Common Weakness Enumeration (CWE)

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

No description available.

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

The product accesses or uses a pointer that has not been initialized.

The product does not correctly convert an object, resource, or structure from one type to a different type.

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

An exception is thrown from a function, but it is not caught.

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

No description available.

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.