Vulnerabilities by weakness (CWE)

All weaknesses 817

• CWE-79 Cross-site Scripting 32,577
• CWE-89 Improper Neutralization of Special Elements used in an SQL Command 13,887
• CWE-862 Missing Authorization 10,470
• CWE-284 Improper Access Control 8,188
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory 7,170
• CWE-352 Cross-Site Request Forgery 6,736
• CWE-20 Improper Input Validation 6,559
• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor 6,386
• CWE-416 Use After Free 6,223
• CWE-125 Out-of-bounds Read 6,104
• CWE-787 Out-of-bounds Write 6,075
• CWE-74 Injection 5,292
• CWE-78 OS Command Injection 5,284
• CWE-94 Improper Control of Generation of Code 5,251
• CWE-863 Incorrect Authorization 4,198
• CWE-121 Stack-based Buffer Overflow 4,135
• CWE-400 Uncontrolled Resource Consumption 4,017
• CWE-122 Heap-based Buffer Overflow 3,746
• CWE-918 Server-Side Request Forgery 3,684
• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer 3,665
• CWE-434 Unrestricted Upload of File with Dangerous Type 3,409
• CWE-502 Deserialization of Untrusted Data 3,317
• CWE-120 Buffer Copy without Checking Size of Input 3,276
• CWE-77 Command Injection 3,200
• CWE-639 Authorization Bypass Through User-Controlled Key 3,192
• CWE-306 Missing Authentication for Critical Functionality 3,121
• CWE-287 Improper Authentication 3,116
• CWE-269 Improper Privilege Management 2,979
• CWE-476 NULL Pointer Dereference 2,628
• CWE-770 Allocation of Resources Without Limits or Throttling 2,444
• CWE-190 Integer Overflow or Wraparound 2,011
• CWE-285 Improper Authorization 1,876
• CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization 1,541
• CWE-601 URL Redirection to Untrusted Site 1,444
• CWE-98 PHP Remote File Inclusion" 1,360
• CWE-266 Incorrect Privilege Assignment 1,309
• CWE-295 Improper Certificate Validation 1,168
• CWE-59 Improper Link Resolution Before File Access 1,107
• CWE-276 Incorrect Default Permissions 1,051
• CWE-693 Protection Mechanism Failure 1,042
• CWE-798 Use of Hard-coded Credentials 1,034
• CWE-532 Insertion of Sensitive Information into Log File 1,004
• CWE-522 Insufficiently Protected Credentials 1,002
• CWE-732 Incorrect Permission Assignment for Critical Resource 977
• CWE-427 Uncontrolled Search Path Element 939
• CWE-611 Improper Restriction of XML External Entity Reference 926
• CWE-347 Improper Verification of Cryptographic Signature 864
• CWE-843 Access of Resource Using Incompatible Type 850
• CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition 827
• CWE-73 External Control of File Name or Path 808
• CWE-401 Missing Release of Memory after Effective Lifetime 765
• CWE-345 Insufficient Verification of Data Authenticity 764
• CWE-288 Authentication Bypass Using an Alternate Path or Channel 761
• CWE-404 Improper Resource Shutdown or Release 760
• CWE-290 Authentication Bypass by Spoofing 746
• CWE-346 Origin Validation Error 737
• CWE-1321 Improperly Controlled Modification of Object Prototype Attributes 707
• CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page 678
• CWE-319 Cleartext Transmission of Sensitive Information 649
• CWE-835 Loop with Unreachable Exit Condition 610
• CWE-613 DEPRECATED: Insufficient Session Expiration 604
• CWE-126 Buffer Over-read 585
• CWE-1333 Inefficient Regular Expression Complexity 581
• CWE-23 Relative Path Traversal 571
• CWE-617 Reachable Assertion 569
• CWE-312 Cleartext Storage of Sensitive Information 564
• CWE-307 Improper Restriction of Excessive Authentication Attempts 558
• CWE-754 Improper Check for Unusual or Exceptional Conditions 534
• CWE-209 Generation of Error Message Containing Sensitive Information 517
• CWE-201 Insertion of Sensitive Information Into Sent Data 515
• CWE-451 User Interface (UI) Misrepresentation of Critical Information 506
• CWE-908 Use of Uninitialized Resource 504
• CWE-674 Uncontrolled Recursion 500
