Categories

The software receives input from an upstream component, but it does not handle or incorrectly handles when an additional unexpected special element is provided.

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

The software properly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.

The product relies on third-party software components that do not provide equivalent functionality across all desirable platforms.

Allowing password aging to occur unchecked can result in the possibility of diminished password integrity.

The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize .. sequences that can resolve to a location that is outside of that directory.

The software uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

The software does not use a standardized method for handling errors throughout the code, which might introduce inconsistent error handling and resultant weaknesses.

The software includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the software, potentially granting total access and control of the software to the untrusted source.