Common Weakness Enumeration (CWE)

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

No description available.

The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

The product accesses or uses a pointer that has not been initialized.

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

The product does not correctly convert an object, resource, or structure from one type to a different type.

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

No description available.

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

An exception is thrown from a function, but it is not caught.

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Storing a password in plaintext may result in a system compromise.