Categories

The program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

The software does not verify, or incorrectly verifies, the cryptographic signature for data.

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

The product divides a value by zero.

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Weaknesses in this category are typically introduced during the configuration of the software.

According to WASC, Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.

The software uses or accesses a resource that has not been initialized.

Weaknesses in this category are typically found in functionality that processes data.