Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-323 |
Reusing a Nonce, Key Pair in Encryption
Nonces should be used for the present occasion and only once. |
|
| CWE-393 |
Return of Wrong Status Code
A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result. |
|
| CWE-562 |
Return of Stack Variable Address
A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash. |
|
| CWE-466 |
Return of Pointer Value Outside of Expected Range
A function can return a pointer to memory that is outside of the buffer that the pointer is expected to reference. |
|
| CWE-584 |
Return Inside Finally Block
The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded. |
|
| CWE-375 |
Returning a Mutable Object to an Untrusted Caller
Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function. |
|
| CWE-509 |
Replicating Malicious Code (Virus or Worm)
Replicating malicious code, including viruses and worms, will attempt to attack other systems once it has successfully compromised the target system or the product. |
|
| CWE-1330 |
Remanent Data Readable after Memory Erase
Confidential information stored in memory circuits is readable or recoverable after being cleared or erased. |
|
| CWE-807 |
Reliance on Untrusted Inputs in a Security Decision
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. |
|
| CWE-758 |
Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity. |
|
| CWE-656 |
Reliance on Security Through Obscurity
The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism. |
|
| CWE-1101 |
Reliance on Runtime Component in Generated Code
The product uses automatically-generated code that cannot be executed without a specific runtime support component. |
|
| CWE-350 |
Reliance on Reverse DNS Resolution for a Security-Critical Action
The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname. |
|
| CWE-487 |
Reliance on Package-level Scope
Java packages are not inherently closed; therefore, relying on them for code security is not a good practice. |
|
| CWE-649 |
Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
The product uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the product does not use integrity checks to detect if those inputs have been modified. |
|
| CWE-1102 |
Reliance on Machine-Dependent Data Representation
The code uses a data representation that relies on low-level data representation or constructs that may vary across different processors, physical machines, OSes, or other physical components. |
|
| CWE-291 |
Reliance on IP Address for Authentication
The product uses an IP address for authentication. |
|
| CWE-1357 |
Reliance on Insufficiently Trustworthy Component
The product is built from multiple separate components, but it uses a component that is not sufficiently trusted to meet expectations for security, reliability, updateability, and maintainability. |
|
| CWE-1428 |
Reliance on HTTP instead of HTTPS
The product provides or relies on use of HTTP communications when HTTPS is available. |
|
| CWE-646 |
Reliance on File Name or Extension of Externally-Supplied File
The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion. |