11 |
ASP.NET Misconfiguration: Creating Debug Binary |
|
Major |
Description, Other_Notes |
|
Minor |
None |
12 |
ASP.NET Misconfiguration: Missing Custom Error Handling |
|
Major |
Common_Consequences, Other_Notes, Potential_Mitigations |
|
Minor |
None |
14 |
Compiler Removal of Code to Clear Buffers |
|
Major |
Applicable_Platforms, Description, Detection_Factors, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings, Time_of_Introduction |
|
Minor |
None |
20 |
Insufficient Input Validation |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
22 |
Path Traversal |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
28 |
Path Traversal: '..\filedir' |
|
Major |
Observed_Examples |
|
Minor |
None |
29 |
Path Traversal: '\..\filename' |
|
Major |
Observed_Examples |
|
Minor |
None |
30 |
Path Traversal: '\dir\..\filename' |
|
Major |
Observed_Examples |
|
Minor |
None |
32 |
Path Traversal: '...' (Triple Dot) |
|
Major |
Observed_Examples |
|
Minor |
None |
35 |
Path Traversal: '.../...//' |
|
Major |
Observed_Examples |
|
Minor |
None |
37 |
Path Traversal: '/absolute/pathname/here' |
|
Major |
Observed_Examples, Relationships, Taxonomy_Mappings |
|
Minor |
None |
38 |
Path Traversal: '\absolute\pathname\here' |
|
Major |
Observed_Examples, Relationships, Taxonomy_Mappings |
|
Minor |
None |
39 |
Path Traversal: 'C:dirname' |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
41 |
Failure to Resolve Path Equivalence |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
49 |
Path Equivalence: 'filename/' (Trailing Slash) |
|
Major |
Observed_Examples |
|
Minor |
None |
59 |
Failure to Resolve Links Before File Access (aka 'Link Following') |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
62 |
UNIX Hard Link |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
64 |
Windows Shortcut Following (.LNK) |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
65 |
Windows Hard Link |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
67 |
Failure to Handle Windows Device Names |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
72 |
Failure to Handle Apple HFS+ Alternate Data Stream Path |
|
Major |
Applicable_Platforms, Background_Details, Demonstrative_Examples, Description, Name, References |
|
Minor |
None |
78 |
Failure to Sanitize Data into an OS Command (aka 'OS Command Injection') |
|
Major |
Observed_Examples, Relationships, Taxonomy_Mappings |
|
Minor |
None |
88 |
Argument Injection or Modification |
|
Major |
Observed_Examples, Relationships, Taxonomy_Mappings |
|
Minor |
None |
89 |
Failure to Sanitize Data within SQL Queries (aka 'SQL Injection') |
|
Major |
Observed_Examples |
|
Minor |
None |
103 |
Struts: Incomplete validate() Method Definition |
|
Major |
Background_Details, Common_Consequences, Description, Other_Notes, Relationship_Notes |
|
Minor |
None |
104 |
Struts: Form Bean Does Not Extend Validation Class |
|
Major |
Background_Details, Common_Consequences, Other_Notes |
|
Minor |
None |
108 |
Struts: Unvalidated Action Form |
|
Major |
Common_Consequences, Description, Other_Notes |
|
Minor |
None |
110 |
Struts: Validator Without Form Field |
|
Major |
Common_Consequences, Description, Other_Notes |
|
Minor |
None |
111 |
Direct Use of Unsafe JNI |
|
Major |
Description, Other_Notes |
|
Minor |
None |
112 |
Missing XML Validation |
|
Major |
Description, Other_Notes |
|
Minor |
None |
113 |
Failure to Sanitize CRLF Sequences in HTTP Headers (aka 'HTTP Response Splitting') |
|
Major |
Description, Other_Notes |
|
Minor |
None |
114 |
Process Control |
|
Major |
Description, Other_Notes |
|
Minor |
None |
117 |
Incorrect Output Sanitization for Logs |
|
Major |
Background_Details, Common_Consequences, Description, Other_Notes, References |
|
Minor |
None |
119 |
Failure to Constrain Operations within the Bounds of an Allocated Memory Buffer |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
120 |
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
|
Major |
Other_Notes, Relationships, Taxonomy_Mappings |
|
Minor |
None |
122 |
Heap-based Buffer Overflow |
|
Major |
Common_Consequences, Other_Notes, Relationship_Notes |
|
Minor |
None |
123 |
Write-what-where Condition |
|
Major |
Common_Consequences, Other_Notes |
|
Minor |
None |
128 |
Wrap-around Error |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
129 |
Unchecked Array Indexing |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
131 |
Incorrect Calculation of Buffer Size |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
134 |
Uncontrolled Format String |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
135 |
Incorrect Calculation of Multi-Byte String Length |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
158 |
Failure to Sanitize Null Byte or NUL Character |
|
Major |
Observed_Examples |
|
Minor |
None |
170 |
Improper Null Termination |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
174 |
Double Decoding of the Same Data |
|
Major |
Observed_Examples |
