 146 handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.

3) Poor Error Handling: Empty Catch Block

The method SomeMethod() in somefile.java ignores an exception on line 33, which could cause the program to overlook unexpected states and conditions.

4) Trust Boundary Violation

The method posasasdrt() in TEST.java commingles trusted and untrusted data in the same data structure, which encourages programmers to mistakenly trust unvalidated data.

5) Denial of Service: StringBuilder

The call to append() in CollectionsExcelZipper.java on line 224 appends untrusted data to a StringBuilder instance initialized with the default backing-array size (16). This can cause the JVM to over-consume heap memory space.

After reading above Impacts, There are few questions are raised in my mind

Questions:

1. How they are related to the security  ? ( According to my understanding it seems like above issues are code quality issues. )

2. If those are real security threats then How can an attacker exploit this?

3. What kind of protection controls are need to mitigate above issues.

your help will be highly appreciated !!!!

Thanks

I received a report from the security team today. The report contains the below mentioned vulnerabilities and description:

1) Poor Error Handling: Overly Broad Throws

The methods in program1.java throws a generic exception making it harder for callers to do a good job of error handling and recovery.

2) Poor Error Handling: Overly Broad Catch

The catch block at EXAMPLE1.java line 146 handles a broad swath of exceptions, potentially trapping dissimilar issues or problems that should not be dealt with at this point in the program.

3) Poor Error Handling: Empty Catch Block

The method SomeMethod() in somefile.java ignores an exception on line 33, which could cause the program to overlook unexpected states and conditions.

4) Trust Boundary Violation

The method posasasdrt() in TEST.java commingles trusted and untrusted data in the same data structure, which encourages programmers to mistakenly trust unvalidated data.

5) Denial of Service: StringBuilder

The call to append() in CollectionsExcelZipper.java on line 224 appends untrusted data to a StringBuilder instance initialized with the default backing-array size (16). This can cause the JVM to over-consume heap memory space.

After reading above Impacts, There are few questions are raised in my mind

Questions:

1. How are these related to security? According to my understanding it seems like the above issues are code quality issues.

2. If those are real security threats, then how can an attacker exploit this?

3. What kind of protection controls are need to mitigate above issues?