Common Weakness Enumeration (CWE)

The product stores sensitive information in cleartext in an executable.

During execution of non-reentrant code, the product performs a call that unintentionally produces a nested invocation of the non-reentrant code.

The product supports password aging, but the expiration period is too long.

The product stores sensitive information in cleartext in the registry.

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '....//' (doubled dot dot slash) sequences that can resolve to a location that is outside of that directory.

The logic level used to set a system to a secure state relies on a fuse being unblown. An attacker can set the system to an insecure state merely by blowing the fuse.

A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.

The product contains code that is designed to disrupt the legitimate operation of the product (or its environment) when a certain time passes, or when a certain logical condition is met.

This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.

The product contains an expression that will always evaluate to false.

The product sends non-cloned mutable data as an argument to a method or function.

The product initializes data using hard-coded values that act as network resource identifiers.

The product contains a class with inheritance from more than one concrete class.

The product contains protection mechanisms to restrict access to 'realdir/filename', but it constructs pathnames using external input in the form of 'fakedir/../realdir/filename' that are not handled by those mechanisms. This allows attackers to perform unauthorized actions against the targeted file.

The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants.

Configuring an ASP.NET application to run with impersonated credentials may give the application unnecessary privileges.

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as variable name delimiters when they are sent to a downstream component.

The product attempts to unlock a resource that is not locked.

The Servlet does not catch all exceptions, which may reveal sensitive debugging information.

No description available.

The product uses a dedicated, central data manager component as required by design, but it contains code that performs data-access operations that do not use this data manager.

The product does not handle or incorrectly handles a file name that identifies a "virtual" resource that is not directly specified within the directory that is associated with the file name, causing the product to perform file-based operations on a resource that is not a file.

The product unlocks a critical resource more times than intended, leading to an unexpected state in the system.

The product does not perform access checks on a resource every time the resource is accessed by an entity, which can create resultant weaknesses if that entity's rights or privileges change over time.

The product defines a large address region protected from modification by the same register lock control bit. This results in a conflict between the functional requirement that some addresses need to be writable by software during operation and the security requirement that the system configuration lock bit must be set during the boot process.