Weakness classes (CWE)

1,245 pages, showing 901–1,000, ordered by identifier.

CWE-577 — EJB Bad Practices: Use of Sockets The product violates the Enterprise JavaBeans (EJB) specification by using sockets.
CWE-578 — EJB Bad Practices: Use of Class Loader The product violates the Enterprise JavaBeans (EJB) specification by using the class loader.
CWE-579 — J2EE Bad Practices: Non-serializable Object Stored in Session The product stores a non-serializable object as an HttpSession attribute, which can hurt reliability.
CWE-58 — Path Equivalence: Windows 8.3 Filename The product contains a protection mechanism that restricts access to a long filename on a Windows operating system,...
CWE-580 — clone() Method Without super.clone() The product contains a clone() method that does not call super.clone() to obtain the new object.
CWE-581 — Object Model Violation: Just One of Equals and Hashcode Defined The product does not maintain equal hashcodes for equal objects.
CWE-582 — Array Declared Public, Final, and Static The product declares an array public, final, and static, which is not sufficient to prevent the array's contents...
CWE-583 — finalize() Method Declared Public The product violates secure coding principles for mobile code by declaring a finalize() method public.
CWE-584 — Return Inside Finally Block The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be...
CWE-585 — Empty Synchronized Block The product contains an empty synchronized block.
CWE-586 — Explicit Call to Finalize() The product makes an explicit call to the finalize() method from outside the finalizer.
CWE-587 — Assignment of a Fixed Address to a Pointer The product sets a pointer to a specific address other than NULL or 0.
CWE-588 — Attempt to Access Child of a Non-structure Pointer Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption.
CWE-589 — Call to Non-ubiquitous API The product uses an API function that does not exist on all versions of the target platform. This could cause...
CWE-59 — Improper Link Resolution Before File Access ('Link Following') The product attempts to access a file based on the filename, but it does not properly prevent that filename from...
CWE-590 — Free of Memory not on the Heap The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions...
CWE-591 — Sensitive Data Storage in Improperly Locked Memory The product stores sensitive data in memory that is not locked, or that has been incorrectly locked, which might...
CWE-593 — Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created The product modifies the SSL context after connection creation has begun.
CWE-594 — J2EE Framework: Saving Unserializable Objects to Disk When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will...
CWE-595 — Comparison of Object References Instead of Object Contents The product compares object references instead of the contents of the objects themselves, preventing it from...
CWE-597 — Use of Wrong Operator in String Comparison The product uses the wrong operator when comparing a string, such as using '==' when the .equals() method should be...
CWE-598 — Use of HTTP Request With Sensitive Query String The web application uses an HTTP method to process a request, but the request includes sensitive information in the...
CWE-599 — Missing Validation of OpenSSL Certificate The product uses OpenSSL and trusts or uses a certificate without using the SSLgetverify_result() function to ensure...
CWE-6 — J2EE Misconfiguration: Insufficient Session-ID Length The J2EE application is configured to use an insufficient session ID length.
CWE-600 — Uncaught Exception in Servlet The Servlet does not catch all exceptions, which may reveal sensitive debugging information.
CWE-601 — URL Redirection to Untrusted Site ('Open Redirect') The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in...
CWE-602 — Client-Side Enforcement of Server-Side Security The product is composed of a server that relies on the client to implement a mechanism that is intended to protect...
CWE-603 — Use of Client-Side Authentication A client/server product performs authentication within client code but not in server code, allowing server-side...
CWE-605 — Multiple Binds to the Same Port When multiple sockets are allowed to bind to the same port, other services on that port may be stolen or spoofed.
CWE-606 — Unchecked Input for Loop Condition The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of...
CWE-607 — Public Static Final Field References Mutable Object A public or protected static final field references a mutable object, which allows the object to be changed by...
CWE-608 — Struts: Non-private Field in ActionForm Class An ActionForm class contains a field that has not been declared private, which can be accessed without using a...
CWE-609 — Double-Checked Locking The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but...
CWE-61 — UNIX Symbolic Link (Symlink) Following The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link...
CWE-610 — Externally Controlled Reference to a Resource in Another Sphere The product uses an externally controlled name or reference that resolves to a resource that is outside of the...
CWE-611 — Improper Restriction of XML External Entity Reference The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of...
CWE-612 — Improper Authorization of Index Containing Sensitive Information The product creates a search index of private or sensitive documents, but it does not properly limit index access to...
CWE-613 — Insufficient Session Expiration According to WASC, 'Insufficient Session Expiration is when a web site permits an attacker to reuse old session...
CWE-614 — Sensitive Cookie in HTTPS Session Without 'Secure' Attribute The Secure attribute for sensitive cookies in HTTPS sessions is not set.
CWE-615 — Inclusion of Sensitive Information in Source Code Comments While adding general comments is very useful, some programmers tend to leave important data, such as: filenames...
CWE-616 — Incomplete Identification of Uploaded File Variables (PHP) The PHP application uses an old method for processing uploaded files by referencing the four global variables that...
CWE-617 — Reachable Assertion The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an...
CWE-618 — Exposed Unsafe ActiveX Method An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that...
CWE-619 — Dangling Database Cursor ('Cursor Injection') If a database cursor is not closed properly, then it could become accessible to other users while retaining the same...
CWE-62 — UNIX Hard Link The product, when opening a file or directory, does not sufficiently account for when the name is associated with a...
CWE-620 — Unverified Password Change When setting a new password for a user, the product does not require knowledge of the original password, or using...
CWE-621 — Variable Extraction Error The product uses external input to determine the names of variables into which information is extracted, without...
CWE-622 — Improper Validation of Function Hook Arguments The product adds hooks to user-accessible API functions, but it does not properly validate the arguments. This could...
CWE-623 — Unsafe ActiveX Control Marked Safe For Scripting An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting.
