The following issues were found

src/test/fuzz/system.cpp
1 issues
system - This causes a new program to execute and is difficult to use safely
Security

Line: 25 Column: 13 CWE codes: 78
Suggestion: try using a library call that implements the same functionality if available 

              }
} // namespace

FUZZ_TARGET(system)
{
    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
    ArgsManager args_manager{};

    if (fuzzed_data_provider.ConsumeBool()) {

Reported by FlawFinder.

src/test/fuzz/socks5.cpp
1 issues
getenv - Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once
Security

Line: 37 Column: 73 CWE codes: 807 20
Suggestion: Check environment variables carefully before using them 

                  InterruptSocks5(fuzzed_data_provider.ConsumeBool());
    // Set FUZZED_SOCKET_FAKE_LATENCY=1 to exercise recv timeout code paths. This
    // will slow down fuzzing.
    g_socks5_recv_timeout = (fuzzed_data_provider.ConsumeBool() && std::getenv("FUZZED_SOCKET_FAKE_LATENCY") != nullptr) ? 1 : default_socks5_recv_timeout;
    FuzzedSock fuzzed_sock = ConsumeSock(fuzzed_data_provider);
    // This Socks5(...) fuzzing harness would have caught CVE-2017-18350 within
    // a few seconds of fuzzing.
    (void)Socks5(fuzzed_data_provider.ConsumeRandomLengthString(512),
                 fuzzed_data_provider.ConsumeIntegral<uint16_t>(),

Reported by FlawFinder.

src/qt/test/test_main.cpp
1 issues
getenv - Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once
Security

Line: 71 Column: 13 CWE codes: 807 20
Suggestion: Check environment variables carefully before using them 

                  // platform ("xcb", "windows", or "cocoa") so tests can't unintentionally
    // interfere with any background GUIs and don't require extra resources.
    #if defined(WIN32)
        if (getenv("QT_QPA_PLATFORM") == nullptr) _putenv_s("QT_QPA_PLATFORM", "minimal");
    #else
        setenv("QT_QPA_PLATFORM", "minimal", /* overwrite */ 0);
    #endif

    // Don't remove this, it's needed to access

Reported by FlawFinder.

src/test/fuzz/rpc.cpp
1 issues
getenv - Environment variables are untrustable input if they can be set by an attacker. They can have any content and length, and the same variable can be set more than once
Security

Line: 332 Column: 49 CWE codes: 807 20
Suggestion: Check environment variables carefully before using them 

                          std::terminate();
        }
    }
    const char* limit_to_rpc_command_env = std::getenv("LIMIT_TO_RPC_COMMAND");
    if (limit_to_rpc_command_env != nullptr) {
        g_limit_to_rpc_command = std::string{limit_to_rpc_command_env};
    }
}

Reported by FlawFinder.

src/test/fuzz/random.cpp
1 issues
random - This function is not sufficiently random for security-related functions such as key and nonce creation
Security

Line: 15 Column: 13 CWE codes: 327
Suggestion: Use a more secure technique for acquiring random values 

              #include <string>
#include <vector>

FUZZ_TARGET(random)
{
    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
    FastRandomContext fast_random_context{ConsumeUInt256(fuzzed_data_provider)};
    (void)fast_random_context.rand64();
    (void)fast_random_context.randbits(fuzzed_data_provider.ConsumeIntegralInRange<int>(0, 64));

Reported by FlawFinder.