Categories

The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

The software performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

The software performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

The software does not initialize a critical resource.

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

The software generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Weaknesses in this category are related to improper calculation or conversion of numbers.