CWE

Common Weakness Enumeration

A Community-Developed List of Software Weakness Types

CWE/SANS Top 25 Most Dangerous Software Errors
Home > CWE List > CWE- Individual Dictionary Definition (2.11)  
ID

CWE VIEW: Seven Pernicious Kingdoms

View ID: 700
Structure: Graph
Status: Incomplete
Presentation Filter:
+ View Data

View Objective

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

+ View Audience
StakeholderDescription
Developers

This view is useful for developers because it is organized around concepts with which developers are familiar, and it focuses on weaknesses that can be detected using source code analysis tools.

+ Alternate Terms
7PK:

"7PK" is frequently used by the MITRE team as an abbreviation.

+ Relationships
Show Details:
700 - Seven Pernicious Kingdoms
+CategoryCategoryEnvironment - (2)
700 (Seven Pernicious Kingdoms) > 2 (Environment)
Weaknesses in this category are typically introduced during unexpected environmental conditions.
*Weakness VariantWeakness VariantASP.NET Misconfiguration: Creating Debug Binary - (11)
700 (Seven Pernicious Kingdoms) > 2 (Environment) > 11 (ASP.NET Misconfiguration: Creating Debug Binary)
Debugging messages help attackers learn about the system and plan a form of attack.
*Weakness VariantWeakness VariantASP.NET Misconfiguration: Missing Custom Error Page - (12)
700 (Seven Pernicious Kingdoms) > 2 (Environment) > 12 (ASP.NET Misconfiguration: Missing Custom Error Page)
An ASP .NET application must enable custom error pages in order to prevent attackers from mining information from the framework's built-in responses.
*Weakness VariantWeakness VariantASP.NET Misconfiguration: Password in Configuration File - (13)
700 (Seven Pernicious Kingdoms) > 2 (Environment) > 13 (ASP.NET Misconfiguration: Password in Configuration File)
Storing a plaintext password in a configuration file allows anyone who can read the file access to the password-protected resource making them an easy target for attackers.
*Weakness BaseWeakness BaseCompiler Removal of Code to Clear Buffers - (14)
700 (Seven Pernicious Kingdoms) > 2 (Environment) > 14 (Compiler Removal of Code to Clear Buffers)
Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal."
*Weakness VariantWeakness VariantJ2EE Misconfiguration: Data Transmission Without Encryption - (5)
700 (Seven Pernicious Kingdoms) > 2 (Environment) > 5 (J2EE Misconfiguration: Data Transmission Without Encryption)
Information sent over a network can be compromised while in transit. An attacker may be able to read/modify the contents if the data are sent in plaintext or are weakly encrypted.
*Weakness VariantWeakness VariantJ2EE Misconfiguration: Entity Bean Declared Remote - (8)
700 (Seven Pernicious Kingdoms) > 2 (Environment) > 8 (J2EE Misconfiguration: Entity Bean Declared Remote)
When an application exposes a remote interface for an entity bean, it might also expose methods that get or set the bean's data. These methods could be leveraged to read sensitive information, or to change data in ways that violate the application's expectations, potentially leading to other vulnerabilities.
*Weakness VariantWeakness VariantJ2EE Misconfiguration: Insufficient Session-ID Length - (6)
700 (Seven Pernicious Kingdoms) > 2 (Environment) > 6 (J2EE Misconfiguration: Insufficient Session-ID Length)
The J2EE application is configured to use an insufficient session ID length.
*Weakness VariantWeakness VariantJ2EE Misconfiguration: Missing Custom Error Page - (7)
700 (Seven Pernicious Kingdoms) > 2 (Environment) > 7 (J2EE Misconfiguration: Missing Custom Error Page)
The default error page of a web application should not display sensitive information about the software system.
*Weakness VariantWeakness VariantJ2EE Misconfiguration: Weak Access Permissions for EJB Methods - (9)
700 (Seven Pernicious Kingdoms) > 2 (Environment) > 9 (J2EE Misconfiguration: Weak Access Permissions for EJB Methods)
If elevated access rights are assigned to EJB methods, then an attacker can take advantage of the permissions to exploit the software system.
+CategoryCategoryError Handling - (388)
700 (Seven Pernicious Kingdoms) > 388 (Error Handling)
This category includes weaknesses that occur when an application does not properly handle errors that occur during processing.
*Weakness BaseWeakness BaseDeclaration of Catch for Generic Exception - (396)
700 (Seven Pernicious Kingdoms) > 388 (Error Handling) > 396 (Declaration of Catch for Generic Exception)
Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
*Weakness BaseWeakness BaseDeclaration of Throws for Generic Exception - (397)
700 (Seven Pernicious Kingdoms) > 388 (Error Handling) > 397 (Declaration of Throws for Generic Exception)
