Weakness classes (CWE)

1,245 pages, showing 201–300, ordered by identifier.

CWE-1192 — Improper Identifier for IP Block used in System-On-Chip (SOC) The System-on-Chip (SoC) does not have unique, immutable identifiers for each of its components.
CWE-1193 — Power-On of Untrusted Execution Core Before Enabling Fabric Access Control The product enables components that contain untrusted firmware before memory and fabric access controls have been enabled.
CWE-1195 — Manufacturing and Life Cycle Management Concerns Manufacturing and Life Cycle Management Concerns
CWE-1196 — Security Flow Issues Security Flow Issues
CWE-1197 — Integration Issues Integration Issues
CWE-1198 — Privilege Separation and Access Control Issues Privilege Separation and Access Control Issues
CWE-1199 — General Circuit and Logic Design Concerns General Circuit and Logic Design Concerns
CWE-12 — ASP.NET Misconfiguration: Missing Custom Error Page An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from...
CWE-120 — Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less...
CWE-1201 — Core and Compute Issues Core and Compute Issues
CWE-1202 — Memory and Storage Issues Memory and Storage Issues
CWE-1203 — Peripherals, On-chip Fabric, and Interface/IO Problems Peripherals, On-chip Fabric, and Interface/IO Problems
CWE-1204 — Generation of Weak Initialization Vector (IV) The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not...
CWE-1205 — Security Primitives and Cryptography Issues Security Primitives and Cryptography Issues
CWE-1206 — Power, Clock, Thermal, and Reset Concerns Power, Clock, Thermal, and Reset Concerns
CWE-1207 — Debug and Test Problems Debug and Test Problems
CWE-1208 — Cross-Cutting Problems Cross-Cutting Problems
CWE-1209 — Failure to Disable Reserved Bits The reserved bits in a hardware design are not disabled prior to production. Typically, reserved bits are used for...
CWE-121 — Stack-based Buffer Overflow A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack...
CWE-1210 — Audit / Logging Errors Audit / Logging Errors
CWE-1211 — Authentication Errors Authentication Errors
CWE-1212 — Authorization Errors Authorization Errors
CWE-1213 — Random Number Issues Random Number Issues
CWE-1214 — Data Integrity Issues Data Integrity Issues
CWE-1215 — Data Validation Issues Data Validation Issues
CWE-1216 — Lockout Mechanism Errors Lockout Mechanism Errors
CWE-1217 — User Session Errors User Session Errors
CWE-1218 — Memory Buffer Errors Memory Buffer Errors
CWE-1219 — File Handling Issues File Handling Issues
CWE-122 — Heap-based Buffer Overflow A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap...
CWE-1220 — Insufficient Granularity of Access Control The product implements access controls via a policy or other feature with the intention to disable or restrict...
CWE-1221 — Incorrect Register Defaults or Module Parameters Hardware description language code incorrectly defines register defaults or hardware Intellectual Property (IP)...
CWE-1222 — Insufficient Granularity of Address Regions Protected by Register Locks The product defines a large address region protected from modification by the same register lock control bit. This...
CWE-1223 — Race Condition for Write-Once Attributes A write-once register in hardware design is programmable by an untrusted software component earlier than the trusted...
CWE-1224 — Improper Restriction of Write-Once Bit Fields The hardware design control register 'sticky bits' or write-once bit fields are improperly implemented, such that...
CWE-1225 — Documentation Issues Documentation Issues
CWE-1226 — Complexity Issues Complexity Issues
CWE-1227 — Encapsulation Issues Encapsulation Issues
CWE-1228 — API / Function Errors API / Function Errors
CWE-1229 — Creation of Emergent Resource The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used...
CWE-123 — Write-what-where Condition Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the...
CWE-1230 — Exposure of Sensitive Information Through Metadata The product prevents direct access to a resource containing sensitive information, but it does not sufficiently...
CWE-1231 — Improper Prevention of Lock Bit Modification The product uses a trusted lock bit for restricting access to registers, address regions, or other resources, but...
CWE-1232 — Improper Lock Behavior After Power State Transition Register lock bit protection disables changes to system configuration once the bit is set. Some of the protected...
CWE-1233 — Security-Sensitive Hardware Controls with Missing Lock Bit Protection The product uses a register lock bit protection mechanism, but it does not ensure that the lock bit prevents...
CWE-1234 — Hardware Internal or Debug Modes Allow Override of Locks System configuration protection may be bypassed during debug mode.
CWE-1235 — Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations The code uses boxed primitives, which may introduce inefficiencies into performance-critical operations.
CWE-1236 — Improper Neutralization of Formula Elements in a CSV File The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or...
CWE-1237 — SFP Primary Cluster: Faulty Resource Release SFP Primary Cluster: Faulty Resource Release
CWE-1238 — SFP Primary Cluster: Failure to Release Memory SFP Primary Cluster: Failure to Release Memory
CWE-1239 — Improper Zeroization of Hardware Register The hardware product does not properly clear sensitive information from built-in registers when the user of the...
CWE-124 — Buffer Underwrite ('Buffer Underflow') The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of...
CWE-1240 — Use of a Cryptographic Primitive with a Risky Implementation To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a...
CWE-1241 — Use of Predictable Algorithm in Random Number Generator The device uses an algorithm that is predictable and generates a pseudo-random number.
CWE-1242 — Inclusion of Undocumented Features or Chicken Bits The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.
CWE-1243 — Sensitive Non-Volatile Information Not Protected During Debug Access to security-sensitive information stored in fuses is not limited during debug.
CWE-1244 — Internal Asset Exposed to Unsafe Debug Access Level or State The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong...
CWE-1245 — Improper Finite State Machines (FSMs) in Hardware Logic Faulty finite state machines (FSMs) in the hardware logic allow an attacker to put the system in an undefined state,...
CWE-1246 — Improper Write Handling in Limited-write Non-Volatile Memories The product does not implement or incorrectly implements wear leveling operations in limited-write non-volatile memories.
