Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-71 |
DEPRECATED: Apple '.DS_Store'
This entry has been deprecated as it represents a specific observed example of a UNIX Hard Link weakness type rather than its own individual weakness type. Please refer to CWE-62. |
|
| CWE-430 |
Deployment of Wrong Handler
The wrong "handler" is assigned to process an object. |
|
| CWE-1395 |
Dependency on Vulnerable Third-Party Component
The product has a dependency on a third-party component that contains one or more known vulnerabilities. |
|
| CWE-463 |
Deletion of Data Structure Sentinel
The accidental deletion of a data-structure sentinel can cause serious programming logic problems. |
|
| CWE-1126 |
Declaration of Variable with Unnecessarily Wide Scope
The source code declares a variable in one scope, but the variable is only used within a narrower scope. |
|
| CWE-397 |
Declaration of Throws for Generic Exception
The product throws or raises an overly broad exceptions that can hide important details and produce inappropriate responses to certain conditions. |
|
| CWE-396 |
Declaration of Catch for Generic Exception
Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities. |
|
| CWE-1295 |
Debug Messages Revealing Unnecessary Information
The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages. |
|
| CWE-833 |
Deadlock
The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. |
|
| CWE-561 |
Dead Code
The product contains dead code, which can never be executed. |
|
| CWE-1072 |
Data Resource Access without Use of Connection Pooling
The product accesses a data resource through a database without using a connection pooling capability. |
|
| CWE-1098 |
Data Element containing Pointer Item without Proper Copy Control Element
The code contains a data element with a pointer that does not have an associated copy or constructor method. |
|
| CWE-1043 |
Data Element Aggregating an Excessively Large Number of Non-Primitive Elements
The product uses a data element that has an excessively large number of sub-elements with non-primitive data types such as structures or aggregated objects. |
|
| CWE-1057 |
Data Access Operations Outside of Expected Data Manager Component
The product uses a dedicated, central data manager component as required by design, but it contains code that performs data-access operations that do not use this data manager. |
|
| CWE-1083 |
Data Access from Outside Expected Data Manager Component
The product is intended to manage data access through a particular data manager component such as a relational or non-SQL database, but it contains code that performs data access operations without using that component. |
|
| CWE-619 |
Dangling Database Cursor ('Cursor Injection')
If a database cursor is not closed properly, then it could become accessible to other users while retaining the same privileges that were originally assigned, leaving the cursor "dangling." |
|
| CWE-432 |
Dangerous Signal Handler not Disabled During Sensitive Operations
The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running. |
|
| CWE-1279 |
Cryptographic Operations are run Before Supporting Units are Ready
Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result. |
|
| CWE-352 |
Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
|
| CWE-493 |
Critical Public Variable Without Final Modifier
The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values. |