Browse cwe in implementation with official CWE context and Glexia analysis.
Search And Filters
Showing 50 of 481 CWE records · Page 6 of 10.
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.
The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.
An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
The product contains code that appears to be malicious in nature.
A covert storage channel transfers information through the setting of bits by one program and the reading of those bits by another. What distinguishes this case from that of ordinary operation is that the bits are used to convey encoded information.
The product does not require that users should have strong passwords.
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
The product uses an environment variable to store unencrypted sensitive information.
The product writes sensitive information to a log file.
In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system.
The product uses the singleton pattern when creating a resource within a multithreaded environment.
The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.
The product makes files or directories accessible to unauthorized actors, even though they should not be.
The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.
The product calls umask() with an incorrect argument that is specified as if it is an argument to chmod().
The product contains dead code, which can never be executed.
A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.
The variable's value is assigned but never used, making it a dead store.
Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.
The product contains a finalize() method that does not call super.finalize().
The product contains an expression that will always evaluate to false.
The product contains an expression that will always evaluate to true.
The product calls a thread's run() method instead of calling start(), which causes the code to run in the thread of the caller instead of the callee.
The product violates the Enterprise JavaBeans (EJB) specification by using thread synchronization primitives.
The product violates the Enterprise JavaBeans (EJB) specification by using the java.io package.
The product violates the Enterprise JavaBeans (EJB) specification by using sockets.
The product violates the Enterprise JavaBeans (EJB) specification by using the class loader.
The product stores a non-serializable object as an HttpSession attribute, which can hurt reliability.
The product contains a clone() method that does not call super.clone() to obtain the new object.
The product does not maintain equal hashcodes for equal objects.
The product declares an array public, final, and static, which is not sufficient to prevent the array's contents from being modified.
The product violates secure coding principles for mobile code by declaring a finalize() method public.
The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.
The product contains an empty synchronized block.
The product makes an explicit call to the finalize() method from outside the finalizer.
The product sets a pointer to a specific address other than NULL or 0.
Casting a non-structure type to a structure type and accessing a field can lead to memory access errors or data corruption.
The product uses an API function that does not exist on all versions of the target platform. This could cause portability problems or inconsistencies that allow denial of service or other consequences.
The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().
The product stores sensitive data in memory that is not locked, or that has been incorrectly locked, which might cause the memory to be written to swap files on disk by the virtual memory manager. This can make the data more accessible to external actors.
The product modifies the SSL context after connection creation has begun.
When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will complete successfully.
The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.
