Common Weakness Enumeration (CWE)

The product stores a password in a configuration file that might be accessible to actors who do not know the password.

The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.

The product detects a specific error, but takes no actions to handle the error.

The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().

This weakness has been deprecated because it covered redundant concepts already described in CWE-287.

The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.

The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.

To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.

The product does not properly encode or decode the data, resulting in unexpected values.

The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.

Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.

The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.

The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.

The product assigns an owner to a resource, but the owner is outside of the intended control sphere.

The product, by default, initializes an internal variable with an insecure or less secure value than is possible.

The product uses an expression in which operator precedence causes incorrect logic to be used.

The product does not neutralize or incorrectly neutralizes delimiters.

The product uses a default cryptographic key for potentially critical functionality.

The product uses an environment variable to store unencrypted sensitive information.

The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

The product uses a regular expression that does not sufficiently restrict the set of allowed values.