Categories

The program releases a resource that is still intended to be used by the program itself or another actor.

The software makes resources available to untrusted parties when those resources are only intended to be accessed by the software.

The product allocates memory based on an untrusted size value, but it does not validate or incorrectly validates the size, allowing arbitrary amounts of memory to be allocated.

The product uses a scheme that generates numbers or identifiers that are more predictable than required.

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

The software does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.

A backup file is stored in a directory or archive that is made accessible to unauthorized actors.

The software uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.

A product defines a set of insecure permissions that are inherited by objects that are created by the program.

The software is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.