2022
Nature Type ID Name Page
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
References
[REF-21]OWASP. "CSV Injection". 2020 February 2. < https://owasp.org/www-community/attacks/
CSV_Injection >.
[REF-22]Jamie Rougvie. "Data Extraction to Command Execution CSV Injection". 2019 September
6. < https://www.veracode.com/blog/secure-development/data-extraction-command-execution-csvinjection
>.
[REF-23]George Mauer. "The Absurdly Underestimated Dangers of CSV Injection". 2017 October
7. < http://georgemauer.net/2017/10/07/csv-injection.html >.
[REF-24]James Kettle. "Comma Separated Vulnerabilities". 2014 August 9. < https://rstforums.com/
forum/topic/82690-comma-separated-vulnerabilities/ >.2023-04-07.
CWE-1239: Improper Zeroization of Hardware Register
Weakness ID : 1239
Structure : Simple
Abstraction : Variant
Description
The hardware product does not properly clear sensitive information from built-in registers when the
user of the hardware block changes.
Extended Description
Hardware logic operates on data stored in registers local to the hardware block. Most hardware
IPs, including cryptographic accelerators, rely on registers to buffer I/O, store intermediate values,
and interface with software. The result of this is that sensitive information, such as passwords or
encryption keys, can exist in locations not transparent to the user of the hardware logic. When a
different entity obtains access to the IP due to a change in operating mode or conditions, the new
entity can extract information belonging to the previous user if no mechanisms are in place to clear
register contents. It is important to clear information stored in the hardware if a physical attack
on the product is detected, or if the user of the hardware block changes. The process of clearing
register contents in a hardware IP is referred to as zeroization in standards for cryptographic
hardware modules such as FIPS-140-2 [REF-267].
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 226 Sensitive Information in Resource Not Removed Before
Reuse