CWE-453: Insecure Default Variable Initialization
The product, by default, initializes an internal variable with an insecure or less secure value than is possible.
CWE Reference
CWE Weaknesses - Page 9
Browse cwe weaknesses with official CWE context and Glexia analysis.
Release 4.20listing
Search And Filters
Browse CWE records
Showing 50 of 969 CWE records · Page 9 of 20.
CWE-454: External Initialization of Trusted Variables or Data Stores
The product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors.
CWE-455: Non-exit on Failed Initialization
The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.
CWE-456: Missing Initialization of a Variable
The product does not initialize critical variables, which causes the execution environment to use unexpected values.
CWE-457: Use of Uninitialized Variable
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CWE-458: DEPRECATED: Incorrect Initialization
This weakness has been deprecated because its name and description did not match. The description duplicated CWE-454, while the name suggested a more abstract initialization problem. Please refer to CWE-665 for the more abstract problem.
CWE-459: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CWE-460: Improper Cleanup on Thrown Exception
The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.
CWE-462: Duplicate Key in Associative List (Alist)
Duplicate keys in associative lists can lead to non-unique keys being mistaken for an error.
CWE-463: Deletion of Data Structure Sentinel
The accidental deletion of a data-structure sentinel can cause serious programming logic problems.
CWE-464: Addition of Data Structure Sentinel
The accidental addition of a data-structure sentinel can cause serious programming logic problems.
CWE-466: Return of Pointer Value Outside of Expected Range
A function can return a pointer to memory that is outside of the buffer that the pointer is expected to reference.
CWE-467: Use of sizeof() on a Pointer Type
The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to determine the size of the data that is being pointed to.
CWE-468: Incorrect Pointer Scaling
In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
CWE-469: Use of Pointer Subtraction to Determine Size
The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
CWE-471: Modification of Assumed-Immutable Data (MAID)
The product does not properly protect an assumed-immutable element from being modified by an attacker.
CWE-472: External Control of Assumed-Immutable Web Parameter
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
CWE-473: PHP External Variable Modification
A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
CWE-474: Use of Function with Inconsistent Implementations
The code uses a function that has inconsistent implementations across operating systems and versions.
CWE-475: Undefined Behavior for Input to API
The behavior of this function is undefined unless its control parameter is set to a specific value.
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
CWE-477: Use of Obsolete Function
The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
CWE-478: Missing Default Case in Multiple Condition Expression
The code does not have a default case in an expression with multiple conditions, such as a switch statement.
CWE-479: Signal Handler Use of a Non-reentrant Function
The product defines a signal handler that calls a non-reentrant function.
CWE-480: Use of Incorrect Operator
The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.
CWE-481: Assigning instead of Comparing
The code uses an operator for assignment when the intention was to perform a comparison.
CWE-482: Comparing instead of Assigning
The code uses an operator for comparison when the intention was to perform an assignment.
CWE-483: Incorrect Block Delimitation
The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.
CWE-484: Omitted Break Statement in Switch
The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.
CWE-486: Comparison of Classes by Name
The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.
CWE-487: Reliance on Package-level Scope
Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.
CWE-488: Exposure of Data Element to Wrong Session
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
CWE-489: Active Debug Code
The product is released with debugging code still enabled or active.
CWE-491: Public cloneable() Method Without Final ('Object Hijack')
A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.
CWE-492: Use of Inner Class Containing Sensitive Data
Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers.
CWE-493: Critical Public Variable Without Final Modifier
The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
CWE-494: Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
CWE-495: Private Data Structure Returned From A Public Method
The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.
CWE-496: Public Data Assigned to Private Array-Typed Field
Assigning public data to a private array is equivalent to giving public access to the array.
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
CWE-498: Cloneable Class Containing Sensitive Information
The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.
CWE-499: Serializable Class Containing Sensitive Data
The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.
CWE-500: Public Static Field Not Marked Final
An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.
CWE-501: Trust Boundary Violation
The product mixes trusted and untrusted data in the same data structure or structured message.
CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
CWE-507: Trojan Horse
The product appears to contain benign or useful functionality, but it also contains code that is hidden from normal operation that violates the intended security policy of the user or the system administrator.
CWE-508: Non-Replicating Malicious Code
Non-replicating malicious code only resides on the target system or product that is attacked; it does not attempt to spread to other systems.
CWE-509: Replicating Malicious Code (Virus or Worm)
Replicating malicious code, including viruses and worms, will attempt to attack other systems once it has successfully compromised the target system or the product.