Common Weakness Enumeration (CWE)

The J2EE application directly uses sockets instead of using framework method calls.

This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.

This entry has been deprecated. There are no documented cases in which a switch's control expression is evaluated more than once.

This entry was deprecated because it overlapped the same concepts as race condition (CWE-362) and Improper Synchronization (CWE-662).

Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.

A J2EE application uses System.exit(), which also shuts down its container.

Thread management in a Web application is forbidden in some circumstances and is always highly error prone.

Throwing overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.

This entry has been deprecated because it was a duplicate of CWE-441. All content has been transferred to CWE-441.

The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running.

A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B.

This weakness has been deprecated because its name and description did not match. The description duplicated CWE-454, while the name suggested a more abstract initialization problem. Please refer to CWE-665 for the more abstract problem.

The accidental addition of a data-structure sentinel can cause serious programming logic problems.

The code uses an operator for assignment when the intention was to perform a comparison.

The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.

Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.

Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers.

The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.

Assigning public data to a private array is equivalent to giving public access to the array.

The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.

An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.

A trapdoor is a hidden piece of code that responds to a special input, allowing its user access to resources without passing through the normal security enforcement mechanism.

The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product.

This weakness can be found at CWE-385.

A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.