Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-766 |
Critical Data Element Declared Public
The product declares a critical variable, field, or member to be public when intended security policy requires it to be private. |
|
| CWE-243 |
Creation of chroot Jail Without Changing Working Directory
The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail. |
|
| CWE-379 |
Creation of Temporary File in Directory with Insecure Permissions
The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file. |
|
| CWE-378 |
Creation of Temporary File With Insecure Permissions
Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack. |
|
| CWE-1046 |
Creation of Immutable Text Using String Concatenation
The product creates an immutable text string using string concatenation operations. |
|
| CWE-1229 |
Creation of Emergent Resource
The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used by attackers in violation of the intended policy. |
|
| CWE-1063 |
Creation of Class Instance within a Static Code Block
A static code block creates an instance of a class. |
|
| CWE-385 |
Covert Timing Channel
Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information. |
|
| CWE-515 |
Covert Storage Channel
A covert storage channel transfers information through the setting of bits by one program and the reading of those bits by another. What distinguishes this case from that of ordinary operation is that the bits are used to convey encoded information. |
|
| CWE-514 |
Covert Channel
A covert channel is a path that can be used to transfer information in a way not intended by the system's designers. |
|
| CWE-368 |
Context Switching Race Condition
A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the product's behavior during the switch. |
|
| CWE-362 |
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
|
| CWE-14 |
Compiler Removal of Code to Clear Buffers
Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal." |
|
| CWE-733 |
Compiler Optimization Removal or Modification of Security-critical Code
The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified. |
|
| CWE-1127 |
Compilation with Insufficient Warnings or Errors
The code is compiled without sufficient warnings enabled, which may prevent the detection of subtle bugs or quality issues. |
|
| CWE-595 |
Comparison of Object References Instead of Object Contents
The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects. |
|
| CWE-1024 |
Comparison of Incompatible Types
The product performs a comparison between two entities, but the entities are of different, incompatible types that cannot be guaranteed to provide correct results when they are directly compared. |
|
| CWE-486 |
Comparison of Classes by Name
The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name. |
|
| CWE-1025 |
Comparison Using Wrong Factors
The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses. |
|
| CWE-1255 |
Comparison Logic is Vulnerable to Power Side-Channel Attacks
A device's real time power consumption may be monitored during security token evaluation and the information gleaned may be used to determine the value of the reference token. |