| CWE-779 |
The software logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack. |
| CWE-78 |
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
| CWE-780 |
The software uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption. |
| CWE-781 |
The software defines an IOCTL that uses METHOD_NEITHER for I/O, but it does not validate or incorrectly validates the addresses that are provided. |
| CWE-782 |
The software implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL. |
| CWE-783 |
The program uses an expression in which operator precedence causes incorrect logic to be used. |
| CWE-784 |
The application uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user. |
| CWE-785 |
The software invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller than the maximum possible size, such as PATH_MAX. |
| CWE-786 |
The software reads or writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer. |
| CWE-787 |
The software writes data past the end, or before the beginning, of the intended buffer. |
