Search

Weaknesses

CWE Weakness Actions
CWE-760 Use of a One-Way Hash with a Predictable Salt
The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.
CWE-663 Use of a Non-reentrant Function in a Concurrent Context
The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.
CWE-324 Use of a Key Past its Expiration Date
The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation
To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation.
CWE-327 Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
CWE-597 Use of Wrong Operator in String Comparison
The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.
CWE-1022 Use of Web Link to Untrusted Target with window.opener Access
The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.
CWE-525 Use of Web Browser Cache Containing Sensitive Information
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
CWE-328 Use of Weak Hash
The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
CWE-1391 Use of Weak Credentials
The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.
CWE-1104 Use of Unmaintained Third Party Components
The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.
CWE-457 Use of Uninitialized Variable
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CWE-908 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
CWE-543 Use of Singleton Pattern Without Synchronization in a Multithreaded Context
The product uses the singleton pattern when creating a resource within a multithreaded environment.
CWE-308 Use of Single-factor Authentication
The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.
CWE-1109 Use of Same Variable for Multiple Purposes
The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data.
CWE-1092 Use of Same Invokable Control Element in Multiple Architectural Layers
The product uses the same control element across multiple architectural layers.
CWE-1041 Use of Redundant Code
The product has multiple functions, methods, procedures, macros, etc. that contain the same code.
CWE-780 Use of RSA Algorithm without OAEP
The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.
CWE-1177 Use of Prohibited Code
The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer.