Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-908 |
Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized. |
|
| CWE-560 |
Use of umask() with chmod-style Argument
The product calls umask() with an incorrect argument that is specified as if it is an argument to chmod(). |
|
| CWE-467 |
Use of sizeof() on a Pointer Type
The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to determine the size of the data that is being pointed to. |
|
| CWE-543 |
Use of Singleton Pattern Without Synchronization in a Multithreaded Context
The product uses the singleton pattern when creating a resource within a multithreaded environment. |
|
| CWE-308 |
Use of Single-factor Authentication
The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor. |
|
| CWE-1109 |
Use of Same Variable for Multiple Purposes
The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data. |
|
| CWE-1092 |
Use of Same Invokable Control Element in Multiple Architectural Layers
The product uses the same control element across multiple architectural layers. |
|
| CWE-780 |
Use of RSA Algorithm without OAEP
The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption. |
|
| CWE-1041 |
Use of Redundant Code
The product has multiple functions, methods, procedures, macros, etc. that contain the same code. |
|
| CWE-1177 |
Use of Prohibited Code
The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer. |
|
| CWE-1241 |
Use of Predictable Algorithm in Random Number Generator
The device uses an algorithm that is predictable and generates a pseudo-random number. |
|
| CWE-676 |
Use of Potentially Dangerous Function
The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely. |
|
| CWE-469 |
Use of Pointer Subtraction to Determine Size
The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk. |
|
| CWE-1103 |
Use of Platform-Dependent Third Party Components
The product relies on third-party components that do not provide equivalent functionality across all desirable platforms. |
|
| CWE-539 |
Use of Persistent Cookies Containing Sensitive Information
The web application uses persistent cookies, but the cookies contain sensitive information. |
|
| CWE-785 |
Use of Path Manipulation Function without Maximum-sized Buffer
The product invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX. |
|
| CWE-309 |
Use of Password System for Primary Authentication
The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism. |
|
| CWE-916 |
Use of Password Hash With Insufficient Computational Effort
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. |
|
| CWE-836 |
Use of Password Hash Instead of Password for Authentication
The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store. |
|
| CWE-823 |
Use of Out-of-range Pointer Offset
The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer. |