Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-374 |
Passing Mutable Objects to an Untrusted Method
The product sends non-cloned mutable data as an argument to a method or function. |
|
| CWE-187 |
Partial String Comparison
The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses. |
|
| CWE-1062 |
Parent Class with References to Child Class
The code has a parent class that contains references to a child class, its methods, or its members. |
|
| CWE-1079 |
Parent Class without Virtual Destructor Method
A parent class contains one or more child classes, but the parent class does not have a virtual destructor method. |
|
| CWE-1045 |
Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor
A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor. |
|
| CWE-186 |
Overly Restrictive Regular Expression
A regular expression is overly restrictive, which prevents dangerous values from being detected. |
|
| CWE-645 |
Overly Restrictive Account Lockout Mechanism
The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out. |
|
| CWE-787 |
Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer. |
|
| CWE-125 |
Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer. |
|
| CWE-346 |
Origin Validation Error
The product does not properly verify that the source of data or communication is valid. |
|
| CWE-783 |
Operator Precedence Logic Error
The product uses an expression in which operator precedence causes incorrect logic to be used. |
|
| CWE-666 |
Operation on Resource in Wrong Phase of Lifetime
The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors. |
|
| CWE-672 |
Operation on a Resource after Expiration or Release
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked. |
|
| CWE-796 |
Only Filtering Special Elements Relative to a Marker
The product receives data from an upstream component, but only accounts for special elements positioned relative to a marker (e.g. "at the beginning/end of a string; the second argument"), thereby missing remaining special elements that may exist before sending it to a downstream component. |
|
| CWE-795 |
Only Filtering Special Elements at a Specified Location
The product receives data from an upstream component, but only accounts for special elements at a specified location, thereby missing remaining special elements that may exist before sending it to a downstream component. |
|
| CWE-797 |
Only Filtering Special Elements at an Absolute Position
The product receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. "byte number 10"), thereby missing remaining special elements that may exist before sending it to a downstream component. |
|
| CWE-793 |
Only Filtering One Instance of a Special Element
The product receives data from an upstream component, but only filters a single instance of a special element before sending it to a downstream component. |
|
| CWE-1191 |
On-Chip Debug and Test Interface With Improper Access Control
The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface. |
|
| CWE-484 |
Omitted Break Statement in Switch
The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition. |
|
| CWE-223 |
Omission of Security-relevant Information
The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe. |