Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-575 |
EJB Bad Practices: Use of AWT Swing
The product violates the Enterprise JavaBeans (EJB) specification by using AWT/Swing. |
|
| CWE-627 |
Dynamic Variable Evaluation
In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions. |
|
| CWE-462 |
Duplicate Key in Associative List (Alist)
Duplicate keys in associative lists can lead to non-unique keys being mistaken for an error. |
|
| CWE-1431 |
Driving Intermediate Cryptographic State/Results to Hardware Module Outputs
The product uses a hardware module implementing a cryptographic algorithm that writes sensitive information about the intermediate state or results of its cryptographic operations via one of its output wires (typically the output port containing the final result). |
|
| CWE-494 |
Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. |
|
| CWE-85 |
Doubled Character XSS Manipulations
The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters. |
|
| CWE-609 |
Double-Checked Locking
The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient. |
|
| CWE-415 |
Double Free
The product calls free() twice on the same memory address. |
|
| CWE-174 |
Double Decoding of the Same Data
The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations. |
|
| CWE-369 |
Divide By Zero
The product divides a value by zero. |
|
| CWE-111 |
Direct Use of Unsafe JNI
When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses cannot occur in Java. |
|
| CWE-425 |
Direct Request ('Forced Browsing')
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. |
|
| CWE-1273 |
Device Unlock Credential Sharing
The credentials necessary for unlocking a device are shared across multiple parties and may expose sensitive information. |
|
| CWE-390 |
Detection of Error Condition Without Action
The product detects a specific error, but takes no actions to handle the error. |
|
| CWE-502 |
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
|
| CWE-430 |
Deployment of Wrong Handler
The wrong "handler" is assigned to process an object. |
|
| CWE-1395 |
Dependency on Vulnerable Third-Party Component
The product has a dependency on a third-party component that contains one or more known vulnerabilities. |
|
| CWE-463 |
Deletion of Data Structure Sentinel
The accidental deletion of a data-structure sentinel can cause serious programming logic problems. |
|
| CWE-1126 |
Declaration of Variable with Unnecessarily Wide Scope
The source code declares a variable in one scope, but the variable is only used within a narrower scope. |
|
| CWE-397 |
Declaration of Throws for Generic Exception
The product throws or raises an overly broad exceptions that can hide important details and produce inappropriate responses to certain conditions. |