970 indexed

CWECWE weaknesses

970 MITRE CWE entries — software weakness types that underlie vulnerabilities (CVE→CWE link). Filter by category. Authored by Adam Lundqvist.

Showing 251–300 of 644 in Other · page 6 of 13

IDTitleSummary
CWE-194Unexpected Sign ExtensionThe product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is ne…
CWE-195Signed to Unsigned Conversion ErrorThe product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive ca…
CWE-196Unsigned to Signed Conversion ErrorThe product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected value if the value of the unsigned primitive …
CWE-197Numeric Truncation ErrorTruncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion. When a primitive is cast to a smaller pr…
CWE-198Use of Incorrect Byte OrderingThe product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input,…
CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to pr…
CWE-203Observable DiscrepancyThe product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor.
CWE-204Observable Response DiscrepancyThe product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended…
CWE-205Observable Behavioral DiscrepancyThe product's behaviors indicate important differences that may be observed by unauthorized actors in a way that reveals (1) its internal state or decision pro…
CWE-206Observable Internal Behavioral DiscrepancyThe product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allo…
CWE-207Observable Behavioral Discrepancy With Equivalent ProductsThe product operates in an environment in which its existence or specific identity should not be known, but it behaves differently than other products with equ…
CWE-208Observable Timing DiscrepancyTwo separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant infor…
CWE-216DEPRECATED: Containment Errors (Container Errors)This entry has been deprecated, as it was not effective as a weakness and was structured more like a category. In addition, the name is inappropriate, since th…
CWE-217DEPRECATED: Failure to Protect Stored Data from ModificationThis entry has been deprecated because it incorporated and confused multiple weaknesses. The issues formerly covered in this entry can be found at CWE-766 and …
CWE-218DEPRECATED: Failure to provide confidentiality for stored dataThis weakness has been deprecated because it was a duplicate of CWE-493. All content has been transferred to CWE-493.
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directo…
CWE-221Information Loss or OmissionThe product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
CWE-222Truncation of Security-relevant InformationThe product truncates the display, recording, or processing of security-relevant information in a way that can obscure the source or nature of an attack.
CWE-223Omission of Security-relevant InformationThe product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is sa…
CWE-224Obscured Security-relevant Information by Alternate NameThe product records security-relevant information according to an alternate name of the affected entity, instead of the canonical name.
CWE-225DEPRECATED: General Information Management ProblemsThis weakness can be found at CWE-199.
CWE-228Improper Handling of Syntactically Invalid StructureThe product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.
CWE-229Improper Handling of ValuesThe product does not properly handle when the expected number of values for parameters, fields, or arguments is not provided in input, or if those values are u…
CWE-23Relative Path TraversalThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as "..…
CWE-230Improper Handling of Missing ValuesThe product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the associated value is missing, i.e. it is empt…
CWE-231Improper Handling of Extra ValuesThe product does not handle or incorrectly handles when more values are provided than expected.
CWE-232Improper Handling of Undefined ValuesThe product does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.
CWE-233Improper Handling of ParametersThe product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefine…
CWE-234Failure to Handle Missing ParameterIf too few arguments are sent to a function, the function will still pop the expected number of arguments from the stack. Potentially, a variable number of arg…
CWE-235Improper Handling of Extra ParametersThe product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.
CWE-236Improper Handling of Undefined ParametersThe product does not handle or incorrectly handles when a particular parameter, field, or argument name is not defined or supported by the product.
CWE-237Improper Handling of Structural ElementsThe product does not handle or incorrectly handles inputs that are related to complex structures.
CWE-238Improper Handling of Incomplete Structural ElementsThe product does not handle or incorrectly handles when a particular structural element is not completely specified.
CWE-239Failure to Handle Incomplete ElementThe product does not properly handle when a particular element is not completely specified.
CWE-24Path Traversal: '../filedir'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that …
CWE-240Improper Handling of Inconsistent Structural ElementsThe product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.
CWE-241Improper Handling of Unexpected Data TypeThe product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a let…
CWE-242Use of Inherently Dangerous FunctionThe product calls a function that can never be guaranteed to work safely. Certain functions behave in dangerous ways regardless of how they are used. Function…
CWE-243Creation of chroot Jail Without Changing Working DirectoryThe product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside …
CWE-245J2EE Bad Practices: Direct Management of ConnectionsThe J2EE application directly manages connections, instead of using the container's connection management facilities. The J2EE standard forbids the direct man…
CWE-246J2EE Bad Practices: Direct Use of SocketsThe J2EE application directly uses sockets instead of using framework method calls.
CWE-247DEPRECATED: Reliance on DNS Lookups in a Security DecisionThis entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.
CWE-248Uncaught ExceptionAn exception is thrown from a function, but it is not caught. When an exception is not caught, it may cause the program to crash or expose sensitive informati…
CWE-249DEPRECATED: Often Misused: Path ManipulationThis entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to C…
CWE-25Path Traversal: '/../filedir'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/../" sequences that…
CWE-252Unchecked Return ValueThe product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. Two common progra…
CWE-253Incorrect Check of Function Return ValueThe product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions. Important and common functio…
CWE-26Path Traversal: '/dir/../filename'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "/dir/../filename" se…
CWE-27Path Traversal: 'dir/../../filename'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal "..…
CWE-28Path Traversal: '..\filedir'The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "..\" sequences that …
Sourced from MITRE CWE 4.x XML. Curated by Adam Lundqvist, Founder at SQUR.