Common Weakness Enumeration (CWE)

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.

No description available.

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

The product does not initialize a critical resource.

When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

No description available.

The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

The product contains code that appears to be malicious in nature.

The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.