Common Weakness Enumeration

531

Inclusion of Sensitive Information in Test Code

532

Insertion of Sensitive Information into Log File

535

Exposure of Information Through Shell Error Message

536

Servlet Runtime Error Message Containing Sensitive Information

537

Java Runtime Error Message Containing Sensitive Information

538

Insertion of Sensitive Information into Externally-Accessible File or Directory

539

Use of Persistent Cookies Containing Sensitive Information

540

Inclusion of Sensitive Information in Source Code

541

Inclusion of Sensitive Information in an Include File

543

Use of Singleton Pattern Without Synchronization in a Multithreaded Context

544

Missing Standardized Error Handling Mechanism

546

Suspicious Comment

547

Use of Hard-coded, Security-relevant Constants

548

Exposure of Information Through Directory Listing

549

Missing Password Field Masking

550

Server-generated Error Message Containing Sensitive Information

551

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

552

Files or Directories Accessible to External Parties

553

Command Shell in Externally Accessible Directory

554

ASP.NET Misconfiguration: Not Using Input Validation Framework

555

J2EE Misconfiguration: Plaintext Password in Configuration File

556

ASP.NET Misconfiguration: Use of Identity Impersonation

558

Use of getlogin() in Multithreaded Application

560

Use of umask() with chmod-style Argument

561

Dead Code

562

Return of Stack Variable Address

563

Assignment to Variable without Use

564

Use of Hibernate with HQL/SQL Query String Containing External Input

565

Reliance on Cookies without Validation and Integrity Checking

566

Authorization Bypass Through User-Controlled SQL Primary Key

567

Unsynchronized Access to Shared Data in a Multithreaded Context

568

finalize() Method Without super.finalize()

570

Expression is Always False

571

Expression is Always True

572

Call to Thread run() instead of start()

573

Improper Following of Specification by Caller

574

EJB Bad Practices: Use of Synchronization Primitives

575

EJB Bad Practices: Use of AWT Swing

576

EJB Bad Practices: Use of Java I/O

577

EJB Bad Practices: Use of Sockets

578

EJB Bad Practices: Use of Class Loader

579

J2EE Bad Practices: Non-serializable Object Stored in Session

580

clone() Method Without super.clone()

581

Object Model Violation: Just One of Equals and Hashcode Defined

582

Array Declared Public, Final, and Static

583

finalize() Method Declared Public

584

Return Inside Finally Block

585

Empty Synchronized Block

586

Explicit Call to Finalize()

587

Assignment of a Fixed Address to a Pointer