Common Weakness Enumeration (CWE)

This entry has been deprecated as it represents a specific observed example of a UNIX Hard Link weakness type rather than its own individual weakness type. Please refer to CWE-62.

The product does not properly handle special paths that may identify the data or resource fork of a file on the HFS+ file system.

The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().

If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.

The product has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation.

When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.

An unused validation form indicates that validation logic is not up-to-date.

Every Action Form must have a corresponding validation form.

Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation.

Validation fields that do not appear in forms they are associated with indicate that the validation logic is out of date.

This entry has been deprecated because it was a duplicate of CWE-170. All content has been transferred to CWE-170.

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as comment delimiters when they are sent to a downstream component.

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as macro symbols when they are sent to a downstream component.

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple leading special elements that could be interpreted in unexpected ways when they are sent to a downstream component.

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple trailing special elements that could be interpreted in unexpected ways when they are sent to a downstream component.

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.

The product validates data before it has been filtered, which prevents the product from detecting data that becomes invalid after the filtering step.

The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

This entry has been deprecated because it incorporated and confused multiple weaknesses. The issues formerly covered in this entry can be found at CWE-766 and CWE-767.

This weakness has been deprecated because it was a duplicate of CWE-493. All content has been transferred to CWE-493.

The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties.

This weakness can be found at CWE-199.

The product does not handle or incorrectly handles when a particular structural element is not completely specified.

The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.

The J2EE application directly manages connections, instead of using the container's connection management facilities.