Weakness classes (CWE)

1,245 pages, showing 301–400, ordered by identifier.

CWE-1284 — Improper Validation of Specified Quantity in Input The product receives input that is expected to specify a quantity (such as size or length), but it does not validate...
CWE-1285 — Improper Validation of Specified Index, Position, or Offset in Input The product receives input that is expected to specify an index, position, or offset into an indexable resource such...
CWE-1286 — Improper Validation of Syntactic Correctness of Input The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does...
CWE-1287 — Improper Validation of Specified Type of Input The product receives input that is expected to be of a certain type, but it does not validate or incorrectly...
CWE-1288 — Improper Validation of Consistency within Input The product receives a complex input with multiple elements or fields that must be consistent with each other, but...
CWE-1289 — Improper Validation of Unsafe Equivalence in Input The product receives an input value that is used as a resource identifier or other type of reference, but it does...
CWE-129 — Improper Validation of Array Index The product uses untrusted input when calculating or using an array index, but the product does not validate or...
CWE-1290 — Incorrect Decoding of Security Identifiers The product implements a decoding mechanism to decode certain bus-transaction signals to security identifiers. If...
CWE-1291 — Public Key Re-Use for Signing both Debug and Production Code The same public key is used for signing both debug and production code.
CWE-1292 — Incorrect Conversion of Security Identifiers The product implements a conversion mechanism to map certain bus-transaction signals to security identifiers....
CWE-1293 — Missing Source Correlation of Multiple Independent Data The product relies on one source of data, preventing the ability to detect if an adversary has compromised a data source.
CWE-1294 — Insecure Security Identifier Mechanism The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or...
CWE-1295 — Debug Messages Revealing Unnecessary Information The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information...
CWE-1296 — Incorrect Chaining or Granularity of Debug Components The product's debug components contain incorrect chaining or granularity of debug components.
CWE-1297 — Unprotected Confidential Information on Device is Accessible by OSAT Vendors The product does not adequately protect confidential information on the device from being accessed by Outsourced...
CWE-1298 — Hardware Logic Contains Race Conditions A race condition in the hardware logic results in undermining security guarantees of the system.
CWE-1299 — Missing Protection Mechanism for Alternate Hardware Interface The lack of protections on alternate paths to access control-protected assets (such as unprotected shadow registers...
CWE-13 — ASP.NET Misconfiguration: Password in Configuration File Storing a plaintext password in a configuration file allows anyone who can read the file access to the...
CWE-130 — Improper Handling of Length Parameter Inconsistency The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field...
CWE-1300 — Improper Protection of Physical Side Channels The device does not contain sufficient protection mechanisms to prevent physical side channels from exposing...
CWE-1301 — Insufficient or Incomplete Data Removal within Hardware Component The product's data removal process does not completely delete all data and potentially sensitive information within...
CWE-1302 — Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when...
CWE-1303 — Non-Transparent Sharing of Microarchitectural Resources Hardware structures shared across execution contexts (e.g., caches and branch predictors) can violate the expected...
CWE-1304 — Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation The product performs a power save/restore operation, but it does not ensure that the integrity of the configuration...
CWE-1306 — CISQ Quality Measures - Reliability CISQ Quality Measures - Reliability
CWE-1307 — CISQ Quality Measures - Maintainability CISQ Quality Measures - Maintainability
CWE-1308 — CISQ Quality Measures - Security CISQ Quality Measures - Security
CWE-1309 — CISQ Quality Measures - Efficiency CISQ Quality Measures - Efficiency
CWE-131 — Incorrect Calculation of Buffer Size The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CWE-1310 — Missing Ability to Patch ROM Code Missing an ability to patch ROM code may leave a System or System-on-Chip (SoC) in a vulnerable state.
CWE-1311 — Improper Translation of Security Attributes by Fabric Bridge The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted...
CWE-1312 — Missing Protection for Mirrored Regions in On-Chip Fabric Firewall The firewall in an on-chip fabric protects the main addressed region, but it does not protect any mirrored memory or...
