Common Weakness Enumeration

587

Assignment of a Fixed Address to a Pointer

588

Attempt to Access Child of a Non-structure Pointer

589

Call to Non-ubiquitous API

590

Free of Memory not on the Heap

591

Sensitive Data Storage in Improperly Locked Memory

593

Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created

594

J2EE Framework: Saving Unserializable Objects to Disk

595

Comparison of Object References Instead of Object Contents

597

Use of Wrong Operator in String Comparison

598

Use of HTTP Request With Sensitive Query String

599

Missing Validation of OpenSSL Certificate

600

Uncaught Exception in Servlet

601

URL Redirection to Untrusted Site ('Open Redirect')

602

Client-Side Enforcement of Server-Side Security

603

Use of Client-Side Authentication

605

Multiple Binds to the Same Port

606

Unchecked Input for Loop Condition

607

Public Static Final Field References Mutable Object

608

Struts: Non-private Field in ActionForm Class

609

Double-Checked Locking

610

Externally Controlled Reference to a Resource in Another Sphere

611

Improper Restriction of XML External Entity Reference

612

Improper Authorization of Index Containing Sensitive Information

613

Insufficient Session Expiration

614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

615

Inclusion of Sensitive Information in Source Code Comments

616

Incomplete Identification of Uploaded File Variables (PHP)

617

Reachable Assertion

618

Exposed Unsafe ActiveX Method

619

Dangling Database Cursor ('Cursor Injection')

620

Unverified Password Change

621

Variable Extraction Error

622

Improper Validation of Function Hook Arguments

623

Unsafe ActiveX Control Marked Safe For Scripting

624

Executable Regular Expression Error

625

Permissive Regular Expression

626

Null Byte Interaction Error (Poison Null Byte)

627

Dynamic Variable Evaluation

628

Function Call with Incorrectly Specified Arguments

636

Not Failing Securely ('Failing Open')

637

Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')

638

Not Using Complete Mediation

639

Authorization Bypass Through User-Controlled Key

640

Weak Password Recovery Mechanism for Forgotten Password

641

Improper Restriction of Names for Files and Other Resources

642

External Control of Critical State Data

643

Improper Neutralization of Data within XPath Expressions ('XPath Injection')

644

Improper Neutralization of HTTP Headers for Scripting Syntax

645

Overly Restrictive Account Lockout Mechanism

646

Reliance on File Name or Extension of Externally-Supplied File