Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-575 |
EJB Bad Practices: Use of AWT Swing
The product violates the Enterprise JavaBeans (EJB) specification by using AWT/Swing. |
|
| CWE-627 |
Dynamic Variable Evaluation
In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions. |
|
| CWE-462 |
Duplicate Key in Associative List (Alist)
Duplicate keys in associative lists can lead to non-unique keys being mistaken for an error. |
|
| CWE-1431 |
Driving Intermediate Cryptographic State/Results to Hardware Module Outputs
The product uses a hardware module implementing a cryptographic algorithm that writes sensitive information about the intermediate state or results of its cryptographic operations via one of its output wires (typically the output port containing the final result). |
|
| CWE-494 |
Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. |
|
| CWE-415 |
Double Free
The product calls free() twice on the same memory address. |
|
| CWE-174 |
Double Decoding of the Same Data
The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs in between the decoding operations. |
|
| CWE-85 |
Doubled Character XSS Manipulations
The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters. |
|
| CWE-609 |
Double-Checked Locking
The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient. |
|
| CWE-1190 |
DMA Device Enabled Too Early in Boot Phase
The product enables a Direct Memory Access (DMA) capable device before the security configuration settings are established, which allows an attacker to extract data from or gain privileges on the product. |
|
| CWE-369 |
Divide By Zero
The product divides a value by zero. |
|
| CWE-111 |
Direct Use of Unsafe JNI
When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses cannot occur in Java. |
|
| CWE-425 |
Direct Request ('Forced Browsing')
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. |
|
| CWE-1273 |
Device Unlock Credential Sharing
The credentials necessary for unlocking a device are shared across multiple parties and may expose sensitive information. |
|
| CWE-390 |
Detection of Error Condition Without Action
The product detects a specific error, but takes no actions to handle the error. |
|
| CWE-502 |
Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
|
| CWE-1187 |
DEPRECATED: Use of Uninitialized Resource
This entry has been deprecated because it was a duplicate of CWE-908. All content has been transferred to CWE-908. |
|
| CWE-545 |
DEPRECATED: Use of Dynamic Class Loading
This weakness has been deprecated because it partially overlaps CWE-470, it describes legitimate programmer behavior, and other portions will need to be integrated into other entries. |
|
| CWE-769 |
DEPRECATED: Uncontrolled File Descriptor Consumption
This entry has been deprecated because it was a duplicate of CWE-774. All content has been transferred to CWE-774. |
|
| CWE-292 |
DEPRECATED: Trusting Self-reported DNS Name
This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350. |