Common Weakness Enumeration (CWE)

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

No description available.

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

No description available.

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

The product contains hard-coded credentials, such as a password or cryptographic key.

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

The product does not validate, or incorrectly validates, a certificate.

During installation, installed file permissions are set to allow anyone to modify those files.

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

No description available.

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.