CWE-1313 — Hardware Allows Activation of Test or Debug Logic at Runtime During runtime, the hardware allows for test or debug logic (feature) to be activated, which allows for changing the...
CWE-1314 — Missing Write Protection for Parametric Data Values The device does not write-protect the parametric data values for sensors that scale the sensor value, allowing...
CWE-1315 — Improper Setting of Bus Controlling Capability in Fabric End-point The bus controller enables bits in the fabric end-point to allow responder devices to control transactions on the fabric.
CWE-1316 — Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges The address map of the on-chip fabric has protected and unprotected regions overlapping, allowing an attacker to...
CWE-1317 — Improper Access Control in Fabric Bridge The product uses a fabric bridge for transactions between two Intellectual Property (IP) blocks, but the bridge does...
CWE-1318 — Missing Support for Security Features in On-chip Fabrics or Buses On-chip fabrics or buses either do not support or are not configured to support privilege separation or other...
CWE-1319 — Improper Protection against Electromagnetic Fault Injection (EM-FI) The device is susceptible to electromagnetic fault injection attacks, causing device internal information to be...
CWE-1320 — Improper Protection for Outbound Error Messages and Alert Signals Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles...
CWE-1321 — Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') The product receives input from an upstream component that specifies attributes that are to be initialized or...
CWE-1322 — Use of Blocking Code in Single-threaded, Non-blocking Context The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but...
CWE-1323 — Improper Management of Sensitive Trace Data Trace data collected from several sources on the System-on-Chip (SoC) is stored in unprotected locations or...
CWE-1325 — Improperly Controlled Sequential Memory Allocation The product manages a group of objects or resources and performs a separate memory allocation for each object, but...
CWE-1326 — Missing Immutable Root of Trust in Hardware A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted...
CWE-1327 — Binding to an Unrestricted IP Address The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource...
CWE-1328 — Security Version Number Mutable to Older Versions Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware...
CWE-1329 — Reliance on Component That is Not Updateable The product contains a component that cannot be updated or patched in order to remove vulnerabilities or significant bugs.
CWE-133 — String Errors String Errors
CWE-1330 — Remanent Data Readable after Memory Erase Confidential information stored in memory circuits is readable or recoverable after being cleared or erased.
CWE-1331 — Improper Isolation of Shared Resources in Network On Chip (NoC) The Network On Chip (NoC) does not isolate or incorrectly isolates its on-chip-fabric and internal resources such...
CWE-1332 — Improper Handling of Faults that Lead to Instruction Skips The device is missing or incorrectly implements circuitry or sensors that detect and mitigate the skipping of...
CWE-1333 — Inefficient Regular Expression Complexity The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly...
CWE-1334 — Unauthorized Error Injection Can Degrade Hardware Redundancy An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system...
CWE-1335 — Incorrect Bitwise Shift of Integer An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of...
CWE-1336 — Improper Neutralization of Special Elements Used in a Template Engine The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or...
CWE-1338 — Improper Protections Against Hardware Overheating A hardware device is missing or has inadequate protection features to prevent overheating.
CWE-1339 — Insufficient Precision or Accuracy of a Real Number The product processes a real number with an implementation in which the number's representation does not preserve...
CWE-134 — Use of Externally-Controlled Format String The product uses a function that accepts a format string as an argument, but the format string originates from an...
CWE-1341 — Multiple Releases of Same Resource or Handle The product attempts to close or release a resource or handle more than once, without any successful open between...
CWE-1342 — Information Exposure through Microarchitectural State after Transient Execution The processor does not properly clear microarchitectural state after incorrect microcode assists or speculative...
