Common Weakness Enumeration (CWE)

The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source.

The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.

The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations, when debug mode is entered.

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that can resolve to a location that is outside of that directory.

The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.

The product is designed with access restricted to certain information, but it does not sufficiently protect against an unauthorized actor with physical access to these areas.

The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.

The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.

The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.

No description available.

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.

No description available.

A backup file is stored in a directory or archive that is made accessible to unauthorized actors.

The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.

The product calls a function that can never be guaranteed to work safely.

The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.

The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.

The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination for that actor.

The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.

The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

The product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.