970 indexed

CWECWE weaknesses

970 MITRE CWE entries — software weakness types that underlie vulnerabilities (CVE→CWE link). Filter by category. Authored by Adam Lundqvist.

Showing 401–450 of 644 in Other · page 9 of 13

IDTitleSummary
CWE-44Path Equivalence: 'file.name' (Internal Dot)The product accepts path input in the form of internal dot ('file.ordir') without appropriate validation, which can lead to ambiguous path resolution and allow…
CWE-440Expected Behavior ViolationA feature, API, or function does not perform according to its specification.
CWE-441Unintended Proxy or Intermediary ('Confused Deputy')The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the req…
CWE-443DEPRECATED: HTTP response splittingThis weakness can be found at CWE-113.
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and serve…
CWE-446UI Discrepancy for Security FeatureThe user interface does not correctly enable or configure a security feature, but the interface provides feedback that causes the user to believe that the feat…
CWE-447Unimplemented or Unsupported Feature in UIA UI function for a security feature appears to be supported and gives feedback to the user that suggests that it is supported, but the underlying functionalit…
CWE-448Obsolete Feature in UIA UI function is obsolete and the product does not warn the user.
CWE-449The UI Performs the Wrong ActionThe UI performs the wrong action with respect to the user's request.
CWE-45Path Equivalence: 'file...name' (Multiple Internal Dot)The product accepts path input in the form of multiple internal dot ('file...dir') without appropriate validation, which can lead to ambiguous path resolution …
CWE-450Multiple Interpretations of UI InputThe UI has multiple interpretations of user input but does not prompt the user when it selects the less secure interpretation.
CWE-451User Interface (UI) Misrepresentation of Critical InformationThe user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. Thi…
CWE-454External Initialization of Trusted Variables or Data StoresThe product initializes critical internal variables or data stores using inputs that can be modified by untrusted actors. A product system should be reluctant…
CWE-455Non-exit on Failed InitializationThe product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a …
CWE-456Missing Initialization of a VariableThe product does not initialize critical variables, which causes the execution environment to use unexpected values.
CWE-457Use of Uninitialized VariableThe code uses a variable that has not been initialized, leading to unpredictable or unintended results. In some languages such as C and C++, stack variables a…
CWE-458DEPRECATED: Incorrect InitializationThis weakness has been deprecated because its name and description did not match. The description duplicated CWE-454, while the name suggested a more abstract …
CWE-459Incomplete CleanupThe product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CWE-46Path Equivalence: 'filename ' (Trailing Space)The product accepts path input in the form of trailing space ('filedir ') without appropriate validation, which can lead to ambiguous path resolution and allow…
CWE-460Improper Cleanup on Thrown ExceptionThe product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow. Often, wh…
CWE-462Duplicate Key in Associative List (Alist)Duplicate keys in associative lists can lead to non-unique keys being mistaken for an error. A duplicate key entry -- if the alist is designed properly -- cou…
CWE-463Deletion of Data Structure SentinelThe accidental deletion of a data-structure sentinel can cause serious programming logic problems. Often times data-structure sentinels are used to mark struc…
CWE-464Addition of Data Structure SentinelThe accidental addition of a data-structure sentinel can cause serious programming logic problems. Data-structure sentinels are often used to mark the structu…
CWE-47Path Equivalence: ' filename' (Leading Space)The product accepts path input in the form of leading space (' filedir') without appropriate validation, which can lead to ambiguous path resolution and allow …
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper …
CWE-471Modification of Assumed-Immutable Data (MAID)The product does not properly protect an assumed-immutable element from being modified by an attacker. This occurs when a particular input is critical enough …
CWE-472External Control of Assumed-Immutable Web ParameterThe web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.
CWE-473PHP External Variable ModificationA PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose t…
CWE-474Use of Function with Inconsistent ImplementationsThe code uses a function that has inconsistent implementations across operating systems and versions.
CWE-475Undefined Behavior for Input to APIThe behavior of this function is undefined unless its control parameter is set to a specific value.
CWE-477Use of Obsolete FunctionThe code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
CWE-479Signal Handler Use of a Non-reentrant FunctionThe product defines a signal handler that calls a non-reentrant function.
CWE-48Path Equivalence: 'file name' (Internal Whitespace)The product accepts path input in the form of internal space ('file(SPACE)name') without appropriate validation, which can lead to ambiguous path resolution an…
CWE-480Use of Incorrect OperatorThe product accidentally uses the wrong operator, which changes the logic in security-relevant ways. These types of errors are generally the result of a typo …
CWE-481Assigning instead of ComparingThe code uses an operator for assignment when the intention was to perform a comparison. In many languages the compare statement is very close in appearance t…
CWE-482Comparing instead of AssigningThe code uses an operator for comparison when the intention was to perform an assignment. In many languages, the compare statement is very close in appearance…
CWE-483Incorrect Block DelimitationThe code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error. In some languages, braces (or other del…
CWE-484Omitted Break Statement in SwitchThe product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems …
CWE-486Comparison of Classes by NameThe product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name. If the decision to trust the met…
CWE-487Reliance on Package-level ScopeJava packages are not inherently closed; therefore, relying on them for code security is not a good practice. The purpose of package scope is to prevent accid…
CWE-49Path Equivalence: 'filename/' (Trailing Slash)The product accepts path input in the form of trailing slash ('filedir/') without appropriate validation, which can lead to ambiguous path resolution and allow…
CWE-491Public cloneable() Method Without Final ('Object Hijack')A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to…
CWE-493Critical Public Variable Without Final ModifierThe product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values. If a field is non-final a…
CWE-494Download of Code Without Integrity CheckThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the …
CWE-495Private Data Structure Returned From A Public MethodThe product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.
CWE-496Public Data Assigned to Private Array-Typed FieldAssigning public data to a private array is equivalent to giving public access to the array.
CWE-50Path Equivalence: '//multiple/leading/slash'The product accepts path input in the form of multiple leading slash ('//multiple/leading/slash') without appropriate validation, which can lead to ambiguous p…
CWE-500Public Static Field Not Marked FinalAn object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways. Public static variables can be read…
CWE-501Trust Boundary ViolationThe product mixes trusted and untrusted data in the same data structure or structured message. A trust boundary can be thought of as line drawn through a prog…
CWE-506Embedded Malicious CodeThe product contains code that appears to be malicious in nature. Malicious flaws have acquired colorful names, including Trojan horse, trapdoor, timebomb, an…
Sourced from MITRE CWE 4.x XML. Curated by Adam Lundqvist, Founder at SQUR.