CWE-1345 — OWASP Top Ten 2021 Category A01:2021 - Broken Access Control OWASP Top Ten 2021 Category A01:2021 - Broken Access Control
CWE-1346 — OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures
CWE-1347 — OWASP Top Ten 2021 Category A03:2021 - Injection OWASP Top Ten 2021 Category A03:2021 - Injection
CWE-1348 — OWASP Top Ten 2021 Category A04:2021 - Insecure Design OWASP Top Ten 2021 Category A04:2021 - Insecure Design
CWE-1349 — OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration
CWE-135 — Incorrect Calculation of Multi-Byte String Length The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.
CWE-1351 — Improper Handling of Hardware Behavior in Exceptionally Cold Environments A hardware device, or the firmware running on it, is missing or has incorrect protection features to maintain goals...
CWE-1352 — OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components
CWE-1353 — OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures
CWE-1354 — OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures
CWE-1355 — OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures
CWE-1356 — OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF) OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF)
CWE-1357 — Reliance on Insufficiently Trustworthy Component The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to...
CWE-1359 — ICS Communications ICS Communications
CWE-136 — Type Errors Type Errors
CWE-1360 — ICS Dependencies (& Architecture) ICS Dependencies (& Architecture)
CWE-1361 — ICS Supply Chain ICS Supply Chain
CWE-1362 — ICS Engineering (Constructions/Deployment) ICS Engineering (Constructions/Deployment)
CWE-1363 — ICS Operations (& Maintenance) ICS Operations (& Maintenance)
CWE-1364 — ICS Communications: Zone Boundary Failures ICS Communications: Zone Boundary Failures
CWE-1365 — ICS Communications: Unreliability ICS Communications: Unreliability
CWE-1366 — ICS Communications: Frail Security in Protocols ICS Communications: Frail Security in Protocols
CWE-1367 — ICS Dependencies (& Architecture): External Physical Systems ICS Dependencies (& Architecture): External Physical Systems
CWE-1368 — ICS Dependencies (& Architecture): External Digital Systems ICS Dependencies (& Architecture): External Digital Systems
CWE-1369 — ICS Supply Chain: IT/OT Convergence/Expansion ICS Supply Chain: IT/OT Convergence/Expansion
CWE-137 — Data Neutralization Issues Data Neutralization Issues
CWE-1370 — ICS Supply Chain: Common Mode Frailties ICS Supply Chain: Common Mode Frailties
CWE-1371 — ICS Supply Chain: Poorly Documented or Undocumented Features ICS Supply Chain: Poorly Documented or Undocumented Features
CWE-1372 — ICS Supply Chain: OT Counterfeit and Malicious Corruption ICS Supply Chain: OT Counterfeit and Malicious Corruption
CWE-1373 — ICS Engineering (Construction/Deployment): Trust Model Problems ICS Engineering (Construction/Deployment): Trust Model Problems
CWE-1374 — ICS Engineering (Construction/Deployment): Maker Breaker Blindness ICS Engineering (Construction/Deployment): Maker Breaker Blindness
CWE-1375 — ICS Engineering (Construction/Deployment): Gaps in Details/Data ICS Engineering (Construction/Deployment): Gaps in Details/Data
CWE-1376 — ICS Engineering (Construction/Deployment): Security Gaps in Commissioning ICS Engineering (Construction/Deployment): Security Gaps in Commissioning
CWE-1377 — ICS Engineering (Construction/Deployment): Inherent Predictability in Design ICS Engineering (Construction/Deployment): Inherent Predictability in Design
CWE-1378 — ICS Operations (& Maintenance): Gaps in obligations and training ICS Operations (& Maintenance): Gaps in obligations and training
CWE-1379 — ICS Operations (& Maintenance): Human factors in ICS environments ICS Operations (& Maintenance): Human factors in ICS environments
CWE-138 — Improper Neutralization of Special Elements The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-1380 — ICS Operations (& Maintenance): Post-analysis changes ICS Operations (& Maintenance): Post-analysis changes
CWE-1381 — ICS Operations (& Maintenance): Exploitable Standard Operational Procedures ICS Operations (& Maintenance): Exploitable Standard Operational Procedures

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.