Common Weakness Enumeration (CWE)

The product does not properly handle when all or part of an input has been URL encoded.

The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.

The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.

The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.

The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.

The product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere.

The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.

The product uses a regular expression that does not sufficiently restrict the set of allowed values.

The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.

The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.

The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.

The code uses a function that has inconsistent implementations across operating systems and versions.

The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

The product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.

The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.

The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.

The UI performs the wrong action with respect to the user's request.

The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.

The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect on its behavior and integrity.

The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents.

A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.