Categories

The product released to market is released in pre-production or manufacturing configuration.

The software does not properly verify that a critical resource is owned by the proper entity.

The software has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.

The software does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

The application stores sensitive data under the web document root with insufficient access control, which might make it accessible to untrusted parties.