CWE-536: Servlet Runtime Error Message Containing Sensitive Information
A servlet error message indicates that there exists an unhandled exception in the web application code and may provide useful information to an attacker.
CWE Reference
CWE for java - Page 2
Browse cwe for java with official CWE context and Glexia analysis.
Release 4.20listing
Search And Filters
Browse CWE records
Showing 37 of 87 CWE records · Page 2 of 2.
CWE-537: Java Runtime Error Message Containing Sensitive Information
In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system.
CWE-543: Use of Singleton Pattern Without Synchronization in a Multithreaded Context
The product uses the singleton pattern when creating a resource within a multithreaded environment.
CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File
The J2EE application stores a plaintext password in a configuration file.
CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context
The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.
CWE-568: finalize() Method Without super.finalize()
The product contains a finalize() method that does not call super.finalize().
CWE-572: Call to Thread run() instead of start()
The product calls a thread's run() method instead of calling start(), which causes the code to run in the thread of the caller instead of the callee.
CWE-574: EJB Bad Practices: Use of Synchronization Primitives
The product violates the Enterprise JavaBeans (EJB) specification by using thread synchronization primitives.
CWE-575: EJB Bad Practices: Use of AWT Swing
The product violates the Enterprise JavaBeans (EJB) specification by using AWT/Swing.
CWE-576: EJB Bad Practices: Use of Java I/O
The product violates the Enterprise JavaBeans (EJB) specification by using the java.io package.
CWE-577: EJB Bad Practices: Use of Sockets
The product violates the Enterprise JavaBeans (EJB) specification by using sockets.
CWE-578: EJB Bad Practices: Use of Class Loader
The product violates the Enterprise JavaBeans (EJB) specification by using the class loader.
CWE-579: J2EE Bad Practices: Non-serializable Object Stored in Session
The product stores a non-serializable object as an HttpSession attribute, which can hurt reliability.
CWE-580: clone() Method Without super.clone()
The product contains a clone() method that does not call super.clone() to obtain the new object.
CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined
The product does not maintain equal hashcodes for equal objects.
CWE-582: Array Declared Public, Final, and Static
The product declares an array public, final, and static, which is not sufficient to prevent the array's contents from being modified.
CWE-583: finalize() Method Declared Public
The product violates secure coding principles for mobile code by declaring a finalize() method public.
CWE-585: Empty Synchronized Block
The product contains an empty synchronized block.
CWE-586: Explicit Call to Finalize()
The product makes an explicit call to the finalize() method from outside the finalizer.
CWE-594: J2EE Framework: Saving Unserializable Objects to Disk
When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will complete successfully.
CWE-595: Comparison of Object References Instead of Object Contents
The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.
CWE-597: Use of Wrong Operator in String Comparison
The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.
CWE-600: Uncaught Exception in Servlet
The Servlet does not catch all exceptions, which may reveal sensitive debugging information.
CWE-607: Public Static Final Field References Mutable Object
A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package.
CWE-608: Struts: Non-private Field in ActionForm Class
An ActionForm class contains a field that has not been declared private, which can be accessed without using a setter or getter.
CWE-609: Double-Checked Locking
The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient.
CWE-617: Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CWE-766: Critical Data Element Declared Public
The product declares a critical variable, field, or member to be public when intended security policy requires it to be private.
CWE-767: Access to Critical Private Variable via Public Method
The product defines a public method that reads or modifies a private variable.
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.
CWE-1024: Comparison of Incompatible Types
The product performs a comparison between two entities, but the entities are of different, incompatible types that cannot be guaranteed to provide correct results when they are directly compared.
CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations
The code uses boxed primitives, which may introduce inefficiencies into performance-critical operations.
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CWE-1335: Incorrect Bitwise Shift of Integer
An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result.
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.
CWE-1341: Multiple Releases of Same Resource or Handle
The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.