Categories
CWE | NAME | LAST 12M | LOW | MEDIUM | HIGH | CRITICAL | TOTAL VULNS |
---|---|---|---|---|---|---|---|
CWE-829 | Inclusion of Functionality from Untrusted Control Sphere The software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. | 3 | 44 | 31 | 14 | 92 | |
CWE-252 | Unchecked Return Value The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. | 3 | 45 | 33 | 6 | 87 | |
CWE-459 | Incomplete Cleanup The software does not properly clean up and remove temporary or supporting resources after they have been used. | 9 | 54 | 21 | 2 | 86 | |
CWE-131 | Incorrect Calculation of Buffer Size The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow. | 4 | 33 | 31 | 15 | 83 | |
CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. | 4 | 42 | 29 | 7 | 82 | |
CWE-91 | XML Injection (aka Blind XPath Injection) The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. | 0 | 48 | 20 | 13 | 81 | |
CWE-682 | Incorrect Calculation The software performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management. | 4 | 40 | 27 | 8 | 79 | |
CWE-834 | Excessive Iteration The software performs an iteration or loop without sufficiently limiting the number of times that the loop is executed. | 2 | 30 | 41 | 0 | 73 | |
CWE-681 | Incorrect Conversion between Numeric Types When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur. | 6 | 27 | 32 | 6 | 71 | |
CWE-916 | Use of Password Hash With Insufficient Computational Effort The software generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. | 6 | 40 | 13 | 10 | 69 |