Hi CHRISTOPHER NATHAN HENDRIS,
Thank you for reaching out to Q&A Forum.
These Veracode findings come from Microsoft ReportViewer DLLs (not SQL Server itself). They are low-risk or false positives since MD5, Random, and HTML rendering are used internally for caching and report output, not for security-critical functions. You can’t modify these Microsoft-signed libraries yourself. Make sure you’re using the latest ReportViewer NuGet packages:
Microsoft.ReportingServices.ReportViewerControl.WebForms
Microsoft.ReportingServices.ReportViewerControl.WinForms
If the issues persist, mark them as “Third-Party / Informational” in Veracode.