• CWE-191 Integer Underflow (Wrap or Wraparound) 496
• CWE-116 Improper Encoding or Escaping of Output 493
• CWE-415 Double Free 490
• CWE-327 Use of a Broken or Risky Cryptographic Algorithm 479
• CWE-203 Observable Discrepancy 459
• CWE-506 Embedded Malicious Code 459
• CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere 453
• CWE-321 Use of Hard-coded Cryptographic Key 428
• CWE-552 Files or Directories Accessible to External Parties 426
• CWE-88 Argument Injection 421
• CWE-1284 Improper Validation of Specified Quantity in Input 410
• CWE-248 Uncaught Exception 408
• CWE-444 Inconsistent Interpretation of HTTP Requests 405
• CWE-250 Execution with Unnecessary Privileges 404
• CWE-129 Improper Validation of Array Index 400
• CWE-311 Missing Encryption of Sensitive Data 383
• CWE-668 Exposure of Resource to Wrong Sphere 377
• CWE-426 Untrusted Search Path 366
• CWE-428 Unquoted Search Path or Element 359
• CWE-789 Memory Allocation with Excessive Size Value 349
• CWE-829 Inclusion of Functionality from Untrusted Control Sphere 337
• CWE-384 Session Fixation 326
• CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine 316
• CWE-755 Improper Handling of Exceptional Conditions 311
• CWE-264 Permissions, Privileges, and Access Controls (category) 309
• CWE-822 Untrusted Pointer Dereference 309
• CWE-922 Insecure Storage of Sensitive Information 303
• CWE-256 Plaintext Storage of a Password 299
• CWE-457 Use of Uninitialized Variable 295
• CWE-407 Inefficient Algorithmic Complexity 294
• CWE-1188 Initialization of a Resource with an Insecure Default 286
• CWE-93 Improper Neutralization of CRLF Sequences 279
• CWE-184 Incomplete List of Disallowed Inputs 274
• CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes 270
• CWE-640 Weak Password Recovery Mechanism for Forgotten Password 267
• CWE-707 Improper Neutralization 262
• CWE-294 Authentication Bypass by Capture-replay 259
• CWE-281 Improper Preservation of Permissions 255
• CWE-208 Observable Timing Discrepancy 250
• CWE-330 Use of Insufficiently Random Values 249
• CWE-326 Inadequate Encryption Strength 245
• CWE-1021 Improper Restriction of Rendered UI Layers or Frames 243
• CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code 241
• CWE-441 Unintended Proxy or Intermediary 238
• CWE-824 Access of Uninitialized Pointer 230
• CWE-369 Divide By Zero 229
• CWE-204 Observable Response Discrepancy 226
• CWE-259 Use of Hard-coded Password 224
• CWE-359 Exposure of Private Personal Information to an Unauthorized Actor 223
• CWE-749 Exposed Dangerous Method or Function 222
• CWE-1236 Improper Neutralization of Formula Elements in a CSV File 220
• CWE-494 Download of Code Without Integrity Check 219
• CWE-61 UNIX Symbolic Link (Symlink) Following 213
• CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) 203
• CWE-35 Path Traversal: '.../...//' 198
• CWE-131 Incorrect Calculation of Buffer Size 195
• CWE-703 Improper Check or Handling of Exceptional Conditions 194
• CWE-436 Interpretation Conflict 193
• CWE-280 Improper Handling of Insufficient Permissions or Privileges 189
• CWE-602 Client-Side Enforcement of Server-Side Security 189
• CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 188
• CWE-667 Improper Locking 188
• CWE-305 Authentication Bypass by Primary Weakness 187
• CWE-134 Use of Externally-Controlled Format String 183
• CWE-665 Improper Initialization 177
• CWE-1287 Improper Validation of Specified Type of Input 176
• CWE-521 Weak Password Requirements 168
• CWE-472 External Control of Assumed-Immutable Web Parameter 167
• CWE-354 Improper Validation of Integrity Check Value 166
• CWE-459 Incomplete Cleanup 163
• CWE-193 Off-by-one Error 162
• CWE-399 Resource Management Errors (category) 160
• CWE-943 Improper Neutralization of Special Elements in Data Query Logic 159
• CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains 154
