Search
Weaknesses
| CWE | Weakness | Actions |
|---|---|---|
| CWE-650 |
Trusting HTTP Permission Methods on the Server Side
The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state. |
|
| CWE-501 |
Trust Boundary Violation
The product mixes trusted and untrusted data in the same data structure or structured message. |
|
| CWE-222 |
Truncation of Security-relevant Information
The product truncates the display, recording, or processing of security-relevant information in a way that can obscure the source or nature of an attack. |
|
| CWE-507 |
Trojan Horse
The product appears to contain benign or useful functionality, but it also contains code that is hidden from normal operation that violates the intended security policy of the user or the system administrator. |
|
| CWE-510 |
Trapdoor
A trapdoor is a hidden piece of code that responds to a special input, allowing its user access to resources without passing through the normal security enforcement mechanism. |
|
| CWE-402 |
Transmission of Private Resources into a New Sphere ('Resource Leak')
The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product. |
|
| CWE-367 |
Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. |
|
| CWE-449 |
The UI Performs the Wrong Action
The UI performs the wrong action with respect to the user's request. |
|
| CWE-1088 |
Synchronous Access of Remote Resource without Timeout
The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite. |
|
| CWE-386 |
Symbolic Name not Mapping to Correct Object
A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time. |
|
| CWE-546 |
Suspicious Comment
The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses. |
|
| CWE-110 |
Struts: Validator Without Form Field
Validation fields that do not appear in forms they are associated with indicate that the validation logic is out of date. |
|
| CWE-109 |
Struts: Validator Turned Off
Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation. |
|
| CWE-108 |
Struts: Unvalidated Action Form
Every Action Form must have a corresponding validation form. |
|
| CWE-107 |
Struts: Unused Validation Form
An unused validation form indicates that validation logic is not up-to-date. |
|
| CWE-106 |
Struts: Plug-in Framework not in Use
When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation. |
|
| CWE-608 |
Struts: Non-private Field in ActionForm Class
An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter. |
|
| CWE-103 |
Struts: Incomplete validate() Method Definition
The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate(). |
|
| CWE-105 |
Struts: Form Field Without Validator
The product has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation. |
|
| CWE-104 |
Struts: Form Bean Does Not Extend Validation Class
If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation. |