Common Weakness Enumeration (CWE)

The Android application uses an implicit intent for transmitting sensitive data to other applications.

The product does not properly encode or decode the data, resulting in unexpected values.

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/dir/../filename" sequences that can resolve to a location that is outside of that directory.

The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.

The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.

The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.

The product uses a default cryptographic key for potentially critical functionality.

The web application sends a redirect to another location, but instead of exiting, it executes additional code.

The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.

The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.

The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.

The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.

The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.

The product requires that an actor should only be able to perform an action once, or to have only one unique action, but the product does not enforce or improperly enforces this restriction.

No description available.

A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as wildcards or matching symbols when they are sent to a downstream component.

The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.

The product allows address regions to overlap, which can result in the bypassing of intended memory protection.

The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.

The behavior of this function is undefined unless its control parameter is set to a specific value.