Weak Password Recovery Mechanism for Forgotten Password - The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak... cwe.mitre.org/data/definitio…

Direct Network Flood - Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target. [Direct Network Flood](T1498/001) are when one or more systems are used to send a high-.. https://attack.mitr

Inter-component Protocol Manipulation - Inter-component protocols are used to communicate between different software and hardware modules within a single computer. Common examples are: interrupt signals and data pipes. Subverting t.. capec.mitre.org

Direct Use of Unsafe JNI - When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses canno.. cwe.mitre.org/da

DDKONG - [DDKONG](S0255) is a malware sample that was part of a campaign by [Rancor](G0075). [DDKONG](S0255) was first seen used in February 2017. (Citation: Rancor Unit42 June 2018).. attack.mitre.org/software/S0…

ICMP Fragmentation - An attacker may execute a ICMP Fragmentation attack against a target with the intention of consuming resources or causing a crash. The attacker crafts a large number of identical fragmented IP packets containin.. capec.mitre.org

Semiconductor Defects in Hardware Logic with Security-Sensitive Implications - The security-sensitive hardware module contains semiconductor defects... cwe.mitre.org/data/definitio…

Drill: Attack signature-based data loss prevention (DLP) : Think ways to circumvent this control from Red Team perspective. cybersecurity.fitness/drill/…...

WireLurker - [WireLurker](S0312) is a family of macOS malware that targets iOS devices connected over USB. (Citation: PaloAlto-WireLurker).. attack.mitre.org/software/S0…

TCP (ISN) Sequence Predictability Probe - This type of operating system probe attempts to determine an estimate for how predictable the sequence number generation algorithm is for a remote host. Statistical techniques, such as stan.. capec.mitre.org

Always-Incorrect Control Flow Implementation - The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated... cwe.mitre.org/data/defi

Rogue Wi-Fi Access Points - An adversary could set up unauthorized Wi-Fi access points or compromise existing access points and, if the device connects to them, carry out network-based attacks such as eavesdropping on or modifying network .. https://attack.

Eavesdropping - An adversary intercepts a form of communication (e.g. text, audio, video) by way of software (e.g., microphone and audio recording application), hardware (e.g., recording equipment), or physical means (e.g., physica.. capec.mitre.org

Inclusion of Web Functionality from an Untrusted Source - The software includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the software, potentially granting total.. cwe.mitre.org/da

Drill: Privacy Exposed : Think how you can reduce the privacy impact. cybersecurity.fitness/drill/…...

Protocol Tunneling - Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explic.. https://attack.

Malicious Automated Software Update - An attacker exploits a weakness in a server or client's process of delivering and verifying the integrity of code supplied by an update-providing server or mechanism to cause code of the attack.. capec.mitre.org

Small Space of Random Values - The number of possible random values is smaller than needed by the product, making it more susceptible to brute force attacks... cwe.mitre.org/data/definitio…

Capture Audio - Adversaries may capture audio to collect information on a user of a mobile device using standard operating system APIs. Adversaries may target audio information such as user conversations, surroundings, phone calls, or othe.. https://attack.

Drill: Verified Purchase and Fraudulent merchants : Identify whether fraudulent merchants can still bypass your rule. cybersecurity.fitness/drill/…...