Weakness classes (CWE)

1,245 pages, showing 701–800, ordered by identifier.

CWE-374 — Passing Mutable Objects to an Untrusted Method The product sends non-cloned mutable data as an argument to a method or function.
CWE-375 — Returning a Mutable Object to an Untrusted Caller Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.
CWE-377 — Insecure Temporary File Creating and using insecure temporary files can leave application and system data vulnerable to attack.
CWE-378 — Creation of Temporary File With Insecure Permissions Opening temporary files without appropriate measures or controls can leave the file, its contents and any function...
CWE-379 — Creation of Temporary File in Directory with Insecure Permissions The product creates a temporary file in a directory whose permissions allow unintended actors to determine the...
CWE-38 — Path Traversal: '\absolute\pathname\here' The product accepts input in the form of a backslash absolute path ('absolutepathnamehere') without appropriate...
CWE-382 — J2EE Bad Practices: Use of System.exit() A J2EE application uses System.exit(), which also shuts down its container.
CWE-383 — J2EE Bad Practices: Direct Use of Threads Thread management in a Web application is forbidden in some circumstances and is always highly error prone.
CWE-384 — Session Fixation Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session...
CWE-385 — Covert Timing Channel Covert timing channels convey information by modulating some aspect of system behavior over time, so that the...
CWE-386 — Symbolic Name not Mapping to Correct Object A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time.
CWE-387 — Signal Errors Signal Errors
CWE-388 — 7PK - Errors 7PK - Errors
CWE-389 — Error Conditions, Return Values, Status Codes Error Conditions, Return Values, Status Codes
CWE-39 — Path Traversal: 'C:dirname' The product accepts input that contains a drive letter or Windows volume letter ('C:dirname') that potentially...
CWE-390 — Detection of Error Condition Without Action The product detects a specific error, but takes no actions to handle the error.
CWE-391 — Unchecked Error Condition [PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and...
CWE-392 — Missing Report of Error Condition The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.
CWE-393 — Return of Wrong Status Code A function or operation returns an incorrect return value or status code that does not indicate the true result of...
CWE-394 — Unexpected Status Code or Return Value The product does not properly check when a function or operation returns a value that is legitimate for the...
CWE-395 — Use of NullPointerException Catch to Detect NULL Pointer Dereference Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a...
CWE-396 — Declaration of Catch for Generic Exception Catching overly broad exceptions promotes complex error handling code that is more likely to contain security...
CWE-397 — Declaration of Throws for Generic Exception The product throws or raises an overly broad exceptions that can hide important details and produce inappropriate...
CWE-398 — 7PK - Code Quality 7PK - Code Quality
CWE-399 — Resource Management Errors Resource Management Errors
CWE-40 — Path Traversal: '\\UNC\share\name\' (Windows UNC Share) The product accepts input that identifies a Windows UNC share ('UNCsharename') that potentially redirects access to...
CWE-400 — Uncontrolled Resource Consumption The product does not properly control the allocation and maintenance of a limited resource.
CWE-401 — Missing Release of Memory after Effective Lifetime The product does not sufficiently track and release allocated memory after it has been used, making the memory...
CWE-402 — Transmission of Private Resources into a New Sphere ('Resource Leak') The product makes resources available to untrusted parties when those resources are only intended to be accessed by...
CWE-403 — Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak') A process does not close sensitive file descriptors before invoking a child process, which allows the child to...
CWE-404 — Improper Resource Shutdown or Release The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-405 — Asymmetric Resource Consumption (Amplification) The product does not properly control situations in which an adversary can cause the product to consume or produce...
CWE-406 — Insufficient Control of Network Message Volume (Network Amplification) The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause...
CWE-407 — Inefficient Algorithmic Complexity An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system...
CWE-408 — Incorrect Behavior Order: Early Amplification The product allows an entity to perform a legitimate but expensive operation before authentication or authorization...
CWE-409 — Improper Handling of Highly Compressed Data (Data Amplification) The product does not handle or incorrectly handles a compressed input with a very high compression ratio that...
CWE-41 — Improper Resolution of Path Equivalence The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the...
CWE-410 — Insufficient Resource Pool The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others...
CWE-411 — Resource Locking Problems Resource Locking Problems
CWE-412 — Unrestricted Externally Accessible Lock The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by...
CWE-413 — Improper Resource Locking The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.
CWE-414 — Missing Lock Check A product does not check to see if a lock is present before performing sensitive operations on a resource.
CWE-415 — Double Free The product calls free() twice on the same memory address.
CWE-416 — Use After Free The product reuses or references memory after it has been freed. At some point afterward, the memory may be...
CWE-417 — Communication Channel Errors Communication Channel Errors
CWE-419 — Unprotected Primary Channel The product uses a primary channel for administration or restricted functionality, but it does not properly protect...
CWE-42 — Path Equivalence: 'filename.' (Trailing Dot) The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can...
CWE-420 — Unprotected Alternate Channel The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
CWE-421 — Race Condition During Access to Alternate Channel The product opens an alternate channel to communicate with an authorized user, but the channel is accessible to other actors.
CWE-422 — Unprotected Windows Messaging Channel ('Shatter') The product does not properly verify the source of a message in the Windows Messaging System while running at...
