Browse cwe in implementation with official CWE context and Glexia analysis.
Search And Filters
Showing 50 of 481 CWE records · Page 4 of 10.
If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.
The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).
The product calls a function that can never be guaranteed to work safely.
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.
The product does not have a mechanism in place for managing password aging.
The product supports password aging, but the expiration period is too long.
The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
The product does not validate, or incorrectly validates, a certificate.
The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate.
The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.
A certificate expiration is not validated or is incorrectly validated.
The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
The product does not encrypt sensitive or critical information before storage or transmission.
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
The product performs a key exchange with an actor without verifying the identity of that actor.
Nonces should be used for the present occasion and only once.
The product uses a broken or risky cryptographic algorithm or protocol.
The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which causes algorithms to be susceptible to dictionary attacks when they are encrypted under the same key.
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.
True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
An exact value or random number can be precisely predicted by observing previous values.
The product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated.
The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
The product uses a signal handler that introduces a race condition.
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
The product sends non-cloned mutable data as an argument to a method or function.
Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.
Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
A J2EE application uses System.exit(), which also shuts down its container.
Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
The product detects a specific error, but takes no actions to handle the error.
