Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-307 |
Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. |
|
| CWE-923 |
Improper Restriction of Communication Channel to Intended Endpoints
The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint. |
|
| CWE-404 |
Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use. |
|
| CWE-413 |
Improper Resource Locking
The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource. |
|
| CWE-41 |
Improper Resolution of Path Equivalence
The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object. |
|
| CWE-212 |
Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors. |
|
| CWE-1338 |
Improper Protections Against Hardware Overheating
A hardware device is missing or has inadequate protection features to prevent overheating. |
|
| CWE-1300 |
Improper Protection of Physical Side Channels
The device does not contain sufficient protection mechanisms to prevent physical side channels from exposing sensitive information due to patterns in physically observable phenomena such as variations in power consumption, electromagnetic emissions (EME), or acoustic emissions. |
|
| CWE-424 |
Improper Protection of Alternate Path
The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources. |
|
| CWE-1320 |
Improper Protection for Outbound Error Messages and Alert Signals
Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts. |
|
| CWE-1247 |
Improper Protection Against Voltage and Clock Glitches
The device does not contain or contains incorrectly implemented circuitry or sensors to detect and mitigate voltage and clock glitches and protect sensitive information or software contained on the device. |
|
| CWE-1319 |
Improper Protection against Electromagnetic Fault Injection (EM-FI)
The device is susceptible to electromagnetic fault injection attacks, causing device internal information to be compromised or security mechanisms to be bypassed. |
|
| CWE-269 |
Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
|
| CWE-1231 |
Improper Prevention of Lock Bit Modification
The product uses a trusted lock bit for restricting access to registers, address regions, or other resources, but the product does not prevent the value of the lock bit from being modified after it has been set. |
|
| CWE-281 |
Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended. |
|
| CWE-1250 |
Improper Preservation of Consistency Between Independent Representations of Shared State
The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other. |
|
| CWE-1263 |
Improper Physical Access Control
The product is designed with access restricted to certain information, but it does not sufficiently protect against an unauthorized actor with physical access to these areas. |
|
| CWE-282 |
Improper Ownership Management
The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource. |
|
| CWE-117 |
Improper Output Neutralization for Logs
The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file. |
|
| CWE-170 |
Improper Null Termination
The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator. |