Common Weakness Enumeration (CWE)

The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

The Android application uses an implicit intent for transmitting sensitive data to other applications.

The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.

The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.

The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.

The behavior of this function is undefined unless its control parameter is set to a specific value.

The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.

The product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere.

The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.

A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.

The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.

The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations, when debug mode is entered.

The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.

A function or operation returns an incorrect return value or status code that does not indicate an error, but causes the product to modify its behavior based on the incorrect result.

No description available.

The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.

The product receives data from an upstream component, but does not filter or incorrectly filters special elements before sending it to a downstream component.

The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

No description available.