Throwing overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
*Weakness BaseWeakness BaseUnchecked Error Condition - (391)
700 (Seven Pernicious Kingdoms) > 388 (Error Handling) > 391 (Unchecked Error Condition)
Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
*Weakness BaseWeakness BaseUse of NullPointerException Catch to Detect NULL Pointer Dereference - (395)
700 (Seven Pernicious Kingdoms) > 388 (Error Handling) > 395 (Use of NullPointerException Catch to Detect NULL Pointer Dereference)
Catching NullPointerException should not be used as an alternative to programmatic checks to prevent dereferencing a null pointer.
+Weakness ClassWeakness ClassImproper Fulfillment of API Contract ('API Abuse') - (227)
700 (Seven Pernicious Kingdoms) > 227 (Improper Fulfillment of API Contract ('API Abuse'))
The software uses an API in a manner contrary to its intended use.API Abuse
*Weakness VariantWeakness VariantCreation of chroot Jail Without Changing Working Directory - (243)
700 (Seven Pernicious Kingdoms) > 227 (Improper Fulfillment of API Contract ('API Abuse')) > 243 (Creation of chroot Jail Without Changing Working Directory)
The program uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.
*Weakness ClassWeakness ClassExecution with Unnecessary Privileges - (250)
700 (Seven Pernicious Kingdoms) > 227 (Improper Fulfillment of API Contract ('API Abuse')) > 250 (Execution with Unnecessary Privileges)
The software performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
*Weakness VariantWeakness VariantImproper Clearing of Heap Memory Before Release ('Heap Inspection') - (244)
700 (Seven Pernicious Kingdoms) > 227 (Improper Fulfillment of API Contract ('API Abuse')) > 244 (Improper Clearing of Heap Memory Before Release ('Heap Inspection'))
Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.
*Weakness VariantWeakness VariantJ2EE Bad Practices: Direct Management of Connections - (245)
700 (Seven Pernicious Kingdoms) > 227 (Improper Fulfillment of API Contract ('API Abuse')) > 245 (J2EE Bad Practices: Direct Management of Connections)
The J2EE application directly manages connections, instead of using the container's connection management facilities.
*Weakness VariantWeakness VariantJ2EE Bad Practices: Direct Use of Sockets - (246)
700 (Seven Pernicious Kingdoms) > 227 (Improper Fulfillment of API Contract ('API Abuse')) > 246 (J2EE Bad Practices: Direct Use of Sockets)
The J2EE application directly uses sockets instead of using framework method calls.
*CategoryCategoryOften Misused: String Management - (251)
700 (Seven Pernicious Kingdoms) > 227 (Improper Fulfillment of API Contract ('API Abuse')) > 251 (Often Misused: String Management)
Functions that manipulate strings encourage buffer overflows.
*Weakness BaseWeakness BaseUncaught Exception - (248)
700 (Seven Pernicious Kingdoms) > 227 (Improper Fulfillment of API Contract ('API Abuse')) > 248 (Uncaught Exception)
An exception is thrown from a function, but it is not caught.
*Weakness BaseWeakness BaseUnchecked Return Value - (252)
700 (Seven Pernicious Kingdoms) > 227 (Improper Fulfillment of API Contract ('API Abuse')) > 252 (Unchecked Return Value)
The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
*Weakness BaseWeakness BaseUse of Inherently Dangerous Function - (242)
700 (Seven Pernicious Kingdoms) > 227 (Improper Fulfillment of API Contract ('API Abuse')) > 242 (Use of Inherently Dangerous Function)
The program calls a function that can never be guaranteed to work safely.
*Weakness VariantWeakness VariantUse of getlogin() in Multithreaded Application - (558)
700 (Seven Pernicious Kingdoms) > 227 (Improper Fulfillment of API Contract ('API Abuse')) > 558 (Use of getlogin() in Multithreaded Application)
The application uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.
+Weakness ClassWeakness ClassIndicator of Poor Code Quality - (398)
700 (Seven Pernicious Kingdoms) > 398 (Indicator of Poor Code Quality)
The code has features that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained.
*Weakness VariantWeakness VariantDouble Free - (415)
700 (Seven Pernicious Kingdoms) > 398 (Indicator of Poor Code Quality) > 415 (Double Free)
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.Double-free
*Weakness BaseWeakness BaseImproper Release of Memory Before Removing Last Reference ('Memory Leak') - (401)
700 (Seven Pernicious Kingdoms) > 398 (Indicator of Poor Code Quality) > 401 (Improper Release of Memory Before Removing Last Reference ('Memory Leak'))
The software does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.Memory Leak
*Weakness BaseWeakness BaseImproper Resource Shutdown or Release - (404)
