Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-403 |
Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')
A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors. |
|
| CWE-488 |
Exposure of Data Element to Wrong Session
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session. |
|
| CWE-528 |
Exposure of Core Dump File to an Unauthorized Control Sphere
The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors. |
|
| CWE-530 |
Exposure of Backup File to an Unauthorized Control Sphere
A backup file is stored in a directory or archive that is made accessible to unauthorized actors. |
|
| CWE-529 |
Exposure of Access Control List Files to an Unauthorized Control Sphere
The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere. |
|
| CWE-618 |
Exposed Unsafe ActiveX Method
An ActiveX control is intended for use in a web browser, but it exposes dangerous methods that perform actions that are outside of the browser's security model (e.g. the zone or domain). |
|
| CWE-782 |
Exposed IOCTL with Insufficient Access Control
The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL. |
|
| CWE-749 |
Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted. |
|
| CWE-586 |
Explicit Call to Finalize()
The product makes an explicit call to the finalize() method from outside the finalizer. |
|
| CWE-825 |
Expired Pointer Dereference
The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid. |
|
| CWE-440 |
Expected Behavior Violation
A feature, API, or function does not perform according to its specification. |
|
| CWE-250 |
Execution with Unnecessary Privileges
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses. |
|
| CWE-698 |
Execution After Redirect (EAR)
The web application sends a redirect to another location, but instead of exiting, it executes additional code. |
|
| CWE-624 |
Executable Regular Expression Error
The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers. |
|
| CWE-1124 |
Excessively Deep Nesting
The code contains a callable or other code grouping in which the nesting / branching is too deep. |
|
| CWE-1093 |
Excessively Complex Data Representation
The product uses an unnecessarily complex internal representation for its data structures or interrelationships between those structures. |
|
| CWE-1119 |
Excessive Use of Unconditional Branching
The code uses too many unconditional branches (such as "goto"). |
|
| CWE-1123 |
Excessive Use of Self-Modifying Code
The product uses too much self-modifying code. |
|
| CWE-1052 |
Excessive Use of Hard-Coded Literals in Initialization
The product initializes a data element using a hard-coded literal that is not a simple integer or static constant element. |
|
| CWE-1108 |
Excessive Reliance on Global Variables
The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of preserving the associated information in a narrower, more local context. |