CWE-510: Trapdoor
A trapdoor is a hidden piece of code that responds to a special input, allowing its user access to resources without passing through the normal security enforcement mechanism.
CWE Reference
CWE Weaknesses - Page 10
Browse cwe weaknesses with official CWE context and Glexia analysis.
Release 4.20listing
Search And Filters
Browse CWE records
Showing 50 of 969 CWE records · Page 10 of 20.
CWE-511: Logic/Time Bomb
The product contains code that is designed to disrupt the legitimate operation of the product (or its environment) when a certain time passes, or when a certain logical condition is met.
CWE-512: Spyware
The product collects personally identifiable information about a human user or the user's activities, but the product accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the product.
CWE-514: Covert Channel
A covert channel is a path that can be used to transfer information in a way not intended by the system's designers.
CWE-515: Covert Storage Channel
A covert storage channel transfers information through the setting of bits by one program and the reading of those bits by another. What distinguishes this case from that of ordinary operation is that the bits are used to convey encoded information.
CWE-516: DEPRECATED: Covert Timing Channel
This weakness can be found at CWE-385.
CWE-520: .NET Misconfiguration: Use of Impersonation
Allowing a .NET application to run at potentially escalated levels of access to the underlying operating and file systems can be dangerous and result in various forms of attacks.
CWE-521: Weak Password Requirements
The product does not require that users should have strong passwords.
CWE-522: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-523: Unprotected Transport of Credentials
Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
CWE-524: Use of Cache Containing Sensitive Information
The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
CWE-525: Use of Web Browser Cache Containing Sensitive Information
The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
The product uses an environment variable to store unencrypted sensitive information.
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere
The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere
The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere
The product stores access control list files in a directory or other container that is accessible to actors outside of the intended control sphere.
CWE-530: Exposure of Backup File to an Unauthorized Control Sphere
A backup file is stored in a directory or archive that is made accessible to unauthorized actors.
CWE-531: Inclusion of Sensitive Information in Test Code
Accessible test applications can pose a variety of security risks. Since developers or administrators rarely consider that someone besides themselves would even know about the existence of these applications, it is common for them to contain sensitive information or functions.
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
CWE-533: DEPRECATED: Information Exposure Through Server Log Files
This entry has been deprecated because its abstraction was too low-level. See CWE-532.
CWE-534: DEPRECATED: Information Exposure Through Debug Log Files
This entry has been deprecated because its abstraction was too low-level. See CWE-532.
CWE-535: Exposure of Information Through Shell Error Message
A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system.
CWE-536: Servlet Runtime Error Message Containing Sensitive Information
A servlet error message indicates that there exists an unhandled exception in the web application code and may provide useful information to an attacker.
CWE-537: Java Runtime Error Message Containing Sensitive Information
In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system.
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
CWE-539: Use of Persistent Cookies Containing Sensitive Information
The web application uses persistent cookies, but the cookies contain sensitive information.
CWE-540: Inclusion of Sensitive Information in Source Code
Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.
CWE-541: Inclusion of Sensitive Information in an Include File
If an include file source is accessible, the file can contain usernames and passwords, as well as sensitive information pertaining to the application and system.
CWE-542: DEPRECATED: Information Exposure Through Cleanup Log Files
This entry has been deprecated because its abstraction was too low-level. See CWE-532.
CWE-543: Use of Singleton Pattern Without Synchronization in a Multithreaded Context
The product uses the singleton pattern when creating a resource within a multithreaded environment.
CWE-544: Missing Standardized Error Handling Mechanism
The product does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.
CWE-545: DEPRECATED: Use of Dynamic Class Loading
This weakness has been deprecated because it partially overlaps CWE-470, it describes legitimate programmer behavior, and other portions will need to be integrated into other entries.
CWE-546: Suspicious Comment
The code contains comments that suggest the presence of bugs, incomplete functionality, or weaknesses.
CWE-547: Use of Hard-coded, Security-relevant Constants
The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
CWE-548: Exposure of Information Through Directory Listing
The product inappropriately exposes a directory listing with an index of all the resources located inside of the directory.
CWE-549: Missing Password Field Masking
The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.
CWE-550: Server-generated Error Message Containing Sensitive Information
Certain conditions, such as network failure, will cause a server error message to be displayed.
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
CWE-552: Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
CWE-553: Command Shell in Externally Accessible Directory
A possible shell file exists in /cgi-bin/ or other accessible directories. This is extremely dangerous and can be used by an attacker to execute commands on the web server.
CWE-554: ASP.NET Misconfiguration: Not Using Input Validation Framework
The ASP.NET application does not use an input validation framework.
CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File
The J2EE application stores a plaintext password in a configuration file.
CWE-556: ASP.NET Misconfiguration: Use of Identity Impersonation
Configuring an ASP.NET application to run with impersonated credentials may give the application unnecessary privileges.
CWE-558: Use of getlogin() in Multithreaded Application
The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.
CWE-560: Use of umask() with chmod-style Argument
The product calls umask() with an incorrect argument that is specified as if it is an argument to chmod().
CWE-561: Dead Code
The product contains dead code, which can never be executed.
CWE-562: Return of Stack Variable Address
A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.
CWE-563: Assignment to Variable without Use
The variable's value is assigned but never used, making it a dead store.
CWE-564: SQL Injection: Hibernate
Using Hibernate to execute a dynamic SQL statement built with user-controlled input can allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands.
CWE-565: Reliance on Cookies without Validation and Integrity Checking
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.