Common Weakness Enumeration (CWE)

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers.

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.

The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.

The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.

Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

The product uses a scheme that generates numbers or identifiers that are more predictable than required.

Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.

The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

No description available.

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Nonces should be used for the present occasion and only once.

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.

A feature, API, or function does not perform according to its specification.

The product uses default passwords for potentially critical functionality.