Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-686 |
Function Call With Incorrect Argument Type
The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses. |
|
| CWE-761 |
Free of Pointer not at Start of Buffer
The product calls free() on a pointer to a memory resource that was allocated on the heap, but the pointer is not at the start of the buffer. |
|
| CWE-590 |
Free of Memory not on the Heap
The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc(). |
|
| CWE-1077 |
Floating Point Comparison with Incorrect Operator
The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision. |
|
| CWE-1277 |
Firmware Not Updateable
The product does not provide its users with the ability to update or patch its firmware to address any vulnerabilities or weaknesses that may be present. |
|
| CWE-568 |
finalize() Method Without super.finalize()
The product contains a finalize() method that does not call super.finalize(). |
|
| CWE-583 |
finalize() Method Declared Public
The product violates secure coding principles for mobile code by declaring a finalize() method public. |
|
| CWE-552 |
Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be. |
|
| CWE-75 |
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
The product does not adequately filter user-controlled input for special elements with control implications. |
|
| CWE-157 |
Failure to Sanitize Paired Delimiters
The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces. |
|
| CWE-234 |
Failure to Handle Missing Parameter
If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well. |
|
| CWE-239 |
Failure to Handle Incomplete Element
The product does not properly handle when a particular element is not completely specified. |
|
| CWE-1209 |
Failure to Disable Reserved Bits
The reserved bits in a hardware design are not disabled prior to production. Typically, reserved bits are used for future capabilities and should not support any functional logic in the design. However, designers might covertly use these bits to debug or further develop new capabilities in production hardware. Adversaries with access to these bits will write to them in hopes of compromising hardware state. |
|
| CWE-1316 |
Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
The address map of the on-chip fabric has protected and unprotected regions overlapping, allowing an attacker to bypass access control to the overlapping portion of the protected region. |
|
| CWE-211 |
Externally-Generated Error Message Containing Sensitive Information
The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information. |
|
| CWE-610 |
Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere. |
|
| CWE-454 |
External Initialization of Trusted Variables or Data Stores
The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors. |
|
| CWE-673 |
External Influence of Sphere Definition
The product does not prevent the definition of control spheres from external actors. |
|
| CWE-15 |
External Control of System or Configuration Setting
One or more system settings or configuration elements can be externally controlled by a user. |
|
| CWE-73 |
External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations. |