Categories

The software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

Weaknesses in this category are typically found in functionality that processes data.

The software stores sensitive information without properly limiting read or write access by unauthorized actors.

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Weaknesses in this category are related to the management of credentials.

The software uses a function that accepts a format string as an argument, but the format string originates from an external source.

A capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

The software does not properly clean up and remove temporary or supporting resources after they have been used.

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.