Search

Weaknesses

CWE Weakness Actions
CWE-374 Passing Mutable Objects to an Untrusted Method
The product sends non-cloned mutable data as an argument to a method or function.
CWE-187 Partial String Comparison
The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.
CWE-1062 Parent Class with References to Child Class
The code has a parent class that contains references to a child class, its methods, or its members.
CWE-1079 Parent Class without Virtual Destructor Method
A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.
CWE-1045 Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor
A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.
CWE-186 Overly Restrictive Regular Expression
A regular expression is overly restrictive, which prevents dangerous values from being detected.
CWE-645 Overly Restrictive Account Lockout Mechanism
The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.
CWE-787 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
CWE-125 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
CWE-346 Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
CWE-783 Operator Precedence Logic Error
The product uses an expression in which operator precedence causes incorrect logic to be used.
CWE-666 Operation on Resource in Wrong Phase of Lifetime
The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.
CWE-672 Operation on a Resource after Expiration or Release
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
CWE-796 Only Filtering Special Elements Relative to a Marker
The product receives data from an upstream component, but only accounts for special elements positioned relative to a marker (e.g. "at the beginning/end of a string; the second argument"), thereby missing remaining special elements that may exist before sending it to a downstream component.
CWE-795 Only Filtering Special Elements at a Specified Location
The product receives data from an upstream component, but only accounts for special elements at a specified location, thereby missing remaining special elements that may exist before sending it to a downstream component.
CWE-797 Only Filtering Special Elements at an Absolute Position
The product receives data from an upstream component, but only accounts for special elements at an absolute position (e.g. "byte number 10"), thereby missing remaining special elements that may exist before sending it to a downstream component.
CWE-793 Only Filtering One Instance of a Special Element
The product receives data from an upstream component, but only filters a single instance of a special element before sending it to a downstream component.
CWE-1191 On-Chip Debug and Test Interface With Improper Access Control
The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.
CWE-484 Omitted Break Statement in Switch
The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.
CWE-223 Omission of Security-relevant Information
The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.