Category: CISQ Quality Measures (2016) - Reliability
Draft
Summary
Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software.
Membership
| ID | Name | Description |
|---|---|---|
| CWE-1045 | Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor | A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor. |
| CWE-1047 | Modules with Circular Dependencies | The product contains modules in which one module has references that cycle back to itself, i.e., there are circular dependencies. |
| CWE-1051 | Initialization with Hard-Coded Network Resource Configuration Data | The product initializes data using hard-coded values that act as network resource identifiers. |
| CWE-1056 | Invokable Control Element with Variadic Parameters | A named-callable or method control element has a signature that supports a variable (variadic) number of parameters or arguments. |
| CWE-1058 | Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element | The code contains a function or method that operates in a multi-threaded environment but owns an unsafe non-final static storable or member data element. |
| CWE-1062 | Parent Class with References to Child Class | The code has a parent class that contains references to a child class, its methods, or its members. |
| CWE-1065 | Runtime Resource Management Control Element in a Component Built to Run on Application Servers | The product uses deployed components from application servers, but it also uses low-level functions/methods for management of resources, instead of the API provided by the application server. |
| CWE-1066 | Missing Serialization Control Element | The product contains a serializable data element that does not have an associated serialization method. |
| CWE-1069 | Empty Exception Block | An invokable code block contains an exception handling block that does not contain any code, i.e. is empty. |
| CWE-1070 | Serializable Data Element Containing non-Serializable Item Elements | The product contains a serializable, storable data element such as a field or member, but the data element contains member elements that are not serializable. |
| CWE-1077 | Floating Point Comparison with Incorrect Operator | The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision. |
| CWE-1079 | Parent Class without Virtual Destructor Method | A parent class contains one or more child classes, but the parent class does not have a virtual destructor method. |
| CWE-1082 | Class Instance Self Destruction Control Element | The code contains a class instance that calls the method or function to delete or destroy itself. |
| CWE-1083 | Data Access from Outside Expected Data Manager Component | The product is intended to manage data access through a particular data manager component such as a relational or non-SQL database, but it contains code that performs data access operations without using that component. |
| CWE-1087 | Class with Virtual Method without a Virtual Destructor | A class contains a virtual method, but the method does not have an associated virtual destructor. |
| CWE-1088 | Synchronous Access of Remote Resource without Timeout | The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite. |
| CWE-1096 | Singleton Class Instance Creation without Proper Locking or Synchronization | The product implements a Singleton design pattern but does not use appropriate locking or other synchronization mechanism to ensure that the singleton class is only instantiated once. |
| CWE-1097 | Persistent Storable Data Element without Associated Comparison Control Element | The product uses a storable data element that does not have all of the associated functions or methods that are necessary to support comparison. |
| CWE-1098 | Data Element containing Pointer Item without Proper Copy Control Element | The code contains a data element with a pointer that does not have an associated copy or constructor method. |
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
| CWE-252 | Unchecked Return Value | The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. |
| CWE-396 | Declaration of Catch for Generic Exception | Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities. |
| CWE-397 | Declaration of Throws for Generic Exception | The product throws or raises an overly broad exceptions that can hide important details and produce inappropriate responses to certain conditions. |
| CWE-456 | Missing Initialization of a Variable | The product does not initialize critical variables, which causes the execution environment to use unexpected values. |
| CWE-674 | Uncontrolled Recursion | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
| CWE-704 | Incorrect Type Conversion or Cast | The product does not correctly convert an object, resource, or structure from one type to a different type. |
| CWE-772 | Missing Release of Resource after Effective Lifetime | The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed. |
| CWE-788 | Access of Memory Location After End of Buffer | The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer. |
| CWE-1128 | CISQ Quality Measures (2016) | This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards. |
Vulnerability Mapping Notes
Usage: Prohibited
Reasons: Category
Rationale:
This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
Comment:
See member weaknesses of this category.