Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-103 |
Struts: Incomplete validate() Method Definition
The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate(). |
|
| CWE-105 |
Struts: Form Field Without Validator
The product has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation. |
|
| CWE-104 |
Struts: Form Bean Does Not Extend Validation Class
If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation. |
|
| CWE-102 |
Struts: Duplicate Validation Forms
The product uses multiple validation forms with the same name, which might cause the Struts Validator to validate a form that the programmer does not expect. |
|
| CWE-257 |
Storing Passwords in a Recoverable Format
The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. |
|
| CWE-921 |
Storage of Sensitive Data in a Mechanism without Access Control
The product stores sensitive information in a file system or device that does not have built-in access control. |
|
| CWE-219 |
Storage of File with Sensitive Data Under Web Root
The product stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties. |
|
| CWE-220 |
Storage of File With Sensitive Data Under FTP Root
The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties. |
|
| CWE-1042 |
Static Member Data Element outside of a Singleton Class Element
The code contains a member element that is declared as static (but not final), in which its parent class element is not a singleton class - that is, a class element that can be used only once in the 'to' association of a Create action. |
|
| CWE-121 |
Stack-based Buffer Overflow
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
|
| CWE-512 |
Spyware
The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product. |
|
| CWE-1080 |
Source Code File with Excessive Number of Lines of Code
A source code file has too many lines of code. |
|
| CWE-1115 |
Source Code Element without Standard Prologue
The source code contains elements such as source files that do not consistently provide a prologue or header that has been standardized for the project. |
|
| CWE-334 |
Small Space of Random Values
The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks. |
|
| CWE-339 |
Small Seed Space in PRNG
A Pseudo-Random Number Generator (PRNG) uses a relatively small seed space, which makes it more susceptible to brute force attacks. |
|
| CWE-1096 |
Singleton Class Instance Creation without Proper Locking or Synchronization
The product implements a Singleton design pattern but does not use appropriate locking or other synchronization mechanism to ensure that the singleton class is only instantiated once. |
|
| CWE-195 |
Signed to Unsigned Conversion Error
The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive. |
|
| CWE-828 |
Signal Handler with Functionality that is not Asynchronous-Safe
The product defines a signal handler that contains code sequences that are not asynchronous-safe, i.e., the functionality is not reentrant, or it can be interrupted. |
|
| CWE-479 |
Signal Handler Use of a Non-reentrant Function
The product defines a signal handler that calls a non-reentrant function. |
|
| CWE-364 |
Signal Handler Race Condition
The product uses a signal handler that introduces a race condition. |