Common Weakness Enumeration (CWE)

The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.

The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.

The code uses a function that has inconsistent implementations across operating systems and versions.

The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.

The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.

The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.

The UI performs the wrong action with respect to the user's request.

The product is designed with access restricted to certain information, but it does not sufficiently protect against an unauthorized actor with physical access to these areas.

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize 'dir\..\..\filename' (multiple internal backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.

The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.

The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect on its behavior and integrity.

The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents.

The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that can resolve to a location that is outside of that directory.

The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.

The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.

No description available.

The device uses an algorithm that is predictable and generates a pseudo-random number.

The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.

The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.

Using an empty string as a password is insecure.

The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.

The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.