CWE-334: Small Space of Random Values
The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks.
CWE Reference
CWE Weaknesses - Page 7
Browse cwe weaknesses with official CWE context and Glexia analysis.
Release 4.20listing
Search And Filters
Browse CWE records
Showing 50 of 969 CWE records · Page 7 of 20.
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
CWE-339: Small Seed Space in PRNG
A Pseudo-Random Number Generator (PRNG) uses a relatively small seed space, which makes it more susceptible to brute force attacks.
CWE-340: Generation of Predictable Numbers or Identifiers
The product uses a scheme that generates numbers or identifiers that are more predictable than required.
CWE-341: Predictable from Observable State
A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.
CWE-342: Predictable Exact Value from Previous Values
An exact value or random number can be precisely predicted by observing previous values.
CWE-343: Predictable Value Range from Previous Values
The product's random number generator produces a series of values which, when observed, can be used to infer a relatively small range of possibilities for the next value that could be generated.
CWE-344: Use of Invariant Value in Dynamically Changing Context
The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-348: Use of Less Trusted Source
The product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action
The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
CWE-351: Insufficient Type Distinction
The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.
CWE-352: Cross-Site Request Forgery (CSRF)
The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-353: Missing Support for Integrity Check
The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
CWE-354: Improper Validation of Integrity Check Value
The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
CWE-356: Product UI does not Warn User of Unsafe Actions
The product's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This makes it easier for attackers to trick users into inflicting damage to their system.
CWE-357: Insufficient UI Warning of Dangerous Operations
The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not noticeable enough to warrant attention.
CWE-358: Improperly Implemented Security Check for Standard
The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
CWE-360: Trust of System Event Data
Security based on event locations are insecure and can be spoofed.
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
CWE-363: Race Condition Enabling Link Following
The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.
CWE-364: Signal Handler Race Condition
The product uses a signal handler that introduces a race condition.
CWE-365: DEPRECATED: Race Condition in Switch
This entry has been deprecated. There are no documented cases in which a switch's control expression is evaluated more than once.
CWE-366: Race Condition within a Thread
If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-368: Context Switching Race Condition
A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the product's behavior during the switch.
CWE-369: Divide By Zero
The product divides a value by zero.
CWE-370: Missing Check for Certificate Revocation after Initial Check
The product does not check the revocation status of a certificate after its initial revocation check, which can cause the product to perform privileged actions even after the certificate is revoked at a later time.
CWE-372: Incomplete Internal State Distinction
The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.
CWE-373: DEPRECATED: State Synchronization Error
This entry was deprecated because it overlapped the same concepts as race condition (CWE-362) and Improper Synchronization (CWE-662).
CWE-374: Passing Mutable Objects to an Untrusted Method
The product sends non-cloned mutable data as an argument to a method or function.
CWE-375: Returning a Mutable Object to an Untrusted Caller
Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.
CWE-377: Insecure Temporary File
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
CWE-378: Creation of Temporary File With Insecure Permissions
Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
CWE-379: Creation of Temporary File in Directory with Insecure Permissions
The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
CWE-382: J2EE Bad Practices: Use of System.exit()
A J2EE application uses System.exit(), which also shuts down its container.
CWE-383: J2EE Bad Practices: Direct Use of Threads
Thread management in a Web application is forbidden in some circumstances and is always highly error prone.
CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CWE-385: Covert Timing Channel
Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.
CWE-386: Symbolic Name not Mapping to Correct Object
A constant symbolic reference to an object is used, even though the reference can resolve to a different object over time.
CWE-390: Detection of Error Condition Without Action
The product detects a specific error, but takes no actions to handle the error.
CWE-391: Unchecked Error Condition
[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
CWE-392: Missing Report of Error Condition
The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.