700 (Seven Pernicious Kingdoms) > 398 (Indicator of Poor Code Quality) > 404 (Improper Resource Shutdown or Release)
The program does not release or incorrectly releases a resource before it is made available for re-use.
*Weakness BaseWeakness BaseNULL Pointer Dereference - (476)
700 (Seven Pernicious Kingdoms) > 398 (Indicator of Poor Code Quality) > 476 (NULL Pointer Dereference)
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
*Weakness BaseWeakness BaseUndefined Behavior for Input to API - (475)
700 (Seven Pernicious Kingdoms) > 398 (Indicator of Poor Code Quality) > 475 (Undefined Behavior for Input to API)
The behavior of this function is undefined unless its control parameter is set to a specific value.
*Weakness BaseWeakness BaseUse After Free - (416)
700 (Seven Pernicious Kingdoms) > 398 (Indicator of Poor Code Quality) > 416 (Use After Free)
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Dangling pointerUse-After-Free
*Weakness BaseWeakness BaseUse of Function with Inconsistent Implementations - (474)
700 (Seven Pernicious Kingdoms) > 398 (Indicator of Poor Code Quality) > 474 (Use of Function with Inconsistent Implementations)
The code uses a function that has inconsistent implementations across operating systems and versions.
*Weakness BaseWeakness BaseUse of Obsolete Functions - (477)
700 (Seven Pernicious Kingdoms) > 398 (Indicator of Poor Code Quality) > 477 (Use of Obsolete Functions)
The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
*Weakness VariantWeakness VariantUse of Uninitialized Variable - (457)
700 (Seven Pernicious Kingdoms) > 398 (Indicator of Poor Code Quality) > 457 (Use of Uninitialized Variable)
The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
+CategoryCategoryInput Validation and Representation - (1005)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation)
This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input.
*Weakness BaseWeakness BaseImproper Control of Resource Identifiers ('Resource Injection') - (99)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 99 (Improper Control of Resource Identifiers ('Resource Injection'))
The software receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.Insecure Direct Object Reference
+Weakness ClassWeakness ClassImproper Input Validation - (20)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation)
The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.
*Weakness BaseWeakness BaseBuffer Copy without Checking Size of Input ('Classic Buffer Overflow') - (120)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.buffer overrunUnbounded Transfer
*Weakness BaseWeakness BaseDirect Use of Unsafe JNI - (111)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 111 (Direct Use of Unsafe JNI)
When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses cannot occur in Java.
*Weakness ClassWeakness ClassExternal Control of File Name or Path - (73)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 73 (External Control of File Name or Path)
The software allows user input to control or influence paths or file names that are used in filesystem operations.
*Weakness BaseWeakness BaseExternal Control of System or Configuration Setting - (15)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 15 (External Control of System or Configuration Setting)
One or more system settings or configuration elements can be externally controlled by a user.
*Weakness BaseWeakness BaseImproper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') - (113)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 113 (Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting'))
The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
*Weakness BaseWeakness BaseImproper Null Termination - (170)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 170 (Improper Null Termination)
The software does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
*Weakness BaseWeakness BaseImproper Output Neutralization for Logs - (117)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 117 (Improper Output Neutralization for Logs)
The software does not neutralize or incorrectly neutralizes output that is written to logs.
*Weakness ClassWeakness ClassImproper Restriction of Operations within the Bounds of a Memory Buffer - (119)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Memory Corruption
*Weakness BaseWeakness BaseInteger Overflow or Wraparound - (190)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 190 (Integer Overflow or Wraparound)
The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.
*Weakness BaseWeakness BaseMissing XML Validation - (112)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 112 (Missing XML Validation)
