Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-558 |
Use of getlogin() in Multithreaded Application
The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values. |
|
| CWE-474 |
Use of Function with Inconsistent Implementations
The code uses a function that has inconsistent implementations across operating systems and versions. |
|
| CWE-470 |
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code. |
|
| CWE-134 |
Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source. |
|
| CWE-910 |
Use of Expired File Descriptor
The product uses or accesses a file descriptor after it has been closed. |
|
| CWE-1393 |
Use of Default Password
The product uses default passwords for potentially critical functionality. |
|
| CWE-1394 |
Use of Default Cryptographic Key
The product uses a default cryptographic key for potentially critical functionality. |
|
| CWE-1392 |
Use of Default Credentials
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality. |
|
| CWE-338 |
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. |
|
| CWE-603 |
Use of Client-Side Authentication
A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check. |
|
| CWE-524 |
Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere. |
|
| CWE-1322 |
Use of Blocking Code in Single-threaded, Non-blocking Context
The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked. |
|
| CWE-759 |
Use of a One-Way Hash without a Salt
The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input. |
|
| CWE-760 |
Use of a One-Way Hash with a Predictable Salt
The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input. |
|
| CWE-663 |
Use of a Non-reentrant Function in a Concurrent Context
The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state. |
|
| CWE-324 |
Use of a Key Past its Expiration Date
The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key. |
|
| CWE-1240 |
Use of a Cryptographic Primitive with a Risky Implementation
To fulfill the need for a cryptographic primitive, the product implements a cryptographic algorithm using a non-standard, unproven, or disallowed/non-compliant cryptographic implementation. |
|
| CWE-327 |
Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol. |
|
| CWE-416 |
Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
|
| CWE-601 |
URL Redirection to Untrusted Site ('Open Redirect')
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |