Categories

The program accesses or uses a pointer that has not been initialized.

The software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

The software compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

The software does not validate or incorrectly validates the integrity check values or checksums of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

The software performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.