Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-1322 |
Use of Blocking Code in Single-threaded, Non-blocking Context
The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked. |
|
| CWE-416 |
Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
|
| CWE-620 |
Unverified Password Change
When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication. |
|
| CWE-283 |
Unverified Ownership
The product does not properly verify that a critical resource is owned by the proper entity. |
|
| CWE-426 |
Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. |
|
| CWE-822 |
Untrusted Pointer Dereference
The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer. |
|
| CWE-567 |
Unsynchronized Access to Shared Data in a Multithreaded Context
The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes. |
|
| CWE-196 |
Unsigned to Signed Conversion Error
The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive can not be represented using a signed primitive. |
|
| CWE-623 |
Unsafe ActiveX Control Marked Safe For Scripting
An ActiveX control is intended for restricted use, but it has been marked as safe-for-scripting. |
|
| CWE-434 |
Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
|
| CWE-412 |
Unrestricted Externally Accessible Lock
The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control. |
|
| CWE-428 |
Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
|
| CWE-422 |
Unprotected Windows Messaging Channel ('Shatter')
The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product. |
|
| CWE-523 |
Unprotected Transport of Credentials
Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server. |
|
| CWE-419 |
Unprotected Primary Channel
The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel. |
|
| CWE-1297 |
Unprotected Confidential Information on Device is Accessible by OSAT Vendors
The product does not adequately protect confidential information on the device from being accessed by Outsourced Semiconductor Assembly and Test (OSAT) vendors. |
|
| CWE-420 |
Unprotected Alternate Channel
The product protects a primary channel, but it does not use the same level of protection for an alternate channel. |
|
| CWE-433 |
Unparsed Raw Web Content Delivery
The product stores raw content or supporting code under the web document root with an extension that is not specifically handled by the server. |
|
| CWE-637 |
Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the mechanism is not correctly understood, modeled, configured, implemented, or used. |
|
| CWE-832 |
Unlock of a Resource that is not Locked
The product attempts to unlock a resource that is not locked. |