Common Weakness Enumeration (CWE)

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.

The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.

The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.

Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.

The product performs a key exchange with an actor without verifying the identity of that actor.

The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.

The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.

[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

The product does not properly verify that a critical resource is owned by the proper entity.

The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

This weakness has been deprecated because it covered redundant concepts already described in CWE-287.

The product stores a password in a configuration file that might be accessible to actors who do not know the password.

A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.

The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.

The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.