Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-760 |
Use of a One-Way Hash with a Predictable Salt
The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input. |
|
| CWE-663 |
Use of a Non-reentrant Function in a Concurrent Context
The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state. |
|
| CWE-324 |
Use of a Key Past its Expiration Date
The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key. |
|
| CWE-1240 |
Use of a Cryptographic Primitive with a Risky Implementation
To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation. |
|
| CWE-327 |
Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol. |
|
| CWE-597 |
Use of Wrong Operator in String Comparison
The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead. |
|
| CWE-1022 |
Use of Web Link to Untrusted Target with window.opener Access
The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property. |
|
| CWE-525 |
Use of Web Browser Cache Containing Sensitive Information
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached. |
|
| CWE-328 |
Use of Weak Hash
The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). |
|
| CWE-1391 |
Use of Weak Credentials
The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker. |
|
| CWE-1104 |
Use of Unmaintained Third Party Components
The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer. |
|
| CWE-457 |
Use of Uninitialized Variable
The code uses a variable that has not been initialized, leading to unpredictable or unintended results. |
|
| CWE-908 |
Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized. |
|
| CWE-543 |
Use of Singleton Pattern Without Synchronization in a Multithreaded Context
The product uses the singleton pattern when creating a resource within a multithreaded environment. |
|
| CWE-308 |
Use of Single-factor Authentication
The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor. |
|
| CWE-1109 |
Use of Same Variable for Multiple Purposes
The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data. |
|
| CWE-1092 |
Use of Same Invokable Control Element in Multiple Architectural Layers
The product uses the same control element across multiple architectural layers. |
|
| CWE-1041 |
Use of Redundant Code
The product has multiple functions, methods, procedures, macros, etc. that contain the same code. |
|
| CWE-780 |
Use of RSA Algorithm without OAEP
The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption. |
|
| CWE-1177 |
Use of Prohibited Code
The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer. |