CWE-95WeaknessVariant
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
CWE-96WeaknessBase
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.
CWE-134WeaknessBase
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CWE-457WeaknessVariant
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CWE-480WeaknessBase
The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.
CWE-624WeaknessBase
The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.
CWE-625WeaknessBase
The product uses a regular expression that does not sufficiently restrict the set of allowed values.
CWE-626WeaknessVariant
The product does not properly handle null bytes or NUL characters when passing data between different representations or components.
CWE-627WeaknessVariant
In a language where the user can influence the name of a variable at runtime, if the variable names are not controlled, an attacker can read or write to arbitrary variables, or access arbitrary functions.
CWE-685WeaknessVariant
The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses.
CWE-688WeaknessVariant
The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.
CWE-689WeaknessCompound
The product, while copying or cloning a resource, does not set the resource's permissions or access control until the copy is complete, leaving the resource exposed to other spheres while the copy is taking place.