Common Weakness Enumeration (CWE)

The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.

System configuration protection may be bypassed during debug mode.

The implementation of the product is not consistent with the design as described within the relevant documentation.

A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.

The product or code does not isolate system-dependent functionality into separate standalone modules.

The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.

The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations.

The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked.

An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.

This entry has been deprecated because it was a duplicate of CWE-908. All content has been transferred to CWE-908.

The product does not return custom error pages to the user, possibly exposing sensitive information.

Aliased or mirrored memory regions in hardware designs may have inconsistent read/write permissions enforced by the hardware. A possible result is that an untrusted agent is blocked from accessing a memory region but is not blocked from accessing the corresponding aliased memory region.

The product performs a data query with a large number of joins and sub-queries on a large data table.

An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

The product filters data in a way that causes it to be reduced or "collapsed" into an unsafe value that violates an expected security property.

The product does not properly handle when a particular element is not completely specified.

The UI has multiple interpretations of user input but does not prompt the user when it selects the less secure interpretation.

The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.

Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption.

A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.

A UI function is obsolete and the product does not warn the user.

The register contents used for attestation or measurement reporting data to verify boot flow are modifiable by an adversary.

The hardware logic for error handling and security checks can incorrectly forward data before the security check is complete.

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

The product, while copying or cloning a resource, does not set the resource's permissions or access control until the copy is complete, leaving the resource exposed to other spheres while the copy is taking place.