• CWE-772 Missing Release of Resource after Effective Lifetime 152
• CWE-36 Absolute Path Traversal 152
• CWE-117 Improper Output Neutralization for Logs 148
• CWE-788 Access of Memory Location After End of Buffer 147
• CWE-377 DEPRECATED: Insecure Temporary File 147
• CWE-807 Reliance on Untrusted Inputs in a Security Decision 146
• CWE-697 Incorrect Comparison 146
• CWE-130 Improper Handling of Length Parameter Inconsistency 145
• CWE-425 Direct Request 145
• CWE-470 Use of Externally-Controlled Input to Select Classes or Code 142
• CWE-1220 Insufficient Granularity of Access Control 138
• CWE-252 Unchecked Return Value 138
• CWE-1392 Use of Default Credentials 137
• CWE-178 Improper Handling of Case Sensitivity 132
• CWE-706 Use of Incorrectly-Resolved Name or Reference 132
• CWE-24 Path Traversal: '../filedir' 130
• CWE-670 Always-Incorrect Control Flow Implementation 130
• CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers 127
• CWE-358 Improperly Implemented Security Check for Standard 125
• CWE-303 Incorrect Implementation of Authentication Algorithm 123
• CWE-331 Insufficient Entropy 123
• CWE-1395 Dependency on Vulnerable Third-Party Component 122
• CWE-1390 Weak Authentication 120
• CWE-926 Improper Export of Android Application Components 119
• CWE-704 Incorrect Type Conversion or Cast 119
• CWE-610 Externally Controlled Reference to a Resource in Another Sphere 117
• CWE-682 Incorrect Calculation 117
• CWE-91 XML Injection 116
• CWE-913 Improper Control of Dynamically-Managed Code Resources 115
• CWE-680 Integer Overflow to Buffer Overflow 114
• CWE-1286 Improper Validation of Syntactic Correctness of Input 111
• CWE-823 Use of Out-of-range Pointer Offset 111
• CWE-620 Unverified Password Change 111
• CWE-15 External Control of System or Configuration Setting 110
• CWE-348 Use of Less Trusted Source 109
• CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory 108
• CWE-916 Use of Password Hash With Insufficient Computational Effort 108
• CWE-489 Active Debug Code 108
• CWE-840 Business Logic Errors (category) 107
• CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer 106
• CWE-776 Improper Restriction of Recursive Entity References in DTDs 104
• CWE-328 Use of Weak Hash 104
• CWE-598 Use of HTTP Request With Sensitive Query String 104
• CWE-297 Improper Validation of Certificate with Host Mismatch 102
• CWE-799 Improper Control of Interaction Frequency 101
• CWE-310 Cryptographic Issues (category) 100
• CWE-825 Expired Pointer Dereference 100
• CWE-912 Hidden Functionality 100
• CWE-197 Numeric Truncation Error 100
• CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences 99
• CWE-90 Improper Neutralization of Special Elements used in an LDAP Query 98
• CWE-681 Incorrect Conversion between Numeric Types 98
• CWE-524 Use of Cache Containing Sensitive Information 94
• CWE-653 Improper Isolation or Compartmentalization 94
• CWE-669 Incorrect Resource Transfer Between Spheres 94
• CWE-841 Improper Enforcement of Behavioral Workflow 93
• CWE-672 Operation on a Resource after Expiration or Release 91
• CWE-923 Improper Restriction of Communication Channel to Intended Endpoints 89
• CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement 88
• CWE-636 Not Failing Securely 82
• CWE-379 Creation of Temporary File in Directory with Insecure Permissions 80
• CWE-405 Amplification 80
• CWE-267 Privilege Defined With Unsafe Actions 77
• CWE-591 Sensitive Data Storage in Improperly Locked Memory 77
• CWE-940 Improper Verification of Source of a Communication Channel 77
• CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input 73
• CWE-277 Insecure Inherited Permissions 73
• CWE-325 Missing Cryptographic Step 73
• CWE-99 Improper Control of Resource Identifiers 73
• CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute 73
• CWE-29 Path Traversal: '\..\filename' 70
