Common Weakness Enumeration (CWE)

The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

The product implements an authentication technique, but it skips a step that weakens the technique.

A feature, API, or function does not perform according to its specification.

The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.

The product uses default passwords for potentially critical functionality.

The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

The product receives data from an upstream component, but does not completely filter special elements before sending it to a downstream component.

The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

Obscuring a password with a trivial encoding does not protect the password.

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

No description available.

The product specifies a regular expression in a way that causes data to be improperly matched or compared.

The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

The product stores sensitive information in cleartext in memory.

The product does not properly protect an assumed-immutable element from being modified by an attacker.

The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.

When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

The product protects a primary channel, but it does not use the same level of protection for an alternate channel.