Common Weakness Enumeration (CWE)

The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages.

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.

The product uses a signal handler that introduces a race condition.

The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention.

The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.

The product assigns an owner to a resource, but the owner is outside of the intended control sphere.

The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.

The product uses an expression in which operator precedence causes incorrect logic to be used.

The product does not neutralize or incorrectly neutralizes delimiters.

To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.

The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.

The product violates well-established principles for secure design.

The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().

The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.

The product uses an environment variable to store unencrypted sensitive information.

The product detects a specific error, but takes no actions to handle the error.

The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

The product, by default, initializes an internal variable with an insecure or less secure value than is possible.

The product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are undefined.