• CWE-257 Storing Passwords in a Recoverable Format 69
• CWE-1391 Use of Weak Credentials 69
• CWE-648 Incorrect Use of Privileged APIs 69
• CWE-300 Channel Accessible by Non-Endpoint 67
• CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax 66
• CWE-170 Improper Null Termination 66
• CWE-183 Permissive List of Allowed Inputs 66
• CWE-340 Generation of Predictable Numbers or Identifiers 65
• CWE-664 Improper Control of a Resource Through its Lifetime 65
• CWE-320 Key Management Errors (category) 64
• CWE-805 Buffer Access with Incorrect Length Value 63
• CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data 63
• CWE-696 Incorrect Behavior Order 63
• CWE-255 Credentials Management Errors (category) 63
• CWE-16 Configuration (category) 62
• CWE-548 Exposure of Information Through Directory Listing 62
• CWE-87 Improper Neutralization of Alternate XSS Syntax 62
• CWE-123 Write-what-where Condition 60
• CWE-488 Exposure of Data Element to Wrong Session 60
• CWE-763 Release of Invalid Pointer or Reference 60
• CWE-834 Excessive Iteration 59
• CWE-275 Permission Issues (category) 57
• CWE-353 Missing Support for Integrity Check 56
• CWE-189 Numeric Errors (category) 56
• CWE-304 Missing Critical Step in Authentication 55
• CWE-440 Expected Behavior Violation 55
• CWE-289 Authentication Bypass by Alternate Name 54
• CWE-1289 Improper Validation of Unsafe Equivalence in Input 53
• CWE-378 Creation of Temporary File With Insecure Permissions 53
• CWE-202 Exposure of Sensitive Information Through Data Queries 53
• CWE-565 Reliance on Cookies without Validation and Integrity Checking 52
• CWE-323 Reusing a Nonce, Key Pair in Encryption 52
• CWE-471 Modification of Assumed-Immutable Data (MAID) 52
• CWE-782 Exposed IOCTL with Insufficient Access Control 51
• CWE-1385 Missing Origin Validation in WebSockets 51
• CWE-662 Improper Synchronization 51
• CWE-180 Incorrect Behavior Order: Validate Before Canonicalize 51
• CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag 51
• CWE-606 Unchecked Input for Loop Condition 50
• CWE-1393 Use of Default Password 50
• CWE-385 Covert Timing Channel 49
• CWE-424 Improper Protection of Alternate Path 49
• CWE-791 Incomplete Filtering of Special Elements 48
• CWE-302 Authentication Bypass by Assumed-Immutable Data 48
• CWE-185 Incorrect Regular Expression 48
• CWE-272 Least Privilege Violation 47
• CWE-124 Buffer Underwrite 47
• CWE-261 Weak Encoding for Password 46
• CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action 46
• CWE-41 Improper Resolution of Path Equivalence 45
• CWE-176 Improper Handling of Unicode Encoding 44
• CWE-214 Invocation of Process Using Visible Sensitive Information 44
• CWE-757 Algorithm Downgrade 44
• CWE-525 Use of Web Browser Cache Containing Sensitive Information 43
• CWE-316 Cleartext Storage of Sensitive Information in Memory 43
• CWE-274 Improper Handling of Insufficient Privileges 42
• CWE-691 Insufficient Control Flow Management 42
• CWE-226 Sensitive Information in Resource Not Removed Before Reuse 42
• CWE-778 Insufficient Logging 41
• CWE-75 Failure to Sanitize Special Elements into a Different Plane 41
• CWE-420 Unprotected Alternate Channel 41
• CWE-1288 Improper Validation of Consistency within Input 39
• CWE-690 Unchecked Return Value to NULL Pointer Dereference 39
• CWE-501 Trust Boundary Violation 39
• CWE-540 Inclusion of Sensitive Information in Source Code 38
• CWE-115 Misinterpretation of Input 37
• CWE-158 Improper Neutralization of Null Byte or NUL Character 37
• CWE-195 Signed to Unsigned Conversion Error 37
• CWE-273 Improper Check for Dropped Privileges 36
• CWE-1300 Improper Protection of Physical Side Channels 36
• CWE-283 Unverified Ownership 36
• CWE-322 Key Exchange without Entity Authentication 36
• CWE-83 Improper Neutralization of Script in Attributes in a Web Page 36
