Common Weakness Enumeration (CWE)

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

The product does not properly manage a user within its environment.

The product performs a key exchange with an actor without verifying the identity of that actor.

The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

The code does not function according to its published specifications, potentially leading to incorrect usage.

The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.

The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "../" sequences that can resolve to a location that is outside of that directory.

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.

The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.

A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.

Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.

While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.

[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.

The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.