The software accepts XML from an untrusted source but does not validate the XML against the proper schema.
*Weakness BaseWeakness BaseProcess Control - (114)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 114 (Process Control)
Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.
*Weakness BaseWeakness BaseReturn of Pointer Value Outside of Expected Range - (466)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 466 (Return of Pointer Value Outside of Expected Range)
A function can return a pointer to memory that is outside of the buffer that the pointer is expected to reference.
*Weakness VariantWeakness VariantStruts: Duplicate Validation Forms - (102)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 102 (Struts: Duplicate Validation Forms)
The application uses multiple validation forms with the same name, which might cause the Struts Validator to validate a form that the programmer does not expect.
*Weakness VariantWeakness VariantStruts: Form Bean Does Not Extend Validation Class - (104)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 104 (Struts: Form Bean Does Not Extend Validation Class)
If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.
*Weakness VariantWeakness VariantStruts: Form Field Without Validator - (105)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 105 (Struts: Form Field Without Validator)
The application has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation.
*Weakness VariantWeakness VariantStruts: Incomplete validate() Method Definition - (103)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 103 (Struts: Incomplete validate() Method Definition)
The application has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().
*Weakness VariantWeakness VariantStruts: Plug-in Framework not in Use - (106)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 106 (Struts: Plug-in Framework not in Use)
When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.
*Weakness VariantWeakness VariantStruts: Unused Validation Form - (107)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 107 (Struts: Unused Validation Form)
An unused validation form indicates that validation logic is not up-to-date.
*Weakness VariantWeakness VariantStruts: Unvalidated Action Form - (108)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 108 (Struts: Unvalidated Action Form)
Every Action Form must have a corresponding validation form.
*Weakness VariantWeakness VariantStruts: Validator Turned Off - (109)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 109 (Struts: Validator Turned Off)
Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation.
*Weakness VariantWeakness VariantStruts: Validator Without Form Field - (110)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 110 (Struts: Validator Without Form Field)
Validation fields that do not appear in forms they are associated with indicate that the validation logic is out of date.
*Weakness BaseWeakness BaseUse of Externally-Controlled Format String - (134)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 134 (Use of Externally-Controlled Format String)
The software uses a function that accepts a format string as an argument, but the format string originates from an external source.
*Weakness BaseWeakness BaseUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') - (470)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 470 (Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection'))
The application uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.Reflection Injection
*Weakness VariantWeakness VariantUse of Path Manipulation Function without Maximum-sized Buffer - (785)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 20 (Improper Input Validation) > 785 (Use of Path Manipulation Function without Maximum-sized Buffer)
The software invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX.
*Weakness BaseWeakness BaseImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - (79)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.XSSCSS
*Weakness ClassWeakness ClassImproper Neutralization of Special Elements used in a Command ('Command Injection') - (77)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
*Weakness BaseWeakness BaseImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - (89)
700 (Seven Pernicious Kingdoms) > 1005 (Input Validation and Representation) > 89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
+Weakness ClassWeakness ClassInsufficient Encapsulation - (485)
700 (Seven Pernicious Kingdoms) > 485 (Insufficient Encapsulation)
The product does not sufficiently encapsulate critical data or functionality.
*Weakness VariantWeakness VariantComparison of Classes by Name - (486)
