Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-396 |
Declaration of Catch for Generic Exception
Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities. |
|
| CWE-1295 |
Debug Messages Revealing Unnecessary Information
The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages. |
|
| CWE-833 |
Deadlock
The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. |
|
| CWE-561 |
Dead Code
The product contains dead code, which can never be executed. |
|
| CWE-1072 |
Data Resource Access without Use of Connection Pooling
The product accesses a data resource through a database without using a connection pooling capability. |
|
| CWE-1098 |
Data Element containing Pointer Item without Proper Copy Control Element
The code contains a data element with a pointer that does not have an associated copy or constructor method. |
|
| CWE-1043 |
Data Element Aggregating an Excessively Large Number of Non-Primitive Elements
The product uses a data element that has an excessively large number of sub-elements with non-primitive data types such as structures or aggregated objects. |
|
| CWE-1083 |
Data Access from Outside Expected Data Manager Component
The product is intended to manage data access through a particular data manager component such as a relational or non-SQL database, but it contains code that performs data access operations without using that component. |
|
| CWE-1057 |
Data Access Operations Outside of Expected Data Manager Component
The product uses a dedicated, central data manager component as required by design, but it contains code that performs data-access operations that do not use this data manager. |
|
| CWE-619 |
Dangling Database Cursor ('Cursor Injection')
If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor "dangling." |
|
| CWE-432 |
Dangerous Signal Handler not Disabled During Sensitive Operations
The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running. |
|
| CWE-1190 |
DMA Device Enabled Too Early in Boot Phase
The product enables a Direct Memory Access (DMA) capable device before the security configuration settings are established, which allows an attacker to extract data from or gain privileges on the product. |
|
| CWE-1187 |
DEPRECATED: Use of Uninitialized Resource
This entry has been deprecated because it was a duplicate of CWE-908. All content has been transferred to CWE-908. |
|
| CWE-545 |
DEPRECATED: Use of Dynamic Class Loading
This weakness has been deprecated because it partially overlaps CWE-470, it describes legitimate programmer behavior, and other portions will need to be integrated into other entries. |
|
| CWE-769 |
DEPRECATED: Uncontrolled File Descriptor Consumption
This entry has been deprecated because it was a duplicate of CWE-774. All content has been transferred to CWE-774. |
|
| CWE-292 |
DEPRECATED: Trusting Self-reported DNS Name
This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350. |
|
| CWE-373 |
DEPRECATED: State Synchronization Error
This entry was deprecated because it overlapped the same concepts as race condition (CWE-362) and Improper Synchronization (CWE-662). |
|
| CWE-1324 |
DEPRECATED: Sensitive Information Accessible by Physical Probing of JTAG Interface
This entry has been deprecated because it was at a lower level of abstraction than supported by CWE. All relevant content has been integrated into CWE-319. |
|
| CWE-247 |
DEPRECATED: Reliance on DNS Lookups in a Security Decision
This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350. |
|
| CWE-365 |
DEPRECATED: Race Condition in Switch
This entry has been deprecated. There are no documented cases in which a switch's control expression is evaluated more than once. |