Common Weakness Enumeration (CWE)

A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.

The product defines a signal handler that calls a non-reentrant function.

No description available.

Hardware description language code incorrectly defines register defaults or hardware Intellectual Property (IP) parameters to insecure values.

A UI function is obsolete and the product does not warn the user.

The product does not handle or incorrectly handles when a particular parameter, field, or argument name is not defined or supported by the product.

The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.

If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.

The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.

The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc.

The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.

The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

The J2EE application stores a plaintext password in a configuration file.

A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system.

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "..\" sequences that can resolve to a location that is outside of that directory.

The product does not implement or incorrectly implements wear leveling operations in limited-write non-volatile memories.

The document does not fully define all mechanisms that are used to control or influence how product-specific programs are executed.

The processor does not properly clear microarchitectural state after incorrect microcode assists or speculative execution, resulting in transient execution.

An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode.

A race condition in the hardware logic results in undermining security guarantees of the system.

No description available.

The product's architecture mirrors regions without ensuring that their contents always stay in sync.

No description available.

The product performs CPU computations using algorithms that are not as efficient as they could be for the needs of the developer, i.e., the computations can be optimized further.

The product released to market is released in pre-production or manufacturing configuration.