Common Weakness Enumeration (CWE)

The accidental addition of a data-structure sentinel can cause serious programming logic problems.

The code uses an operator for assignment when the intention was to perform a comparison.

The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.

The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.

Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.

Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers.

The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.

Assigning public data to a private array is equivalent to giving public access to the array.

The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.

An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.

A trapdoor is a hidden piece of code that responds to a special input, allowing its user access to resources without passing through the normal security enforcement mechanism.

The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product.

This weakness can be found at CWE-385.

A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.

In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system.

This entry has been deprecated because its abstraction was too low-level. See CWE-532.

The product uses the singleton pattern when creating a resource within a multithreaded environment.

This weakness has been deprecated because it partially overlaps CWE-470, it describes legitimate programmer behavior, and other portions will need to be integrated into other entries.

The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses.

The ASP.NET application does not use an input validation framework.

The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.

The product calls umask() with an incorrect argument that is specified as if it is an argument to chmod().

The product contains a finalize() method that does not call super.finalize().

The product calls a thread's run() method instead of calling start(), which causes the code to run in the thread of the caller instead of the callee.

The product violates the Enterprise JavaBeans (EJB) specification by using thread synchronization primitives.