970 indexed
CWECWE weaknesses
970 MITRE CWE entries — software weakness types that underlie vulnerabilities (CVE→CWE link). Filter by category. Authored by Adam Lundqvist.
Showing 201–250 of 970 · page 5 of 20
| ID | Title | Summary |
|---|---|---|
| CWE-1287 | Improper Validation of Specified Type of Input | The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expect… |
| CWE-1288 | Improper Validation of Consistency within Input | The product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validate… |
| CWE-1289 | Improper Validation of Unsafe Equivalence in Input | The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that th… |
| CWE-129 | Improper Validation of Array Index | The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the i… |
| CWE-1290 | Incorrect Decoding of Security Identifiers | The product implements a decoding mechanism to decode certain bus-transaction signals to security identifiers. If the decoding is implemented incorrectly, then… |
| CWE-1291 | Public Key Re-Use for Signing both Debug and Production Code | The same public key is used for signing both debug and production code. |
| CWE-1292 | Incorrect Conversion of Security Identifiers | The product implements a conversion mechanism to map certain bus-transaction signals to security identifiers. However, if the conversion is incorrectly impleme… |
| CWE-1293 | Missing Source Correlation of Multiple Independent Data | The product relies on one source of data, preventing the ability to detect if an adversary has compromised a data source. |
| CWE-1294 | Insecure Security Identifier Mechanism | The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from … |
| CWE-1295 | Debug Messages Revealing Unnecessary Information | The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages. |
| CWE-1296 | Incorrect Chaining or Granularity of Debug Components | The product's debug components contain incorrect chaining or granularity of debug components. |
| CWE-1297 | Unprotected Confidential Information on Device is Accessible by OSAT Vendors | The product does not adequately protect confidential information on the device from being accessed by Outsourced Semiconductor Assembly and Test (OSAT) vendors. |
| CWE-1298 | Hardware Logic Contains Race Conditions | A race condition in the hardware logic results in undermining security guarantees of the system. |
| CWE-1299 | Missing Protection Mechanism for Alternate Hardware Interface | The lack of protections on alternate paths to access control-protected assets (such as unprotected shadow registers and other e… |
| CWE-13 | ASP.NET Misconfiguration: Password in Configuration File | Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target f… |
| CWE-130 | Improper Handling of Length Parameter Inconsistency | The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length o… |
| CWE-1300 | Improper Protection of Physical Side Channels | The device does not contain sufficient protection mechanisms to prevent physical side channels from exposing sensitive information due to patterns in physica… |
| CWE-1301 | Insufficient or Incomplete Data Removal within Hardware Component | The product's data removal process does not completely delete all data and potentially sensitive information within hardware components. |
| CWE-1302 | Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) | The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. A … |
| CWE-1303 | Non-Transparent Sharing of Microarchitectural Resources | Hardware structures shared across execution contexts (e.g., caches and branch predictors) can violate the expected architecture isolation between contexts. |
| CWE-1304 | Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation | The product performs a power save/restore operation, but it does not ensure that the integrity of the configuration state is maintained… |
| CWE-131 | Incorrect Calculation of Buffer Size | The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow. |
| CWE-1310 | Missing Ability to Patch ROM Code | Missing an ability to patch ROM code may leave a System or System-on-Chip (SoC) in a vulnerable state. |
| CWE-1311 | Improper Translation of Security Attributes by Fabric Bridge | The bridge incorrectly translates security attributes from either trusted to untrusted or from untrusted to trusted when converting from one fabric protocol to… |
| CWE-1312 | Missing Protection for Mirrored Regions in On-Chip Fabric Firewall | The firewall in an on-chip fabric protects the main addressed region, but it does not protect any mirrored memory or memory-mapped-IO (MMIO) regions. |
| CWE-1313 | Hardware Allows Activation of Test or Debug Logic at Runtime | During runtime, the hardware allows for test or debug logic (feature) to be activated, which allows for changing the state of the hardware. This feature can al… |
| CWE-1314 | Missing Write Protection for Parametric Data Values | The device does not write-protect the parametric data values for sensors that scale the sensor value, allowing untrusted software to manipulate the apparent re… |
| CWE-1315 | Improper Setting of Bus Controlling Capability in Fabric End-point | The bus controller enables bits in the fabric end-point to allow responder devices to control transactions on the fabric. |
| CWE-1316 | Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges | The address map of the on-chip fabric has protected and unprotected regions overlapping, allowing an attacker to bypass access control to the overlapping porti… |
| CWE-1317 | Improper Access Control in Fabric Bridge | The product uses a fabric bridge for transactions between two Intellectual Property (IP) blocks, but the bridge does not properly perform the expected privileg… |
| CWE-1318 | Missing Support for Security Features in On-chip Fabrics or Buses | On-chip fabrics or buses either do not support or are not configured to support privilege separation or other security features, such as access control. |
| CWE-1319 | Improper Protection against Electromagnetic Fault Injection (EM-FI) | The device is susceptible to electromagnetic fault injection attacks, causing device internal information to be compromised or security mechanisms to be bypass… |
| CWE-132 | DEPRECATED: Miscalculated Null Termination | This entry has been deprecated because it was a duplicate of CWE-170. All content has been transferred to CWE-170. |
| CWE-1320 | Improper Protection for Outbound Error Messages and Alert Signals | Untrusted agents can disable alerts about signal conditions exceeding limits or the response mechanism that handles such alerts. |
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly co… |
| CWE-1322 | Use of Blocking Code in Single-threaded, Non-blocking Context | The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it… |
| CWE-1323 | Improper Management of Sensitive Trace Data | Trace data collected from several sources on the System-on-Chip (SoC) is stored in unprotected locations or transported to untr… |
| CWE-1324 | DEPRECATED: Sensitive Information Accessible by Physical Probing of JTAG Interface | This entry has been deprecated because it was at a lower level of abstraction than supported by CWE. All relevant content has been integrated into CWE-319. |
| CWE-1325 | Improperly Controlled Sequential Memory Allocation | The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount … |
| CWE-1326 | Missing Immutable Root of Trust in Hardware | A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code. |
| CWE-1327 | Binding to an Unrestricted IP Address | The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely. |
| CWE-1328 | Security Version Number Mutable to Older Versions | Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions. |
| CWE-1329 | Reliance on Component That is Not Updateable | The product contains a component that cannot be updated or patched in order to remove vulnerabilities or significant bugs. |
| CWE-1330 | Remanent Data Readable after Memory Erase | Confidential information stored in memory circuits is readable or recoverable after being cleared or erased. |
| CWE-1331 | Improper Isolation of Shared Resources in Network On Chip (NoC) | The Network On Chip (NoC) does not isolate or incorrectly isolates its on-chip-fabric and internal resources such that they are shared between trusted and untr… |
| CWE-1332 | Improper Handling of Faults that Lead to Instruction Skips | The device is missing or incorrectly implements circuitry or sensors that detect and mitigate the skipping of security-critical CPU instructions when they occu… |
| CWE-1333 | Inefficient Regular Expression Complexity | The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential. |
| CWE-1334 | Unauthorized Error Injection Can Degrade Hardware Redundancy | An unauthorized agent can inject errors into a redundant block to deprive the system of redundancy or put the system in a degraded operating mode. |
| CWE-1335 | Incorrect Bitwise Shift of Integer | An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an une… |
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or … |