Common Weakness Enumeration (CWE)

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

No description available.

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

An exception is thrown from a function, but it is not caught.

No description available.

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

The product accesses or uses a pointer that has not been initialized.

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

The product does not correctly convert an object, resource, or structure from one type to a different type.

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.