• CWE-939 Improper Authorization in Handler for Custom URL Scheme 36
• CWE-213 Exposure of Sensitive Information Due to Incompatible Policies 36
• CWE-233 Improper Handling of Parameters 36
• CWE-241 Improper Handling of Unexpected Data Type 36
• CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior 36
• CWE-1327 Binding to an Unrestricted IP Address 34
• CWE-92 DEPRECATED: Improper Sanitization of Custom Special Characters 34
• CWE-1275 Sensitive Cookie with Improper SameSite Attribute 34
• CWE-286 Incorrect User Management 33
• CWE-313 Cleartext Storage in a File or on Disk 33
• CWE-833 Deadlock 33
• CWE-1104 Use of Unmaintained Third Party Components 33
• CWE-356 Missing User Interaction for Potentially Unsafe Action 33
• CWE-282 Improper Ownership Management 31
• CWE-96 Improper Neutralization of Directives in Statically Saved Code 31
• CWE-684 Incorrect Provision of Specified Functionality 31
• CWE-460 Improper Cleanup on Thrown Exception 31
• CWE-27 Path Traversal: 'dir/../../filename' 30
• CWE-390 Detection of Error Condition Without Action 30
• CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel 30
• CWE-215 Insertion of Sensitive Information Into Debugging Code 30
• CWE-279 Incorrect Execution-Assigned Permissions 29
• CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization 29
• CWE-1325 Improperly Controlled Sequential Memory Allocation 29
• CWE-1191 On-Chip Debug and Test Interface With Improper Access Control 29
• CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable 28
• CWE-603 Use of Client-Side Authentication 28
• CWE-114 Process Control 28
• CWE-391 DEPRECATED: Unchecked Error Condition 28
• CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation 28
• CWE-523 Unprotected Transport of Credentials 27
• CWE-270 Privilege Context Switching Error 27
• CWE-324 Use of a Key Past its Expiration Date 27
• CWE-590 Free of Memory not on the Heap 27
• CWE-625 Permissive Regular Expression 26
• CWE-1394 Use of Default Cryptographic Key 26
• CWE-1230 Exposure of Sensitive Information Through Metadata 26
• CWE-228 Improper Handling of Syntactically Invalid Structure 26
• CWE-253 Incorrect Check of Function Return Value 26
• CWE-260 Password in Configuration File 25
• CWE-268 Privilege Chaining 25
• CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) 25
• CWE-1427 Improper Neutralization of Input Used for LLM Prompting 25
• CWE-406 Insufficient Control of Network Message Volume (Network Amplification) 25
• CWE-453 Insecure Default Variable Initialization 25
• CWE-299 Improper Check for Certificate Revocation 24
• CWE-592 DEPRECATED: Authentication Bypass Issues 24
• CWE-657 Violation of Secure Design Principles 24
• CWE-402 Transmission of Private Resources into a New Sphere 24
• CWE-779 Logging of Excessive Data 23
• CWE-783 Operator Precedence Logic Error 23
• CWE-1295 Debug Messages Revealing Unnecessary Information 23
• CWE-1050 Excessive Platform Resource Consumption within a Loop 23
• CWE-296 Improper Following of a Certificate's Chain of Trust 23
• CWE-308 Use of Single-factor Authentication 23
• CWE-84 Improper Neutralization of Encoded URI Schemes in a Web Page 23
• CWE-177 Improper Handling of URL Encoding (Hex Encoding) 23
• CWE-708 Incorrect Ownership Assignment 23
• CWE-759 Use of a One-Way Hash without a Salt 23
• CWE-1023 Incomplete Comparison with Missing Factors 23
• CWE-1025 Comparison Using Wrong Factors 22
• CWE-366 Race Condition within a Thread 22
• CWE-642 External Control of Critical State Data 22
• CWE-410 Insufficient Resource Pool 22
• CWE-698 Execution After Redirect (EAR) 22
• CWE-244 Improper Clearing of Heap Memory Before Release 22
• CWE-804 Guessable CAPTCHA 21
• CWE-357 Insufficient UI Warning of Dangerous Operations 21
• CWE-140 Improper Neutralization of Delimiters 21
• CWE-155 Improper Neutralization of Wildcards or Matching Symbols 21
• CWE-413 Improper Resource Locking 21