|
Minor |
None |
176 |
Failure to Handle Unicode Encoding |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
178 |
Failure to Resolve Case Sensitivity |
|
Major |
Observed_Examples |
|
Minor |
None |
182 |
Collapse of Data Into Unsafe Value |
|
Major |
Observed_Examples |
|
Minor |
None |
184 |
Incomplete Blacklist |
|
Major |
Observed_Examples |
|
Minor |
None |
190 |
Integer Overflow (Wrap or Wraparound) |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
192 |
Integer Coercion Error |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
193 |
Off-by-one Error |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
194 |
Unexpected Sign Extension |
|
Major |
Common_Consequences, Demonstrative_Examples, Description, Maintenance_Notes, Name, Observed_Examples, Potential_Mitigations, References, Relationship_Notes, Relationships |
|
Minor |
None |
197 |
Numeric Truncation Error |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
211 |
Product-External Error Message Information Leak |
|
Major |
Description, Enabling_Factors_for_Exploitation, Functional_Areas, Observed_Examples, Other_Notes, Potential_Mitigations, Relationship_Notes, Weakness_Ordinalities |
|
Minor |
None |
226 |
Sensitive Information Uncleared Before Release |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
234 |
Failure to Handle Missing Parameter |
|
Major |
Observed_Examples |
|
Minor |
None |
241 |
Failure to Handle Wrong Data Type |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
242 |
Use of Inherently Dangerous Function |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
244 |
Failure to Clear Heap Memory Before Release (aka 'Heap Inspection') |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
252 |
Unchecked Return Value |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
253 |
Misinterpreted Function Return Value |
|
Major |
Demonstrative_Examples |
|
Minor |
None |
259 |
Hard-Coded Password |
|
Major |
Demonstrative_Examples, Description, Maintenance_Notes, Other_Notes, Potential_Mitigations |
|
Minor |
None |
267 |
Privilege Defined With Unsafe Actions |
|
Major |
Relationships |
|
Minor |
None |
272 |
Least Privilege Violation |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
273 |
Failure to Check Whether Privileges Were Dropped Successfully |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
276 |
Insecure Default Permissions |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
279 |
Insecure Execution-assigned Permissions |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
288 |
Authentication Bypass Using an Alternate Path or Channel |
|
Major |
Observed_Examples |
|
Minor |
None |
289 |
Authentication Bypass by Alternate Name |
|
Major |
Observed_Examples |
|
Minor |
None |
305 |
Authentication Bypass by Primary Weakness |
|
Major |
Observed_Examples |
|
Minor |
None |
330 |
Use of Insufficiently Random Values |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
362 |
Race Condition |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
363 |
Race Condition Enabling Link Following |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
365 |
Race Condition in Switch |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
366 |
Race Condition within a Thread |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
367 |
Time-of-check Time-of-use (TOCTOU) Race Condition |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
369 |
Divide By Zero |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
379 |
Creation of Temporary File in Directory with Insecure Permissions |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
390 |
Detection of Error Condition Without Action |
|
Major |
Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations |
|
Minor |
None |
391 |
Unchecked Error Condition |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
403 |
UNIX File Descriptor Leak |
|
Major |
Affected_Resources, Observed_Examples, Relationships, Taxonomy_Mappings |
|
Minor |
None |
404 |
Improper Resource Shutdown or Release |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
415 |
Double Free |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
416 |
Use After Free |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
418 |
Channel Errors |
|
Major |
Relationships |
|
Minor |
None |
423 |
DEPRECATED (Duplicate): Proxied Trusted Channel |
|
Major |
Applicable_Platforms, Description, Name, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type |
|
Minor |
None |
426 |
Untrusted Search Path |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
435 |
Interaction Error |
|
Major |
Relationships |
|
Minor |
None |
439 |
Behavioral Change in New Version or Environment |
|
Major |
Observed_Examples |
|
Minor |
None |
441 |
Unintended Proxy/Intermediary |
|
Major |
Maintenance_Notes, Relationships, Taxonomy_Mappings, Time_of_Introduction |
|
Minor |
None |
462 |
Duplicate Key in Associative List (Alist) |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
464 |
