Categories

The software does not verify, or incorrectly verifies, the cryptographic signature for data.

The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

The software uses a function that accepts a format string as an argument, but the format string originates from an external source.

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

The product divides a value by zero.

The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.

The software uses or accesses a resource that has not been initialized.

The software generates an error message that includes sensitive information about its environment, users, or associated data.

The program does not release or incorrectly releases a resource before it is made available for re-use.