Categories

The software uses a Pseudo-Random Number Generator (PRNG) that does not correctly manage seeds.

The software does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

The software does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

The software allows user input to control or influence paths or file names that are used in filesystem operations.

The software attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

The application uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.