CWE-1247 — Improper Protection Against Voltage and Clock Glitches The device does not contain or contains incorrectly implemented circuitry or sensors to detect and mitigate voltage...
CWE-1248 — Semiconductor Defects in Hardware Logic with Security-Sensitive Implications The security-sensitive hardware module contains semiconductor defects.
CWE-1249 — Application-Level Admin Tool with Inconsistent View of Underlying Operating System The product provides an application for administrators to manage parts of the underlying operating system, but the...
CWE-125 — Out-of-bounds Read The product reads data past the end, or before the beginning, of the intended buffer.
CWE-1250 — Improper Preservation of Consistency Between Independent Representations of Shared State The product has or supports multiple distributed components or sub-systems that are each required to keep their own...
CWE-1251 — Mirrored Regions with Different Values The product's architecture mirrors regions without ensuring that their contents always stay in sync.
CWE-1252 — CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations The CPU is not configured to provide hardware support for exclusivity of write and execute operations on memory....
CWE-1253 — Incorrect Selection of Fuse Values The logic level used to set a system to a secure state relies on a fuse being unblown.
CWE-1254 — Incorrect Comparison Logic Granularity The product's comparison logic is performed over a series of steps rather than across the entire string in one...
CWE-1255 — Comparison Logic is Vulnerable to Power Side-Channel Attacks A device's real time power consumption may be monitored during security token evaluation and the information gleaned...
CWE-1256 — Improper Restriction of Software Interfaces to Hardware Features The product provides software-controllable device functionality for capabilities such as power and clock management,...
CWE-1257 — Improper Access Control Applied to Mirrored or Aliased Memory Regions Aliased or mirrored memory regions in hardware designs may have inconsistent read/write permissions enforced by the...
CWE-1258 — Exposure of Sensitive System Information Due to Uncleared Debug Information The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic...
CWE-1259 — Improper Restriction of Security Token Assignment The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or...
CWE-126 — Buffer Over-read The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory...
CWE-1260 — Improper Handling of Overlap Between Protected Memory Ranges The product allows address regions to overlap, which can result in the bypassing of intended memory protection.
CWE-1261 — Improper Handling of Single Event Upsets The hardware logic does not effectively handle when single-event upsets (SEUs) occur.
CWE-1262 — Improper Access Control for Register Interface The product uses memory-mapped I/O registers that act as an interface to hardware functionality from software, but...
CWE-1263 — Improper Physical Access Control The product is designed with access restricted to certain information, but it does not sufficiently protect against...
CWE-1264 — Hardware Logic with Insecure De-Synchronization between Control and Data Channels The hardware logic for error handling and security checks can incorrectly forward data before the security check is complete.
CWE-1265 — Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls The product invokes code that is believed to be reentrant, but the code performs a call that unintentionally...
CWE-1266 — Improper Scrubbing of Sensitive Data from Decommissioned Device The product does not properly provide a capability for the product administrator to remove sensitive data at the...
CWE-1267 — Policy Uses Obsolete Encoding The product uses an obsolete encoding mechanism to implement access controls.
CWE-1268 — Policy Privileges are not Assigned Consistently Between Control and Data Agents The product's hardware-enforced access control for a particular resource improperly accounts for privilege...
CWE-1269 — Product Released in Non-Release Configuration The product released to market is released in pre-production or manufacturing configuration.
CWE-127 — Buffer Under-read The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory...
CWE-1270 — Generation of Incorrect Security Tokens The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a...
CWE-1271 — Uninitialized Value on Reset for Registers Holding Security Settings Security-critical logic is not set to a known value on reset.
CWE-1272 — Sensitive Information Uncleared Before Debug/Power State Transition The product performs a power or debug state transition, but it does not clear sensitive information that should no...
CWE-1273 — Device Unlock Credential Sharing The credentials necessary for unlocking a device are shared across multiple parties and may expose sensitive information.
CWE-1274 — Improper Access Control for Volatile Memory Containing Boot Code The product conducts a secure-boot process that transfers bootloader code from Non-Volatile Memory (NVM) into...
CWE-1275 — Sensitive Cookie with Improper SameSite Attribute The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
CWE-1276 — Hardware Child Block Incorrectly Connected to Parent System Signals between a hardware IP and the parent system design are incorrectly connected causing security risks.
CWE-1277 — Firmware Not Updateable The product does not provide its users with the ability to update or patch its firmware to address any...
CWE-1278 — Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques Information stored in hardware may be recovered by an attacker with the capability to capture and analyze images of...
CWE-1279 — Cryptographic Operations are run Before Supporting Units are Ready Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may...
CWE-128 — Wrap-around Error Wrap around errors occur whenever a value is incremented past the maximum value for its type and therefore 'wraps...
CWE-1280 — Access Control Check Implemented After Asset is Accessed A product's hardware-based access control check occurs after the asset has been accessed.
CWE-1281 — Sequence of Processor Instructions Leads to Unexpected Behavior Specific combinations of processor instructions lead to undesirable behavior such as locking the processor until a...
CWE-1282 — Assumed-Immutable Data is Stored in Writable Memory Immutable data, such as a first-stage bootloader, device identifiers, and 'write-once' configuration settings are...
CWE-1283 — Mutable Attestation or Measurement Reporting Data The register contents used for attestation or measurement reporting data to verify boot flow are modifiable by an adversary.

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.