Categories

Environmental variables may contain sensitive information about a remote server.

The software does not handle or incorrectly handles when a value is not defined or supported for the associated parameter, field, or argument name.

The software does not properly determine which state it is in, causing it to assume it is in state X when in fact it is in state Y, causing it to perform incorrect operations in a security-relevant manner.

A function or operation returns an incorrect return value or status code that does not indicate an error, but causes the product to modify its behavior based on the incorrect result.

A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user awareness or involvement.

The program checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.

A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.

The product creates a search index of private or sensitive documents, but it does not properly limit index access to actors who are authorized to see the original information.

The software contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out.

The software records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.