CWE-624 — Executable Regular Expression Error The product uses a regular expression that either (1) contains an executable component with user-controlled inputs,...
CWE-625 — Permissive Regular Expression The product uses a regular expression that does not sufficiently restrict the set of allowed values.
CWE-626 — Null Byte Interaction Error (Poison Null Byte) The product does not properly handle null bytes or NUL characters when passing data between different...
CWE-627 — Dynamic Variable Evaluation In a language where the user can influence the name of a variable at runtime, if the variable names are not...
CWE-628 — Function Call with Incorrectly Specified Arguments The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to...
CWE-636 — Not Failing Securely ('Failing Open') When the product encounters an error condition or failure, its design requires it to fall back to a state that is...
CWE-637 — Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the...
CWE-638 — Not Using Complete Mediation The product does not perform access checks on a resource every time the resource is accessed by an entity, which can...
CWE-639 — Authorization Bypass Through User-Controlled Key The system's authorization functionality does not prevent one user from gaining access to another user's data or...
CWE-64 — Windows Shortcut Following (.LNK) The product, when opening a file or directory, does not sufficiently handle when the file is a Windows shortcut...
CWE-640 — Weak Password Recovery Mechanism for Forgotten Password The product contains a mechanism for users to recover or change their passwords without knowing the original...
CWE-641 — Improper Restriction of Names for Files and Other Resources The product constructs the name of a file or other resource using input from an upstream component, but it does not...
CWE-642 — External Control of Critical State Data The product stores security-critical state information about its users, or the product itself, in a location that is...
CWE-643 — Improper Neutralization of Data within XPath Expressions ('XPath Injection') The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML...
CWE-644 — Improper Neutralization of HTTP Headers for Scripting Syntax The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by...
CWE-645 — Overly Restrictive Account Lockout Mechanism The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be...
CWE-646 — Reliance on File Name or Extension of Externally-Supplied File The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the...
CWE-647 — Use of Non-Canonical URL Paths for Authorization Decisions The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is...
CWE-648 — Incorrect Use of Privileged APIs The product does not conform to the API requirements for a function call that requires extra privileges. This could...
CWE-649 — Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking The product uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the...
CWE-65 — Windows Hard Link The product, when opening a file or directory, does not sufficiently handle when the name is associated with a hard...
CWE-650 — Trusting HTTP Permission Methods on the Server Side The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause...
CWE-651 — Exposure of WSDL File Containing Sensitive Information The Web services architecture may require exposing a Web Service Definition Language (WSDL) file that contains...
CWE-652 — Improper Neutralization of Data within XQuery Expressions ('XQuery Injection') The product uses external input to dynamically construct an XQuery expression used to retrieve data from an XML...
CWE-653 — Improper Isolation or Compartmentalization The product does not properly compartmentalize or isolate functionality, processes, or resources that require...
CWE-654 — Reliance on a Single Factor in a Security Decision A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the...
CWE-655 — Insufficient Psychological Acceptability The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users...
CWE-656 — Reliance on Security Through Obscurity The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its...
CWE-657 — Violation of Secure Design Principles The product violates well-established principles for secure design.
CWE-66 — Improper Handling of File Names that Identify Virtual Resources The product does not handle or incorrectly handles a file name that identifies a 'virtual' resource that is not...
CWE-662 — Improper Synchronization The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared...
CWE-663 — Use of a Non-reentrant Function in a Concurrent Context The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread...
CWE-664 — Improper Control of a Resource Through its Lifetime The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation,...
CWE-665 — Improper Initialization The product does not initialize or incorrectly initializes a resource, which might leave the resource in an...
CWE-666 — Operation on Resource in Wrong Phase of Lifetime The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to...
CWE-667 — Improper Locking The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes...
CWE-668 — Exposure of Resource to Wrong Sphere The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to...
CWE-669 — Incorrect Resource Transfer Between Spheres The product does not properly transfer a resource/behavior to another sphere, or improperly imports a...
CWE-67 — Improper Handling of Windows Device Names The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname...
CWE-670 — Always-Incorrect Control Flow Implementation The code contains a control flow path that does not reflect the algorithm that the path is intended to implement,...
CWE-671 — Lack of Administrator Control over Security The product uses security features in a way that prevents the product's administrator from tailoring security...
CWE-672 — Operation on a Resource after Expiration or Release The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
CWE-673 — External Influence of Sphere Definition The product does not prevent the definition of control spheres from external actors.
CWE-674 — Uncontrolled Recursion The product does not properly control the amount of recursion that takes place, consuming excessive resources, such...
CWE-675 — Multiple Operations on Resource in Single-Operation Context The product performs the same operation on a resource two or more times, when the operation should only be applied once.
CWE-676 — Use of Potentially Dangerous Function The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly,...
CWE-680 — Integer Overflow to Buffer Overflow The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that...
CWE-681 — Incorrect Conversion between Numeric Types When converting from one data type to another, such as long to integer, data can be omitted or translated in a way...
CWE-682 — Incorrect Calculation The product performs a calculation that generates incorrect or unintended results that are later used in...
CWE-683 — Function Call With Incorrect Order of Arguments The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order,...
CWE-684 — Incorrect Provision of Specified Functionality The code does not function according to its published specifications, potentially leading to incorrect usage.

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.