Common Weakness Enumeration (CWE)

The product violates the Enterprise JavaBeans (EJB) specification by using AWT/Swing.

The product violates the Enterprise JavaBeans (EJB) specification by using the java.io package.

The product violates the Enterprise JavaBeans (EJB) specification by using sockets.

The product violates the Enterprise JavaBeans (EJB) specification by using the class loader.

The product stores a non-serializable object as an HttpSession attribute, which can hurt reliability.

The product contains a clone() method that does not call super.clone() to obtain the new object.

The product does not maintain equal hashcodes for equal objects.

The product declares an array public, final, and static, which is not sufficient to prevent the array's contents from being modified.

The product violates secure coding principles for mobile code by declaring a finalize() method public.

The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.

The product contains an empty synchronized block.

The product makes an explicit call to the finalize() method from outside the finalizer.

The product uses an API function that does not exist on all versions of the target platform. This could cause portability problems or inconsistencies that allow denial of service or other consequences.

The product modifies the SSL context after connection creation has begun.

When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will complete successfully.

The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.

This weakness has been deprecated. It was poorly described and difficult to distinguish from other entries. It was also inappropriate to assign a separate ID solely because of domain-specific considerations. Its closest equivalent is CWE-1023.

A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package.

An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.

The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient.

If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor "dangling."

The Web services architecture may require exposing a Web Service Definition Language (WSDL) file that contains information on the publicly accessible services and how callers of these services should interact with them (e.g. what parameters they expect and what types they return).

The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.

The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.

The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses.