Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-289 |
Authentication Bypass by Alternate Name
The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor. |
|
| CWE-588 |
Attempt to Access Child of a Non-structure Pointer
Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption. |
|
| CWE-405 |
Asymmetric Resource Consumption (Amplification)
The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric." |
|
| CWE-1282 |
Assumed-Immutable Data is Stored in Writable Memory
Immutable data, such as a first-stage bootloader, device identifiers, and "write-once" configuration settings are stored in writable memory that can be re-programmed or updated in the field. |
|
| CWE-563 |
Assignment to Variable without Use
The variable's value is assigned but never used, making it a dead store. |
|
| CWE-587 |
Assignment of a Fixed Address to a Pointer
The product sets a pointer to a specific address other than NULL or 0. |
|
| CWE-481 |
Assigning instead of Comparing
The code uses an operator for assignment when the intention was to perform a comparison. |
|
| CWE-556 |
ASP.NET Misconfiguration: Use of Identity Impersonation
Configuring an ASP.NET application to run with impersonated credentials may give the application unnecessary privileges. |
|
| CWE-13 |
ASP.NET Misconfiguration: Password in Configuration File
Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target for attackers. |
|
| CWE-554 |
ASP.NET Misconfiguration: Not Using Input Validation Framework
The ASP.NET application does not use an input validation framework. |
|
| CWE-12 |
ASP.NET Misconfiguration: Missing Custom Error Page
An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses. |
|
| CWE-1174 |
ASP.NET Misconfiguration: Improper Model Validation
The ASP.NET application does not use, or incorrectly uses, the model validation framework. |
|
| CWE-11 |
ASP.NET Misconfiguration: Creating Debug Binary
Debugging messages help attackers learn about the system and plan a form of attack. |
|
| CWE-582 |
Array Declared Public, Final, and Static
The product declares an array public, final, and static, which is not sufficient to prevent the array's contents from being modified. |
|
| CWE-1044 |
Architecture with Number of Horizontal Layers Outside of Expected Range
The product's architecture contains too many - or too few - horizontal layers. |
|
| CWE-1249 |
Application-Level Admin Tool with Inconsistent View of Underlying Operating System
The product provides an application for administrators to manage parts of the underlying operating system, but the application does not accurately identify all of the relevant entities or resources that exist in the OS; that is, the application's model of the OS's state is inconsistent with the OS's actual state. |
|
| CWE-670 |
Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated. |
|
| CWE-770 |
Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
|
| CWE-774 |
Allocation of File Descriptors or Handles Without Limits or Throttling
The product allocates file descriptors or handles on behalf of an actor without imposing any restrictions on how many descriptors can be allocated, in violation of the intended security policy for that actor. |
|
| CWE-464 |
Addition of Data Structure Sentinel
The accidental addition of a data-structure sentinel can cause serious programming logic problems. |