Categories

The software does not properly protect an assumed-immutable element from being modified by an attacker.

The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. eval).

Environmental variables may contain sensitive information about a remote server.

The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that requests.

The product does not sufficiently compartmentalize functionality or processes that require different privilege levels, rights, or permissions.

The software stores sensitive information in a file system or device that does not have built-in access control.

The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

This entry has been deprecated because it was a duplicate of CWE-774. All content has been transferred to CWE-774.

The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.