CWE-391: Unchecked Error Condition
[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
CWE Reference
CWE in implementation - Page 5
Browse cwe in implementation with official CWE context and Glexia analysis.
Release 4.20listing
Search And Filters
Browse CWE records
Showing 50 of 481 CWE records · Page 5 of 10.
CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference
Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.
CWE-400: Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
CWE-401: Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-404: Improper Resource Shutdown or Release
The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-406: Insufficient Control of Network Message Volume (Network Amplification)
The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.
CWE-410: Insufficient Resource Pool
The product's resource pool is not large enough to handle peak demand, which allows an attacker to prevent others from accessing the resource by using a (relatively) large number of requests for resources.
CWE-412: Unrestricted Externally Accessible Lock
The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.
CWE-413: Improper Resource Locking
The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.
CWE-414: Missing Lock Check
A product does not check to see if a lock is present before performing sensitive operations on a resource.
CWE-415: Double Free
The product calls free() twice on the same memory address.
CWE-416: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-426: Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CWE-428: Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
CWE-431: Missing Handler
A handler is not available or implemented.
CWE-432: Dangerous Signal Handler not Disabled During Sensitive Operations
The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running.
CWE-434: Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
CWE-450: Multiple Interpretations of UI Input
The UI has multiple interpretations of user input but does not prompt the user when it selects the less secure interpretation.
CWE-451: User Interface (UI) Misrepresentation of Critical Information
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
CWE-454: External Initialization of Trusted Variables or Data Stores
The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.
CWE-455: Non-exit on Failed Initialization
The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.
CWE-456: Missing Initialization of a Variable
The product does not initialize critical variables, which causes the execution environment to use unexpected values.
CWE-457: Use of Uninitialized Variable
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CWE-459: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CWE-460: Improper Cleanup on Thrown Exception
The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.
CWE-464: Addition of Data Structure Sentinel
The accidental addition of a data-structure sentinel can cause serious programming logic problems.
CWE-467: Use of sizeof() on a Pointer Type
The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to determine the size of the data that is being pointed to.
CWE-468: Incorrect Pointer Scaling
In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
CWE-469: Use of Pointer Subtraction to Determine Size
The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
CWE-471: Modification of Assumed-Immutable Data (MAID)
The product does not properly protect an assumed-immutable element from being modified by an attacker.
CWE-472: External Control of Assumed-Immutable Web Parameter
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
CWE-473: PHP External Variable Modification
A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
CWE-477: Use of Obsolete Function
The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
CWE-478: Missing Default Case in Multiple Condition Expression
The code does not have a default case in an expression with multiple conditions, such as a switch statement.
CWE-479: Signal Handler Use of a Non-reentrant Function
The product defines a signal handler that calls a non-reentrant function.
CWE-481: Assigning instead of Comparing
The code uses an operator for assignment when the intention was to perform a comparison.
CWE-483: Incorrect Block Delimitation
The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.
CWE-484: Omitted Break Statement in Switch
The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.
CWE-486: Comparison of Classes by Name
The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.
CWE-487: Reliance on Package-level Scope
Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
CWE-491: Public cloneable() Method Without Final ('Object Hijack')
A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.
CWE-492: Use of Inner Class Containing Sensitive Data
Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers.
CWE-493: Critical Public Variable Without Final Modifier
The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
CWE-494: Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
CWE-495: Private Data Structure Returned From A Public Method
The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.
CWE-496: Public Data Assigned to Private Array-Typed Field
Assigning public data to a private array is equivalent to giving public access to the array.