Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-242 |
Use of Inherently Dangerous Function
The product calls a function that can never be guaranteed to work safely. |
|
| CWE-706 |
Use of Incorrectly-Resolved Name or Reference
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. |
|
| CWE-480 |
Use of Incorrect Operator
The product accidentally uses the wrong operator, which changes the logic in security-relevant ways. |
|
| CWE-198 |
Use of Incorrect Byte Ordering
The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used. |
|
| CWE-927 |
Use of Implicit Intent for Sensitive Communication
The Android application uses an implicit intent for transmitting sensitive data to other applications. |
|
| CWE-547 |
Use of Hard-coded, Security-relevant Constants
The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change. |
|
| CWE-259 |
Use of Hard-coded Password
The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components. |
|
| CWE-321 |
Use of Hard-coded Cryptographic Key
The product uses a hard-coded, unchangeable cryptographic key. |
|
| CWE-798 |
Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key. |
|
| CWE-598 |
Use of HTTP Request With Sensitive Query String
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string. |
|
| CWE-474 |
Use of Function with Inconsistent Implementations
The code uses a function that has inconsistent implementations across operating systems and versions. |
|
| CWE-470 |
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. |
|
| CWE-134 |
Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source. |
|
| CWE-910 |
Use of Expired File Descriptor
The product uses or accesses a file descriptor after it has been closed. |
|
| CWE-1393 |
Use of Default Password
The product uses default passwords for potentially critical functionality. |
|
| CWE-1394 |
Use of Default Cryptographic Key
The product uses a default cryptographic key for potentially critical functionality. |
|
| CWE-1392 |
Use of Default Credentials
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. |
|
| CWE-338 |
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
|
| CWE-603 |
Use of Client-Side Authentication
A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check. |
|
| CWE-524 |
Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere. |