Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-1265 |
Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
The product invokes code that is believed to be reentrant, but the code performs a call that unintentionally produces a nested invocation of the non-reentrant code. |
|
| CWE-441 |
Unintended Proxy or Intermediary ('Confused Deputy')
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor. |
|
| CWE-1271 |
Uninitialized Value on Reset for Registers Holding Security Settings
Security-critical logic is not set to a known value on reset. |
|
| CWE-447 |
Unimplemented or Unsupported Feature in UI
A UI function for a security feature appears to be supported and gives feedback to the user that suggests that it is supported, but the underlying functionality is not implemented. |
|
| CWE-394 |
Unexpected Status Code or Return Value
The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product. |
|
| CWE-194 |
Unexpected Sign Extension
The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses. |
|
| CWE-475 |
Undefined Behavior for Input to API
The behavior of this function is undefined unless its control parameter is set to a specific value. |
|
| CWE-427 |
Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. |
|
| CWE-400 |
Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource. |
|
| CWE-674 |
Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
|
| CWE-1075 |
Unconditional Control Flow Transfer outside of Switch Block
The product performs unconditional control transfer (such as a "goto") in code outside of a branching structure such as a switch block. |
|
| CWE-690 |
Unchecked Return Value to NULL Pointer Dereference
The product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. |
|
| CWE-252 |
Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. |
|
| CWE-606 |
Unchecked Input for Loop Condition
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping. |
|
| CWE-391 |
Unchecked Error Condition
[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed. |
|
| CWE-600 |
Uncaught Exception in Servlet
The Servlet does not catch all exceptions, which may reveal sensitive debugging information. |
|
| CWE-248 |
Uncaught Exception
An exception is thrown from a function, but it is not caught. |
|
| CWE-1334 |
Unauthorized Error Injection Can Degrade Hardware Redundancy
An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode. |
|
| CWE-446 |
UI Discrepancy for Security Feature
The user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feature is in a secure state. |
|
| CWE-360 |
Trust of System Event Data
Security based on event locations are insecure and can be spoofed. |