Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-1084 |
Invokable Control Element with Excessive File or Data Access Operations
A function or method contains too many operations that utilize a data manager or file resource. |
|
| CWE-1058 |
Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element
The code contains a function or method that operates in a multi-threaded environment but owns an unsafe non-final static storable or member data element. |
|
| CWE-214 |
Invocation of Process Using Visible Sensitive Information
A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system. |
|
| CWE-1054 |
Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer
The code at one architectural layer invokes code that resides at a deeper layer than the adjacent layer, i.e., the invocation skips at least one layer, and the invoked code is not part of a vertical utility layer that can be referenced from any horizontal layer. |
|
| CWE-436 |
Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state. |
|
| CWE-1244 |
Internal Asset Exposed to Unsafe Debug Access Level or State
The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents. |
|
| CWE-191 |
Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
|
| CWE-680 |
Integer Overflow to Buffer Overflow
The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow. |
|
| CWE-190 |
Integer Overflow or Wraparound
The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number. |
|
| CWE-192 |
Integer Coercion Error
Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types. |
|
| CWE-1007 |
Insufficient Visual Distinction of Homoglyphs Presented to User
The product displays information or identifiers to a user, but the display mechanism does not make it easy for the user to distinguish between visually similar or identical glyphs (homoglyphs), which may cause the user to misinterpret a glyph and perform an unintended, insecure action. |
|
| CWE-345 |
Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
|
| CWE-1106 |
Insufficient Use of Symbolic Constants
The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants. |
|
| CWE-357 |
Insufficient UI Warning of Dangerous Operations
The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention. |
|
| CWE-351 |
Insufficient Type Distinction
The product does not properly distinguish between different types of elements in a way that leads to insecure behavior. |
|
| CWE-1059 |
Insufficient Technical Documentation
The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc. |
|
| CWE-613 |
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." |
|
| CWE-410 |
Insufficient Resource Pool
The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources. |
|
| CWE-655 |
Insufficient Psychological Acceptability
The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose. |
|
| CWE-1339 |
Insufficient Precision or Accuracy of a Real Number
The product processes a real number with an implementation in which the number's representation does not preserve required accuracy and precision in its fractional part, causing an incorrect result. |