CWE-448: Obsolete Feature in UI
A UI function is obsolete and the product does not warn the user.
CWE Reference
CWE in architecture and design - Page 4
Browse cwe in architecture and design with official CWE context and Glexia analysis.
Release 4.20listing
Search And Filters
Browse CWE records
Showing 50 of 379 CWE records · Page 4 of 8.
CWE-451: User Interface (UI) Misrepresentation of Critical Information
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
CWE-454: External Initialization of Trusted Variables or Data Stores
The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.
CWE-457: Use of Uninitialized Variable
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CWE-459: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CWE-462: Duplicate Key in Associative List (Alist)
Duplicate keys in associative lists can lead to non-unique keys being mistaken for an error.
CWE-463: Deletion of Data Structure Sentinel
The accidental deletion of a data-structure sentinel can cause serious programming logic problems.
CWE-464: Addition of Data Structure Sentinel
The accidental addition of a data-structure sentinel can cause serious programming logic problems.
CWE-468: Incorrect Pointer Scaling
In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
CWE-471: Modification of Assumed-Immutable Data (MAID)
The product does not properly protect an assumed-immutable element from being modified by an attacker.
CWE-474: Use of Function with Inconsistent Implementations
The code uses a function that has inconsistent implementations across operating systems and versions.
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
CWE-479: Signal Handler Use of a Non-reentrant Function
The product defines a signal handler that calls a non-reentrant function.
CWE-487: Reliance on Package-level Scope
Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
CWE-488: Exposure of Data Element to Wrong Session
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
CWE-494: Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
CWE-500: Public Static Field Not Marked Final
An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.
CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-521: Weak Password Requirements
The product does not require that users should have strong passwords.
CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-524: Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
CWE-525: Use of Web Browser Cache Containing Sensitive Information
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
The product uses an environment variable to store unencrypted sensitive information.
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
CWE-539: Use of Persistent Cookies Containing Sensitive Information
The web application uses persistent cookies, but the cookies contain sensitive information.
CWE-540: Inclusion of Sensitive Information in Source Code
Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.
CWE-541: Inclusion of Sensitive Information in an Include File
If an include file source is accessible, the file can contain usernames and passwords, as well as sensitive information pertaining to the application and system.
CWE-543: Use of Singleton Pattern Without Synchronization in a Multithreaded Context
The product uses the singleton pattern when creating a resource within a multithreaded environment.
CWE-544: Missing Standardized Error Handling Mechanism
The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.
CWE-548: Exposure of Information Through Directory Listing
The product inappropriately exposes a directory listing with an index of all the resources located inside of the directory.
CWE-550: Server-generated Error Message Containing Sensitive Information
Certain conditions, such as network failure, will cause a server error message to be displayed.
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
CWE-554: ASP.NET Misconfiguration: Not Using Input Validation Framework
The ASP.NET application does not use an input validation framework.
CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File
The J2EE application stores a plaintext password in a configuration file.
CWE-556: ASP.NET Misconfiguration: Use of Identity Impersonation
Configuring an ASP.NET application to run with impersonated credentials may give the application unnecessary privileges.
CWE-558: Use of getlogin() in Multithreaded Application
The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.
CWE-564: SQL Injection: Hibernate
Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.
CWE-565: Reliance on Cookies without Validation and Integrity Checking
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
CWE-575: EJB Bad Practices: Use of AWT Swing
The product violates the Enterprise JavaBeans (EJB) specification by using AWT/Swing.
CWE-577: EJB Bad Practices: Use of Sockets
The product violates the Enterprise JavaBeans (EJB) specification by using sockets.
CWE-578: EJB Bad Practices: Use of Class Loader
The product violates the Enterprise JavaBeans (EJB) specification by using the class loader.
CWE-590: Free of Memory not on the Heap
The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().
CWE-591: Sensitive Data Storage in Improperly Locked Memory
The product stores sensitive data in memory that is not locked, or that has been incorrectly locked, which might cause the memory to be written to swap files on disk by the virtual memory manager. This can make the data more accessible to external actors.
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
The product modifies the SSL context after connection creation has begun.
CWE-594: J2EE Framework: Saving Unserializable Objects to Disk
When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will complete successfully.
CWE-599: Missing Validation of OpenSSL Certificate
The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.