• CWE-229 Improper Handling of Values 21
• CWE-26 Path Traversal: '/dir/../filename' 20
• CWE-837 Improper Enforcement of a Single, Unique Action 20
• CWE-341 Predictable from Observable State 20
• CWE-364 Signal Handler Race Condition 20
• CWE-641 Improper Restriction of Names for Files and Other Resources 20
• CWE-643 Improper Neutralization of Data within XPath Expressions 20
• CWE-909 Missing Initialization of Resource 20
• CWE-911 Improper Update of Reference Count 20
• CWE-549 Missing Password Field Masking 19
• CWE-172 Improper Encoding or Decoding of Data 19
• CWE-187 Partial String Comparison 19
• CWE-475 Undefined Behavior for Input to API 19
• CWE-1259 Improper Restriction of Security Token Assignment 19
• CWE-820 Missing Synchronization 18
• CWE-836 Use of Password Hash Instead of Password for Authentication 18
• CWE-838 Inappropriate Encoding for Output Context 18
• CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG) 18
• CWE-1386 Insecure Operation on Windows Junction / Mount Point 18
• CWE-394 Unexpected Status Code or Return Value 18
• CWE-395 Use of NullPointerException Catch to Detect NULL Pointer Dereference 18
• CWE-927 Use of Implicit Intent for Sensitive Communication 18
• CWE-694 Use of Multiple Resources with Duplicate Identifier 18
• CWE-1260 Improper Handling of Overlap Between Protected Memory Ranges 18
• CWE-1022 Use of Web Link to Untrusted Target with window.opener Access 18
• CWE-564 Use of Hibernate with HQL/SQL Query String Containing External Input 17
• CWE-351 Insufficient Type Distinction 17
• CWE-647 Use of Non-Canonical URL Paths for Authorization Decisions 17
• CWE-25 Path Traversal: '/../filedir' 16
• CWE-31 Path Traversal: 'dir\..\..\filename' 16
• CWE-76 Improper Neutralization of Equivalent Special Elements 16
• CWE-334 Small Space of Random Values 16
• CWE-363 Race Condition Enabling Link Following 16
• CWE-1242 Inclusion of Undocumented Features or Chicken Bits 16
• CWE-477 Use of Obsolete Function 16
• CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information 16
• CWE-265 Privilege Issues (category) 15
• CWE-19 Data Processing Errors (category) 15
• CWE-790 Improper Filtering of Special Elements 15
• CWE-821 Incorrect Synchronization 15
• CWE-329 Generation of Predictable IV with CBC Mode 15
• CWE-599 Missing Validation of OpenSSL Certificate 15
• CWE-393 Return of Wrong Status Code 15
• CWE-547 Use of Hard-coded, Security-relevant Constants 14
• CWE-64 Windows Shortcut Following (.LNK) 14
• CWE-138 Improper Neutralization of Special Elements 14
• CWE-449 The UI Performs the Wrong Action 14
• CWE-1241 Use of Predictable Algorithm in Random Number Generator 14
• CWE-474 Use of Function with Inconsistent Implementations 14
• CWE-230 Improper Handling of Missing Values 14
• CWE-1263 Improper Physical Access Control 14
• CWE-762 Mismatched Memory Management Routines 14
• CWE-258 Empty Password in Configuration File 13
• CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities (category) 13
• CWE-271 Privilege Dropping / Lowering Errors 13
• CWE-530 Exposure of Backup File to an Unauthorized Control Sphere 13
• CWE-291 Reliance on IP Address for Authentication 13
• CWE-567 Unsynchronized Access to Shared Data in a Multithreaded Context 13
• CWE-830 Inclusion of Web Functionality from an Untrusted Source 13
• CWE-86 Improper Neutralization of Invalid Characters in Identifiers in Web Pages 13
• CWE-372 Incomplete Internal State Distinction 13
• CWE-392 Missing Report of Error Condition 13
• CWE-650 Trusting HTTP Permission Methods on the Server Side 13
• CWE-1419 Incorrect Initialization of Resource 13
• CWE-159 Improper Handling of Invalid Use of Special Elements 13
• CWE-941 Incorrectly Specified Destination in a Communication Channel 13
• CWE-1244 Internal Asset Exposed to Unsafe Debug Access Level or State 13
