Common Weakness Enumeration (CWE)

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

The product, by default, initializes an internal variable with an insecure or less secure value than is possible.

The web application sends a redirect to another location, but instead of exiting, it executes additional code.

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/dir/../filename" sequences that can resolve to a location that is outside of that directory.

The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.

The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.

The Android application uses an implicit intent for transmitting sensitive data to other applications.

The product uses a default cryptographic key for potentially critical functionality.

The product does not properly encode or decode the data, resulting in unexpected values.

The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.

A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component.

The product allows address regions to overlap, which can result in the bypassing of intended memory protection.

The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.

Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.

The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.

The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.

The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.

The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.

The behavior of this function is undefined unless its control parameter is set to a specific value.

The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.

No description available.