700 (Seven Pernicious Kingdoms) > 485 (Insufficient Encapsulation) > 486 (Comparison of Classes by Name)
The program compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.
*Weakness VariantWeakness VariantCritical Public Variable Without Final Modifier - (493)
700 (Seven Pernicious Kingdoms) > 485 (Insufficient Encapsulation) > 493 (Critical Public Variable Without Final Modifier)
The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
*Weakness VariantWeakness VariantExposure of Data Element to Wrong Session - (488)
700 (Seven Pernicious Kingdoms) > 485 (Insufficient Encapsulation) > 488 (Exposure of Data Element to Wrong Session)
The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.
*Weakness VariantWeakness VariantExposure of System Data to an Unauthorized Control Sphere - (497)
700 (Seven Pernicious Kingdoms) > 485 (Insufficient Encapsulation) > 497 (Exposure of System Data to an Unauthorized Control Sphere)
Exposing system data or debugging information helps an adversary learn about the system and form an attack plan.
*Weakness BaseWeakness BaseLeftover Debug Code - (489)
700 (Seven Pernicious Kingdoms) > 485 (Insufficient Encapsulation) > 489 (Leftover Debug Code)
The application can be deployed with active debugging code that can create unintended entry points.
*CategoryCategoryMobile Code Issues - (490)
700 (Seven Pernicious Kingdoms) > 485 (Insufficient Encapsulation) > 490 (Mobile Code Issues)
Weaknesses in this category are frequently found in mobile code.
*Weakness VariantWeakness VariantPrivate Array-Typed Field Returned From A Public Method - (495)
700 (Seven Pernicious Kingdoms) > 485 (Insufficient Encapsulation) > 495 (Private Array-Typed Field Returned From A Public Method)
The product has a method that is declared public, but returns a reference to a private array, which could then be modified in unexpected ways.
*Weakness VariantWeakness VariantPublic Data Assigned to Private Array-Typed Field - (496)
700 (Seven Pernicious Kingdoms) > 485 (Insufficient Encapsulation) > 496 (Public Data Assigned to Private Array-Typed Field)
Assigning public data to a private array is equivalent to giving public access to the array.
*Weakness VariantWeakness VariantPublic cloneable() Method Without Final ('Object Hijack') - (491)
700 (Seven Pernicious Kingdoms) > 485 (Insufficient Encapsulation) > 491 (Public cloneable() Method Without Final ('Object Hijack'))
A class has a cloneable() method that is not declared final, which allows an object to be created without calling the constructor. This can cause the object to be in an unexpected state.
*Weakness BaseWeakness BaseTrust Boundary Violation - (501)
700 (Seven Pernicious Kingdoms) > 485 (Insufficient Encapsulation) > 501 (Trust Boundary Violation)
The product mixes trusted and untrusted data in the same data structure or structured message.
*Weakness VariantWeakness VariantUse of Inner Class Containing Sensitive Data - (492)
700 (Seven Pernicious Kingdoms) > 485 (Insufficient Encapsulation) > 492 (Use of Inner Class Containing Sensitive Data)
Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers.
+CategoryCategorySecurity Features - (254)
700 (Seven Pernicious Kingdoms) > 254 (Security Features)
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
*Weakness VariantWeakness VariantEmpty Password in Configuration File - (258)
700 (Seven Pernicious Kingdoms) > 254 (Security Features) > 258 (Empty Password in Configuration File)
Using an empty string as a password is insecure.
*Weakness ClassWeakness ClassExposure of Private Information ('Privacy Violation') - (359)
700 (Seven Pernicious Kingdoms) > 254 (Security Features) > 359 (Exposure of Private Information ('Privacy Violation'))
The software does not properly prevent private data (such as credit card numbers) from being accessed by actors who either (1) are not explicitly authorized to access the data or (2) do not have the implicit consent of the people to which the data is related. Privacy leakPrivacy leakage
*Weakness ClassWeakness ClassImproper Authorization - (285)
700 (Seven Pernicious Kingdoms) > 254 (Security Features) > 285 (Improper Authorization)
The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.AuthZ
*Weakness BaseWeakness BaseLeast Privilege Violation - (272)
700 (Seven Pernicious Kingdoms) > 254 (Security Features) > 272 (Least Privilege Violation)
The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
*Weakness VariantWeakness VariantPassword in Configuration File - (260)
700 (Seven Pernicious Kingdoms) > 254 (Security Features) > 260 (Password in Configuration File)
The software stores a password in a configuration file that might be accessible to actors who do not know the password.
