Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-477 |
Use of Obsolete Function
The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained. |
|
| CWE-1091 |
Use of Object without Invoking Destructor Method
The product contains a method that accesses an object but does not later invoke the element's associated finalize/destructor method. |
|
| CWE-395 |
Use of NullPointerException Catch to Detect NULL Pointer Dereference
Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer. |
|
| CWE-647 |
Use of Non-Canonical URL Paths for Authorization Decisions
The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization. |
|
| CWE-694 |
Use of Multiple Resources with Duplicate Identifier
The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required. |
|
| CWE-695 |
Use of Low-Level Functionality
The product uses low-level functionality that is explicitly prohibited by the framework or specification under which the product is supposed to operate. |
|
| CWE-348 |
Use of Less Trusted Source
The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack. |
|
| CWE-344 |
Use of Invariant Value in Dynamically Changing Context
The product uses a constant value, name, or reference, but this value can (or should) vary across different environments. |
|
| CWE-330 |
Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. |
|
| CWE-492 |
Use of Inner Class Containing Sensitive Data
Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers. |
|
| CWE-242 |
Use of Inherently Dangerous Function
The product calls a function that can never be guaranteed to work safely. |
|
| CWE-480 |
Use of Incorrect Operator
The product accidentally uses the wrong operator, which changes the logic in security-relevant ways. |
|
| CWE-706 |
Use of Incorrectly-Resolved Name or Reference
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere. |
|
| CWE-198 |
Use of Incorrect Byte Ordering
The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used. |
|
| CWE-927 |
Use of Implicit Intent for Sensitive Communication
The Android application uses an implicit intent for transmitting sensitive data to other applications. |
|
| CWE-598 |
Use of HTTP Request With Sensitive Query String
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string. |
|
| CWE-547 |
Use of Hard-coded, Security-relevant Constants
The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change. |
|
| CWE-259 |
Use of Hard-coded Password
The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components. |
|
| CWE-321 |
Use of Hard-coded Cryptographic Key
The product uses a hard-coded, unchangeable cryptographic key. |
|
| CWE-798 |
Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key. |