Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-1241 |
Use of Predictable Algorithm in Random Number Generator
The device uses an algorithm that is predictable and generates a pseudo-random number. |
|
| CWE-676 |
Use of Potentially Dangerous Function
The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely. |
|
| CWE-469 |
Use of Pointer Subtraction to Determine Size
The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk. |
|
| CWE-1103 |
Use of Platform-Dependent Third Party Components
The product relies on third-party components that do not provide equivalent functionality across all desirable platforms. |
|
| CWE-539 |
Use of Persistent Cookies Containing Sensitive Information
The web application uses persistent cookies, but the cookies contain sensitive information. |
|
| CWE-785 |
Use of Path Manipulation Function without Maximum-sized Buffer
The product invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX. |
|
| CWE-309 |
Use of Password System for Primary Authentication
The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism. |
|
| CWE-916 |
Use of Password Hash With Insufficient Computational Effort
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. |
|
| CWE-836 |
Use of Password Hash Instead of Password for Authentication
The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store. |
|
| CWE-823 |
Use of Out-of-range Pointer Offset
The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer. |
|
| CWE-477 |
Use of Obsolete Function
The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained. |
|
| CWE-1091 |
Use of Object without Invoking Destructor Method
The product contains a method that accesses an object but does not later invoke the element's associated finalize/destructor method. |
|
| CWE-395 |
Use of NullPointerException Catch to Detect NULL Pointer Dereference
Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer. |
|
| CWE-647 |
Use of Non-Canonical URL Paths for Authorization Decisions
The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization. |
|
| CWE-694 |
Use of Multiple Resources with Duplicate Identifier
The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required. |
|
| CWE-695 |
Use of Low-Level Functionality
The product uses low-level functionality that is explicitly prohibited by the framework or specification under which the product is supposed to operate. |
|
| CWE-348 |
Use of Less Trusted Source
The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack. |
|
| CWE-344 |
Use of Invariant Value in Dynamically Changing Context
The product uses a constant value, name, or reference, but this value can (or should) vary across different environments. |
|
| CWE-330 |
Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. |
|
| CWE-492 |
Use of Inner Class Containing Sensitive Data
Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers. |