Addition of Data Structure Sentinel |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
466 |
Return of Pointer Value Outside of Expected Range |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
467 |
Use of sizeof() on a Pointer Type |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
468 |
Incorrect Pointer Scaling |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
469 |
Use of Pointer Subtraction to Determine Size |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
476 |
NULL Pointer Dereference |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
479 |
Unsafe Function Call from a Signal Handler |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
480 |
Use of Incorrect Operator |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
482 |
Comparing instead of Assigning |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
484 |
Omitted Break Statement in Switch |
|
Major |
Applicable_Platforms, Demonstrative_Examples, Description, Detection_Factors, Name, Other_Notes, Potential_Mitigations, Weakness_Ordinalities |
|
Minor |
None |
485 |
Insufficient Encapsulation |
|
Major |
Relationships |
|
Minor |
None |
493 |
Critical Public Variable Without Final Modifier |
|
Major |
Background_Details, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations |
|
Minor |
None |
500 |
Public Static Field Not Marked Final |
|
Major |
Background_Details, Demonstrative_Examples, Description, Name, Other_Notes, Potential_Mitigations |
|
Minor |
None |
528 |
Information Leak Through Core Dump Files |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
539 |
Information Leak Through Persistent Cookies |
|
Major |
None |
|
Minor |
Other_Notes |
544 |
Missing Error Handling Mechanism |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
547 |
Use of Hard-coded, Security-relevant Constants |
|
Major |
Description, Potential_Mitigations, Relationships, Taxonomy_Mappings |
|
Minor |
None |
552 |
Files or Directories Accessible to External Parties |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
561 |
Dead Code |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
562 |
Return of Stack Variable Address |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
563 |
Unused Variable |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
570 |
Expression is Always False |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
571 |
Expression is Always True |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
587 |
Assignment of a Fixed Address to a Pointer |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
590 |
Free of Invalid Pointer Not on the Heap |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
591 |
Sensitive Data Storage in Improperly Locked Memory |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
604 |
Deprecated Entries |
|
Major |
Name, Relationships |
|
Minor |
None |
606 |
Unchecked Input for Loop Condition |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
609 |
Double-Checked Locking |
|
Major |
Demonstrative_Examples |
|
Minor |
None |
618 |
Exposed Unsafe ActiveX Method |
|
Major |
Relationships, Type |
|
Minor |
None |
620 |
Unverified Password Change |
|
Major |
Observed_Examples |
|
Minor |
None |
628 |
Function Call with Incorrectly Specified Arguments |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
662 |
Insufficient Synchronization |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
665 |
Incorrect or Incomplete Initialization |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
667 |
Insufficient Locking |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
668 |
Exposure of Resource to Wrong Sphere |
|
Major |
Relationships |
|
Minor |
None |
675 |
Duplicate Operations on Resource |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
676 |
Use of Potentially Dangerous Function |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
681 |
Incorrect Conversion between Numeric Types |
|
Major |
Description, Relationships, Taxonomy_Mappings |
|
Minor |
None |
682 |
Incorrect Calculation |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
684 |
Failure to Provide Specified Functionality |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
686 |
Function Call With Incorrect Argument Type |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
687 |
Function Call With Incorrectly Specified Argument Value |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
691 |
Insufficient Control Flow Management |
|
Major |
Relationships |
|
Minor |
None |
696 |
Incorrect Behavior Order |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
697 |
Insufficient Comparison |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
704 |
Incorrect Type Conversion or Cast |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
705 |
Incorrect Control Flow Scoping |
|
Major |
Relationships, Taxonomy_Mappings |
|
Minor |
None |
733 |
Compiler Optimization Removal or Modification of Security-critical Code |
|
Major |
Detection_Factors |
|
Minor |
None |