Browse cwe in architecture and design operation with official CWE context and Glexia analysis.
Search And Filters
Showing 35 of 35 CWE records.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
The product allows user input to control or influence paths or file names that are used in filesystem operations.
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
The product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.
The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.
The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
During installation, installed file permissions are set to allow anyone to modify those files.
A product defines a set of insecure permissions that are inherited by objects that are created by the program.
A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.
While it is executing, the product sets the permissions of an object in a way that violates the intended permissions that have been specified by the user.
The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.
The product does not properly verify that a critical resource is owned by the proper entity.
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
The product does not properly protect an assumed-immutable element from being modified by an attacker.
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived, reused, or guessed by an attacker.