*Weakness VariantWeakness VariantPlaintext Storage of a Password - (256)
700 (Seven Pernicious Kingdoms) > 254 (Security Features) > 256 (Plaintext Storage of a Password)
Storing a password in plaintext may result in a system compromise.
*Weakness BaseWeakness BaseUse of Hard-coded Credentials - (798)
700 (Seven Pernicious Kingdoms) > 254 (Security Features) > 798 (Use of Hard-coded Credentials)
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
*Weakness BaseWeakness BaseUse of Hard-coded Password - (259)
700 (Seven Pernicious Kingdoms) > 254 (Security Features) > 259 (Use of Hard-coded Password)
The software contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
*Weakness ClassWeakness ClassUse of Insufficiently Random Values - (330)
700 (Seven Pernicious Kingdoms) > 254 (Security Features) > 330 (Use of Insufficiently Random Values)
The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.
*Weakness VariantWeakness VariantWeak Cryptography for Passwords - (261)
700 (Seven Pernicious Kingdoms) > 254 (Security Features) > 261 (Weak Cryptography for Passwords)
Obscuring a password with a trivial encoding does not protect the password.
+CategoryCategoryTime and State - (361)
700 (Seven Pernicious Kingdoms) > 361 (Time and State)
Weaknesses in this category are related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads.
*Weakness BaseWeakness BaseInsecure Temporary File - (377)
700 (Seven Pernicious Kingdoms) > 361 (Time and State) > 377 (Insecure Temporary File)
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
*Weakness VariantWeakness VariantJ2EE Bad Practices: Direct Use of Threads - (383)
700 (Seven Pernicious Kingdoms) > 361 (Time and State) > 383 (J2EE Bad Practices: Direct Use of Threads)
Thread management in a Web application is forbidden in some circumstances and is always highly error prone.
*Weakness VariantWeakness VariantJ2EE Bad Practices: Use of System.exit() - (382)
700 (Seven Pernicious Kingdoms) > 361 (Time and State) > 382 (J2EE Bad Practices: Use of System.exit())
A J2EE application uses System.exit(), which also shuts down its container.
+Compound Element: CompositeCompound Element: CompositeSession Fixation - (384)
700 (Seven Pernicious Kingdoms) > 361 (Time and State) > 384 (Session Fixation)
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
*Weakness BaseWeakness BaseExternal Control of Assumed-Immutable Web Parameter - (472)
700 (Seven Pernicious Kingdoms) > 361 (Time and State) > 384 (Session Fixation) > 472 (External Control of Assumed-Immutable Web Parameter)
The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.Assumed-Immutable Parameter Tampering
*Weakness BaseWeakness BaseOrigin Validation Error - (346)
700 (Seven Pernicious Kingdoms) > 361 (Time and State) > 384 (Session Fixation) > 346 (Origin Validation Error)
The software does not properly verify that the source of data or communication is valid.
*Weakness ClassWeakness ClassUnintended Proxy or Intermediary ('Confused Deputy') - (441)
700 (Seven Pernicious Kingdoms) > 361 (Time and State) > 384 (Session Fixation) > 441 (Unintended Proxy or Intermediary ('Confused Deputy'))
The software receives a request, message, or directive from an upstream component, but the software does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the software's control sphere. This causes the software to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.Confused Deputy
*Weakness BaseWeakness BaseSignal Handler Race Condition - (364)
700 (Seven Pernicious Kingdoms) > 361 (Time and State) > 364 (Signal Handler Race Condition)
The software uses a signal handler that introduces a race condition.
*CategoryCategoryTemporary File Issues - (376)
700 (Seven Pernicious Kingdoms) > 361 (Time and State) > 376 (Temporary File Issues)
Weaknesses in this category are related to improper handling of temporary files.
*Weakness BaseWeakness BaseTime-of-check Time-of-use (TOCTOU) Race Condition - (367)
700 (Seven Pernicious Kingdoms) > 361 (Time and State) > 367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.TOCTTOUTOCCTOU
*Weakness BaseWeakness BaseUnrestricted Externally Accessible Lock - (412)
700 (Seven Pernicious Kingdoms) > 361 (Time and State) > 412 (Unrestricted Externally Accessible Lock)
The software properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
2008-09-09MITREInternal CWE Team
Modifications
Modification DateModifierOrganizationSource
2017-05-03CWE Content TeamMITREInternal
updated Relationships
+ View Metrics
CWEs in this viewTotal CWEs
Total98out of1006
Views0out of33
Categories8out of245
Weaknesses89out of720
Compound_Elements1out of8

More information is available — Please select a different filter.
Page Last Updated: May 05, 2017