Common Weakness Enumeration (CWE)

When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will complete successfully.

The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.

This weakness has been deprecated. It was poorly described and difficult to distinguish from other entries. It was also inappropriate to assign a separate ID solely because of domain-specific considerations. Its closest equivalent is CWE-1023.

A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package.

An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.

The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient.

If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor "dangling."

The Web services architecture may require exposing a Web Service Definition Language (WSDL) file that contains information on the publicly accessible services and how callers of these services should interact with them (e.g. what parameters they expect and what types they return).

The product declares a critical variable, field, or member to be public when intended security policy requires it to be private.

The product does not properly maintain references to a file descriptor or handle, which prevents that file descriptor/handle from being reclaimed.

The product defines an IOCTL that uses METHOD_NEITHER for I/O, but it does not validate or incorrectly validates the addresses that are provided.

The product invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX.

The product receives data from an upstream component, but only filters a single instance of a special element before sending it to a downstream component.

The product receives data from an upstream component, but only accounts for special elements at a specified location, thereby missing remaining special elements that may exist before sending it to a downstream component.

The product receives data from an upstream component, but only accounts for special elements positioned relative to a marker (e.g. "at the beginning/end of a string; the second argument"), thereby missing remaining special elements that may exist before sending it to a downstream component.

The product receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. "byte number 10"), thereby missing remaining special elements that may exist before sending it to a downstream component.

The product uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.

The product defines a function that is used as a handler for more than one signal.

The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

The code contains a member element that is declared as static (but not final), in which its parent class element is not a singleton class - that is, a class element that can be used only once in the 'to' association of a Create action.

The product uses a data element that has an excessively large number of sub-elements with non-primitive data types such as structures or aggregated objects.

The product's architecture contains too many - or too few - horizontal layers.

A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.

The product contains modules in which one module has references that cycle back to itself, i.e., there are circular dependencies.

The code contains callable control elements that contain an excessively large number of references to other application objects external to the context of the callable, i.e. a Fan-Out value that is excessively large.