• CWE-842 Placement of User into Incorrect Group 12
• CWE-112 Missing XML Validation 12
• CWE-118 Range Error 12
• CWE-127 Buffer Under-read 12
• CWE-141 Improper Neutralization of Parameter/Argument Delimiters 12
• CWE-656 Reliance on Security Through Obscurity 12
• CWE-419 Unprotected Primary Channel 12
• CWE-676 Use of Potentially Dangerous Function 12
• CWE-223 Omission of Security-relevant Information 12
• CWE-480 Use of Incorrect Operator 12
• CWE-232 Improper Handling of Undefined Values 12
• CWE-1262 Improper Access Control for Register Interface 12
• CWE-760 Use of a One-Way Hash with a Predictable Salt 12
• CWE-1299 Missing Protection Mechanism for Alternate Hardware Interface 11
• CWE-826 Premature Release of Resource During Expected Lifetime 11
• CWE-573 Improper Following of Specification by Caller 11
• CWE-612 Improper Authorization of Index Containing Sensitive Information 11
• CWE-616 Incomplete Identification of Uploaded File Variables (PHP) 11
• CWE-628 Function Call with Incorrectly Specified Arguments 11
• CWE-646 Reliance on File Name or Extension of Externally-Supplied File 11
• CWE-1173 Improper Use of Validation Framework 11
• CWE-692 Incomplete Denylist to Cross-Site Scripting 11
• CWE-705 Incorrect Control Flow Scoping 11
• CWE-242 Use of Inherently Dangerous Function 11
• CWE-1270 Generation of Incorrect Security Tokens 11
• CWE-14 Compiler Removal of Code to Clear Buffers 10
• CWE-298 Improper Validation of Certificate Expiration 10
• CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key 10
• CWE-1357 Reliance on Insufficiently Trustworthy Component 10
• CWE-81 Improper Neutralization of Script in an Error Message Web Page 10
• CWE-146 Improper Neutralization of Expression/Command Delimiters 10
• CWE-921 Storage of Sensitive Data in a Mechanism without Access Control 10
• CWE-173 Improper Handling of Alternate Encoding 10
• CWE-179 Incorrect Behavior Order: Early Validation 10
• CWE-196 Unsigned to Signed Conversion Error 10
• CWE-733 Compiler Optimization Removal or Modification of Security-critical Code 10
• CWE-775 Missing Release of File Descriptor or Handle after Effective Lifetime 9
• CWE-786 Access of Memory Location Before Start of Buffer 9
• CWE-544 Missing Standardized Error Handling Mechanism 9
• CWE-1326 Missing Immutable Root of Trust in Hardware 9
• CWE-561 Dead Code 9
• CWE-315 Cleartext Storage of Sensitive Information in a Cookie 9
• CWE-1341 Multiple Releases of Same Resource or Handle 9
• CWE-1088 Synchronous Access of Remote Resource without Timeout 9
• CWE-839 Numeric Range Comparison Without Minimum Check 9
• CWE-332 Insufficient Entropy in PRNG 9
• CWE-626 Null Byte Interaction Error (Poison Null Byte) 9
• CWE-371 State Issues (category) 9
• CWE-388 7PK - Errors (category) 9
• CWE-645 Overly Restrictive Account Lockout Mechanism 9
• CWE-914 Improper Control of Dynamically-Identified Variables 9
• CWE-408 Incorrect Behavior Order: Early Amplification 9
• CWE-710 Improper Adherence to Coding Standards 9
• CWE-456 Missing Initialization of a Variable 9
• CWE-466 Return of Pointer Value Outside of Expected Range 9
• CWE-221 Information Loss or Omission 9
• CWE-1274 Improper Access Control for Volatile Memory Containing Boot Code 9
• CWE-1282 Assumed-Immutable Data is Stored in Writable Memory 8
• CWE-278 Insecure Preserved Inherited Permissions 8
• CWE-562 Return of Stack Variable Address 8
• CWE-1335 Incorrect Bitwise Shift of Integer 8
• CWE-317 Cleartext Storage of Sensitive Information in GUI 8
• CWE-82 Improper Neutralization of Script in Attributes of IMG Tags in a Web Page 8
• CWE-649 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking 8
• CWE-147 Improper Neutralization of Input Terminators 8
• CWE-403 Exposure of File Descriptor to Unintended Control Sphere 8
• CWE-421 Race Condition During Access to Alternate Channel 8
• CWE-174 Double Decoding of the Same Data 8
