CWE-1106: Insufficient Use of Symbolic Constants
The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants.
CWE Reference
CWE Weaknesses - Page 17
Browse cwe weaknesses with official CWE context and Glexia analysis.
Release 4.20listing
Search And Filters
Browse CWE records
Showing 50 of 969 CWE records · Page 17 of 20.
CWE-1107: Insufficient Isolation of Symbolic Constant Definitions
The source code uses symbolic constants, but it does not sufficiently place the definitions of these constants into a more centralized or isolated location.
CWE-1108: Excessive Reliance on Global Variables
The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of preserving the associated information in a narrower, more local context.
CWE-1109: Use of Same Variable for Multiple Purposes
The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data.
CWE-1110: Incomplete Design Documentation
The product's design documentation does not adequately describe control flow, data flow, system initialization, relationships between tasks, components, rationales, or other important aspects of the design.
CWE-1111: Incomplete I/O Documentation
The product's documentation does not adequately define inputs, outputs, or system/software interfaces.
CWE-1112: Incomplete Documentation of Program Execution
The document does not fully define all mechanisms that are used to control or influence how product-specific programs are executed.
CWE-1113: Inappropriate Comment Style
The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.
CWE-1114: Inappropriate Whitespace Style
The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.
CWE-1115: Source Code Element without Standard Prologue
The source code contains elements such as source files that do not consistently provide a prologue or header that has been standardized for the project.
CWE-1116: Inaccurate Source Code Comments
The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.
CWE-1117: Callable with Insufficient Behavioral Summary
The code contains a function or method whose signature and/or associated inline documentation does not sufficiently describe the callable's inputs, outputs, side effects, assumptions, or return codes.
CWE-1118: Insufficient Documentation of Error Handling Techniques
The documentation does not sufficiently describe the techniques that are used for error handling, exception processing, or similar mechanisms.
CWE-1119: Excessive Use of Unconditional Branching
The code uses too many unconditional branches (such as "goto").
CWE-1120: Excessive Code Complexity
The code is too complex, as calculated using a well-defined, quantitative measure.
CWE-1121: Excessive McCabe Cyclomatic Complexity
The code contains McCabe cyclomatic complexity that exceeds a desirable maximum.
CWE-1122: Excessive Halstead Complexity
The code is structured in a way that a Halstead complexity measure exceeds a desirable maximum.
CWE-1123: Excessive Use of Self-Modifying Code
The product uses too much self-modifying code.
CWE-1124: Excessively Deep Nesting
The code contains a callable or other code grouping in which the nesting / branching is too deep.
CWE-1125: Excessive Attack Surface
The product has an attack surface whose quantitative measurement exceeds a desirable maximum.
CWE-1126: Declaration of Variable with Unnecessarily Wide Scope
The source code declares a variable in one scope, but the variable is only used within a narrower scope.
CWE-1127: Compilation with Insufficient Warnings or Errors
The code is compiled without sufficient warnings enabled, which may prevent the detection of subtle bugs or quality issues.
CWE-1164: Irrelevant Code
The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.
CWE-1173: Improper Use of Validation Framework
The product does not use, or incorrectly uses, an input validation framework that is provided by the source language or an independent library.
CWE-1174: ASP.NET Misconfiguration: Improper Model Validation
The ASP.NET application does not use, or incorrectly uses, the model validation framework.
CWE-1176: Inefficient CPU Computation
The product performs CPU computations using algorithms that are not as efficient as they could be for the needs of the developer, i.e., the computations can be optimized further.
CWE-1177: Use of Prohibited Code
The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer.
CWE-1187: DEPRECATED: Use of Uninitialized Resource
This entry has been deprecated because it was a duplicate of CWE-908. All content has been transferred to CWE-908.
CWE-1188: Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-1189: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
The System-On-a-Chip (SoC) does not properly isolate shared resources between trusted and untrusted agents.
CWE-1190: DMA Device Enabled Too Early in Boot Phase
The product enables a Direct Memory Access (DMA) capable device before the security configuration settings are established, which allows an attacker to extract data from or gain privileges on the product.
CWE-1191: On-Chip Debug and Test Interface With Improper Access Control
The chip does not implement or does not correctly perform access control to check whether users are authorized to access internal registers and test modes through the physical debug/test interface.
CWE-1192: Improper Identifier for IP Block used in System-On-Chip (SOC)
The System-on-Chip (SoC) does not have unique, immutable identifiers for each of its components.
CWE-1193: Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
The product enables components that contain untrusted firmware before memory and fabric access controls have been enabled.
CWE-1204: Generation of Weak Initialization Vector (IV)
The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.
CWE-1209: Failure to Disable Reserved Bits
The reserved bits in a hardware design are not disabled prior to production. Typically, reserved bits are used for future capabilities and should not support any functional logic in the design. However, designers might covertly use these bits to debug or further develop new capabilities in production hardware. Adversaries with access to these bits will write to them in hopes of compromising hardware state.
CWE-1220: Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
CWE-1221: Incorrect Register Defaults or Module Parameters
Hardware description language code incorrectly defines register defaults or hardware Intellectual Property (IP) parameters to insecure values.
CWE-1222: Insufficient Granularity of Address Regions Protected by Register Locks
The product defines a large address region protected from modification by the same register lock control bit. This results in a conflict between the functional requirement that some addresses need to be writable by software during operation and the security requirement that the system configuration lock bit must be set during the boot process.
CWE-1223: Race Condition for Write-Once Attributes
A write-once register in hardware design is programmable by an untrusted software component earlier than the trusted software component, resulting in a race condition issue.
CWE-1224: Improper Restriction of Write-Once Bit Fields
The hardware design control register "sticky bits" or write-once bit fields are improperly implemented, such that they can be reprogrammed by software.
CWE-1229: Creation of Emergent Resource
The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used by attackers in violation of the intended policy.
CWE-1230: Exposure of Sensitive Information Through Metadata
The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.
CWE-1231: Improper Prevention of Lock Bit Modification
The product uses a trusted lock bit for restricting access to registers, address regions, or other resources, but the product does not prevent the value of the lock bit from being modified after it has been set.
CWE-1232: Improper Lock Behavior After Power State Transition
Register lock bit protection disables changes to system configuration once the bit is set. Some of the protected registers or lock bits become programmable after power state transitions (e.g., Entry and wake from low power sleep modes) causing the system configuration to be changeable.
CWE-1233: Security-Sensitive Hardware Controls with Missing Lock Bit Protection
The product uses a register lock bit protection mechanism, but it does not ensure that the lock bit prevents modification of system registers or controls that perform changes to important hardware system configuration.
CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks
System configuration protection may be bypassed during debug mode.
CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations
The code uses boxed primitives, which may introduce inefficiencies into performance-critical operations.
CWE-1236: Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
CWE-1239: Improper Zeroization of Hardware Register
The hardware product does not properly clear sensitive information from built-in registers when the user of the hardware block changes.