CWE-424 — Improper Protection of Alternate Path The product does not sufficiently protect all possible paths that a user can take to access restricted functionality...
CWE-425 — Direct Request ('Forced Browsing') The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
CWE-426 — Untrusted Search Path The product searches for critical resources using an externally-supplied search path that can point to resources...
CWE-427 — Uncontrolled Search Path Element The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be...
CWE-428 — Unquoted Search Path or Element The product uses a search path that contains an unquoted element, in which the element contains whitespace or other...
CWE-429 — Handler Errors Handler Errors
CWE-43 — Path Equivalence: 'filename....' (Multiple Trailing Dot) The product accepts path input in the form of multiple trailing dot ('filedir....') without appropriate validation,...
CWE-430 — Deployment of Wrong Handler The wrong 'handler' is assigned to process an object.
CWE-431 — Missing Handler A handler is not available or implemented.
CWE-432 — Dangerous Signal Handler not Disabled During Sensitive Operations The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or...
CWE-433 — Unparsed Raw Web Content Delivery The product stores raw content or supporting code under the web document root with an extension that is not...
CWE-434 — Unrestricted Upload of File with Dangerous Type The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-435 — Improper Interaction Between Multiple Correctly-Behaving Entities An interaction error occurs when two entities have correct behavior when running independently of each other, but...
CWE-436 — Interpretation Conflict Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on...
CWE-437 — Incomplete Model of Endpoint Features A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of...
CWE-438 — Behavioral Problems Behavioral Problems
CWE-439 — Behavioral Change in New Version or Environment A's behavior or functionality changes with a new version of A, or a new environment, which is not known (or manageable) by B.
CWE-44 — Path Equivalence: 'file.name' (Internal Dot) The product accepts path input in the form of internal dot ('file.ordir') without appropriate validation, which can...
CWE-440 — Expected Behavior Violation A feature, API, or function does not perform according to its specification.
CWE-441 — Unintended Proxy or Intermediary ('Confused Deputy') The product receives a request, message, or directive from an upstream component, but the product does not...
CWE-444 — Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities...
CWE-446 — UI Discrepancy for Security Feature The user interface does not correctly enable or configure a security feature, but the interface provides feedback...
CWE-447 — Unimplemented or Unsupported Feature in UI A UI function for a security feature appears to be supported and gives feedback to the user that suggests that it is...
CWE-448 — Obsolete Feature in UI A UI function is obsolete and the product does not warn the user.
CWE-449 — The UI Performs the Wrong Action The UI performs the wrong action with respect to the user's request.
CWE-45 — Path Equivalence: 'file...name' (Multiple Internal Dot) The product accepts path input in the form of multiple internal dot ('file...dir') without appropriate validation,...
CWE-450 — Multiple Interpretations of UI Input The UI has multiple interpretations of user input but does not prompt the user when it selects the less secure...
CWE-451 — User Interface (UI) Misrepresentation of Critical Information The user interface (UI) does not properly represent critical information to the user, allowing the information - or...
CWE-452 — Initialization and Cleanup Errors Initialization and Cleanup Errors
CWE-453 — Insecure Default Variable Initialization The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
CWE-454 — External Initialization of Trusted Variables or Data Stores The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.
CWE-455 — Non-exit on Failed Initialization The product does not exit or otherwise modify its operation when security-relevant errors occur during...
CWE-456 — Missing Initialization of a Variable The product does not initialize critical variables, which causes the execution environment to use unexpected values.
CWE-457 — Use of Uninitialized Variable The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CWE-459 — Incomplete Cleanup The product does not properly 'clean up' and remove temporary or supporting resources after they have been used.
CWE-46 — Path Equivalence: 'filename ' (Trailing Space) The product accepts path input in the form of trailing space ('filedir ') without appropriate validation, which can...
CWE-460 — Improper Cleanup on Thrown Exception The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to...
CWE-462 — Duplicate Key in Associative List (Alist) Duplicate keys in associative lists can lead to non-unique keys being mistaken for an error.
CWE-463 — Deletion of Data Structure Sentinel The accidental deletion of a data-structure sentinel can cause serious programming logic problems.
CWE-464 — Addition of Data Structure Sentinel The accidental addition of a data-structure sentinel can cause serious programming logic problems.
CWE-465 — Pointer Issues Pointer Issues
CWE-466 — Return of Pointer Value Outside of Expected Range A function can return a pointer to memory that is outside of the buffer that the pointer is expected to reference.
CWE-467 — Use of sizeof() on a Pointer Type The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to...
CWE-468 — Incorrect Pointer Scaling In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are...
CWE-469 — Use of Pointer Subtraction to Determine Size The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if...
CWE-47 — Path Equivalence: ' filename' (Leading Space) The product accepts path input in the form of leading space (' filedir') without appropriate validation, which can...
CWE-470 — Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') The product uses external input with reflection to select which classes or code to use, but it does not sufficiently...
CWE-471 — Modification of Assumed-Immutable Data (MAID) The product does not properly protect an assumed-immutable element from being modified by an attacker.
CWE-472 — External Control of Assumed-Immutable Web Parameter The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally...
CWE-473 — PHP External Variable Modification A PHP application does not properly protect against the modification of variables from external sources, such as...

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.