CWE-225: DEPRECATED: General Information Management Problems
This weakness can be found at CWE-199.
CWE Reference
CWE Weaknesses - Page 5
Browse cwe weaknesses with official CWE context and Glexia analysis.
Release 4.20listing
Search And Filters
Browse CWE records
Showing 50 of 969 CWE records · Page 5 of 20.
CWE-226: Sensitive Information in Resource Not Removed Before Reuse
The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
CWE-228: Improper Handling of Syntactically Invalid Structure
The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.
CWE-229: Improper Handling of Values
The product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are undefined.
CWE-230: Improper Handling of Missing Values
The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empty, blank, or null.
CWE-231: Improper Handling of Extra Values
The product does not handle or incorrectly handles when more values are provided than expected.
CWE-232: Improper Handling of Undefined Values
The product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.
CWE-233: Improper Handling of Parameters
The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.
CWE-234: Failure to Handle Missing Parameter
If too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arguments could be exhausted in a function as well.
CWE-235: Improper Handling of Extra Parameters
The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.
CWE-236: Improper Handling of Undefined Parameters
The product does not handle or incorrectly handles when a particular parameter, field, or argument name is not defined or supported by the product.
CWE-237: Improper Handling of Structural Elements
The product does not handle or incorrectly handles inputs that are related to complex structures.
CWE-238: Improper Handling of Incomplete Structural Elements
The product does not handle or incorrectly handles when a particular structural element is not completely specified.
CWE-239: Failure to Handle Incomplete Element
The product does not properly handle when a particular element is not completely specified.
CWE-240: Improper Handling of Inconsistent Structural Elements
The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.
CWE-241: Improper Handling of Unexpected Data Type
The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).
CWE-242: Use of Inherently Dangerous Function
The product calls a function that can never be guaranteed to work safely.
CWE-243: Creation of chroot Jail Without Changing Working Directory
The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.
CWE-244: Improper Clearing of Heap Memory Before Release ('Heap Inspection')
Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.
CWE-245: J2EE Bad Practices: Direct Management of Connections
The J2EE application directly manages connections, instead of using the container's connection management facilities.
CWE-246: J2EE Bad Practices: Direct Use of Sockets
The J2EE application directly uses sockets instead of using framework method calls.
CWE-247: DEPRECATED: Reliance on DNS Lookups in a Security Decision
This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.
CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
CWE-249: DEPRECATED: Often Misused: Path Manipulation
This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.
CWE-250: Execution with Unnecessary Privileges
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
CWE-252: Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-253: Incorrect Check of Function Return Value
The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.
CWE-256: Plaintext Storage of a Password
The product stores a password in plaintext within resources such as memory or files.
CWE-257: Storing Passwords in a Recoverable Format
The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
CWE-258: Empty Password in Configuration File
Using an empty string as a password is insecure.
CWE-259: Use of Hard-coded Password
The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
CWE-260: Password in Configuration File
The product stores a password in a configuration file that might be accessible to actors who do not know the password.
CWE-261: Weak Encoding for Password
Obscuring a password with a trivial encoding does not protect the password.
CWE-262: Not Using Password Aging
The product does not have a mechanism in place for managing password aging.
CWE-263: Password Aging with Long Expiration
The product supports password aging, but the expiration period is too long.
CWE-266: Incorrect Privilege Assignment
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-267: Privilege Defined With Unsafe Actions
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
CWE-268: Privilege Chaining
Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
CWE-269: Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-270: Privilege Context Switching Error
The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.
CWE-271: Privilege Dropping / Lowering Errors
The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.
CWE-272: Least Privilege Violation
The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
CWE-273: Improper Check for Dropped Privileges
The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
CWE-274: Improper Handling of Insufficient Privileges
The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
CWE-276: Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
CWE-277: Insecure Inherited Permissions
A product defines a set of insecure permissions that are inherited by objects that are created by the program.
CWE-278: Insecure Preserved Inherited Permissions
A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.
CWE-279: Incorrect Execution-Assigned Permissions
While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
CWE-280: Improper Handling of Insufficient Permissions or Privileges
The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.
CWE-281: Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.