Common Weakness Enumeration (CWE)

A handler is not available or implemented.

The product enables a Direct Memory Access (DMA) capable device before the security configuration settings are established, which allows an attacker to extract data from or gain privileges on the product.

The product defines a signal handler that calls a non-reentrant function.

No description available.

Hardware description language code incorrectly defines register defaults or hardware Intellectual Property (IP) parameters to insecure values.

The product does not handle or incorrectly handles when a particular parameter, field, or argument name is not defined or supported by the product.

The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.

If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.

The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.

The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.

The product performs a power or debug state transition, but it does not clear sensitive information that should no longer be accessible due to changes to information access restrictions.

The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

The J2EE application stores a plaintext password in a configuration file.

A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system.

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "..\" sequences that can resolve to a location that is outside of that directory.

The product accepts path input in the form of multiple leading slash ('//multiple/leading/slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.

The product does not implement or incorrectly implements wear leveling operations in limited-write non-volatile memories.

The document does not fully define all mechanisms that are used to control or influence how product-specific programs are executed.

An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode.

The product's architecture mirrors regions without ensuring that their contents always stay in sync.

No description available.

The product adds hooks to user-accessible API functions, but it does not properly validate the arguments. This could lead to resultant vulnerabilities.

The product defines a signal handler that contains code sequences that are not asynchronous-safe, i.e., the functionality is not reentrant, or it can be interrupted.

A write-once register in hardware design is programmable by an untrusted software component earlier than the trusted software component, resulting in a race condition issue.

The source code uses symbolic constants, but it does not sufficiently place the definitions of these constants into a more centralized or isolated location.