Common Weakness Enumeration (CWE)

The product allocates file descriptors or handles on behalf of an actor without imposing any restrictions on how many descriptors can be allocated, in violation of the intended security policy for that actor.

This entry has been deprecated, as it was not effective as a weakness and was structured more like a category. In addition, the name is inappropriate, since the "container" term is widely understood by developers in different ways than originally intended by PLOVER, the original source for this entry.

The code calls sizeof() on a malloced pointer type, which always returns the wordsize/8. This can produce an unexpected result if the programmer intended to determine how much memory has been allocated.

The product accepts input that identifies a Windows UNC share ('\\UNC\share\name') that potentially redirects access to an unintended location or arbitrary file.

The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.

The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.

The product does not handle or incorrectly handles inputs that are related to complex structures.

Certain conditions, such as network failure, will cause a server error message to be displayed.

System configuration protection may be bypassed during debug mode.

The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability.

The implementation of the product is not consistent with the design as described within the relevant documentation.

The product parses numeric input assuming base 10 (decimal) values, but it does not account for inputs that use a different base number (radix).

The product receives input from an upstream component, but it does not handle or incorrectly handles when an expected special element is missing.

A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.

The product provides software-controllable device functionality for capabilities such as power and clock management, but it does not properly limit functionality that can lead to modification of hardware memory or register bits, or the ability to observe physical side channels.

The product or code does not isolate system-dependent functionality into separate standalone modules.

The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.

No description available.

An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.

This entry has been deprecated because it was a duplicate of CWE-908. All content has been transferred to CWE-908.

The product does not return custom error pages to the user, possibly exposing sensitive information.

Aliased or mirrored memory regions in hardware designs may have inconsistent read/write permissions enforced by the hardware. A possible result is that an untrusted agent is blocked from accessing a memory region but is not blocked from accessing the corresponding aliased memory region.

The product performs a data query with a large number of joins and sub-queries on a large data table.

An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

The product filters data in a way that causes it to be reduced or "collapsed" into an unsafe value that violates an expected security property.