Common Weakness Enumeration (CWE)

The product does not properly handle when the same input uses several different (mixed) encodings.

The product validates data before it has been filtered, which prevents the product from detecting data that becomes invalid after the filtering step.

The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points.

The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

This entry has been deprecated because it incorporated and confused multiple weaknesses. The issues formerly covered in this entry can be found at CWE-766 and CWE-767.

This weakness has been deprecated because it was a duplicate of CWE-493. All content has been transferred to CWE-493.

The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties.

The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

The product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.

This weakness can be found at CWE-199.

The product does not handle or incorrectly handles when a particular structural element is not completely specified.

The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.

The J2EE application directly manages connections, instead of using the container's connection management facilities.

The J2EE application directly uses sockets instead of using framework method calls.

This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.

This entry has been deprecated. There are no documented cases in which a switch's control expression is evaluated more than once.

This entry was deprecated because it overlapped the same concepts as race condition (CWE-362) and Improper Synchronization (CWE-662).

Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.

A J2EE application uses System.exit(), which also shuts down its container.

Thread management in a Web application is forbidden in some circumstances and is always highly error prone.

Throwing overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.

This entry has been deprecated because it was a duplicate of CWE-441. All content has been transferred to CWE-441.

The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running.

A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B.

This weakness has been deprecated because its name and description did not match. The description duplicated CWE-454, while the name suggested a more abstract initialization problem. Please refer to CWE-665 for the more abstract problem.