Common Weakness Enumeration (CWE)

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes trailing special elements that could be interpreted in unexpected ways when they are sent to a downstream component.

The product does not properly handle when the same input uses several different (mixed) encodings.

The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points.

The product truncates the display, recording, or processing of security-relevant information in a way that can obscure the source or nature of an attack.

The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.

The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server.

This weakness can be found at CWE-113.

The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.

The code does not have a default case in an expression with multiple conditions, such as a switch statement.

The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.

The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.

A covert storage channel transfers information through the setting of bits by one program and the reading of those bits by another. What distinguishes this case from that of ordinary operation is that the bits are used to convey encoded information.

This entry has been deprecated because its abstraction was too low-level. See CWE-532.

The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the mechanism is not correctly understood, modeled, configured, implemented, or used.

The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.

The product uses low-level functionality that is explicitly prohibited by the framework or specification under which the product is supposed to operate.

The product locks a critical resource more times than intended, leading to an unexpected state in the system.

The product contains a conditional statement with multiple logical expressions in which one of the non-leading expressions may produce side effects. This may lead to an unexpected state in the program after the execution of the conditional, because short-circuiting logic may prevent the side effects from occurring.

The code contains a function or method that operates in a multi-threaded environment but owns an unsafe non-final static storable or member data element.

The product contains a serializable data element that does not have an associated serialization method.

The product contains a data query against an SQL table or view that is configured in a way that does not utilize an index and may cause sequential searches to be performed.

The product accesses a data resource through a database without using a connection pooling capability.

The source code does not follow desired style or formatting for indentation, white space, comments, etc.

The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.

The product provides an application for administrators to manage parts of the underlying operating system, but the application does not accurately identify all of the relevant entities or resources that exist in the OS; that is, the application's model of the OS's state is inconsistent with the OS's actual state.