• CWE-219 Storage of File with Sensitive Data Under Web Root 8
• CWE-1254 Incorrect Comparison Logic Granularity 8
• CWE-1281 Sequence of Processor Instructions Leads to Unexpected Behavior 7
• CWE-771 Missing Reference to Active Allocated Resource 7
• CWE-777 Regular Expression without Anchors 7
• CWE-1038 Insecure Automated Optimizations 7
• CWE-539 Use of Persistent Cookies Containing Sensitive Information 7
• CWE-40 Path Traversal: '\\UNC\share\name\' (Windows UNC Share) 7
• CWE-1320 Improper Protection for Outbound Error Messages and Alert Signals 7
• CWE-1077 Floating Point Comparison with Incorrect Operator 7
• CWE-65 Windows Hard Link 7
• CWE-67 Improper Handling of Windows Device Names 7
• CWE-342 Predictable Exact Value from Previous Values 7
• CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page 7
• CWE-627 Dynamic Variable Evaluation 7
• CWE-412 Unrestricted Externally Accessible Lock 7
• CWE-1189 Improper Isolation of Shared Resources on System-on-a-Chip (SoC) 7
• CWE-686 Function Call With Incorrect Argument Type 7
• CWE-192 Integer Coercion Error 7
• CWE-1250 Improper Preservation of Consistency Between Independent Representations of Shared State 7
• CWE-1256 Improper Restriction of Software Interfaces to Hardware Features 7
• CWE-262 Not Using Password Aging 6
• CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision 6
• CWE-37 Path Traversal: '/absolute/pathname/here' 6
• CWE-1319 Improper Protection against Electromagnetic Fault Injection (EM-FI) 6
• CWE-1328 Security Version Number Mutable to Older Versions 6
• CWE-1329 Reliance on Component That is Not Updateable 6
• CWE-62 UNIX Hard Link 6
• CWE-1384 Improper Handling of Physical or Environmental Conditions 6
• CWE-1389 Incorrect Parsing of Numbers with Different Radices 6
• CWE-368 Context Switching Race Condition 6
• CWE-1423 Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution 6
• CWE-149 Improper Neutralization of Quoting Syntax 6
• CWE-666 Operation on Resource in Wrong Phase of Lifetime 6
• CWE-671 Lack of Administrator Control over Security 6
• CWE-1204 Generation of Weak Initialization Vector (IV) 6
• CWE-188 Reliance on Data/Memory Layout 6
• CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection 6
• CWE-240 Improper Handling of Inconsistent Structural Elements 6
• CWE-249 DEPRECATED: Often Misused: Path Manipulation 6
• CWE-254 7PK - Security Features (category) 6
• CWE-774 Allocation of File Descriptors or Handles Without Limits or Throttling 5
• CWE-520 .NET Misconfiguration: Use of Impersonation 5
• CWE-1032 OWASP Top Ten 2017 Category A6 - Security Misconfiguration (category) 5
• CWE-1037 Processor Optimization Removal or Modification of Security-critical Code 5
• CWE-527 Exposure of Version-Control Repository to an Unauthorized Control Sphere 5
• CWE-1303 Non-Transparent Sharing of Microarchitectural Resources 5
• CWE-792 Incomplete Filtering of One or More Instances of Special Elements 5
• CWE-794 Incomplete Filtering of Multiple Instances of Special Elements 5
• CWE-550 Server-generated Error Message Containing Sensitive Information 5
• CWE-1068 Inconsistency Between Implementation and Documented Design 5
• CWE-1100 Insufficient Isolation of System-Dependent Functions 5
• CWE-343 Predictable Value Range from Previous Values 5
• CWE-1116 Inaccurate Source Code Comments 5
• CWE-1125 Excessive Attack Surface 5
• CWE-128 Wrap-around Error 5
• CWE-144 Improper Neutralization of Line Delimiters 5
• CWE-1428 Reliance on HTTP instead of HTTPS 5
• CWE-1176 Inefficient CPU Computation 5
• CWE-153 Improper Neutralization of Substitution Characters 5
• CWE-156 Improper Neutralization of Whitespace 5
• CWE-675 Multiple Operations on Resource in Single-Operation Context 5
• CWE-166 Improper Handling of Missing Special Element 5
• CWE-167 Improper Handling of Additional Special Element 5
• CWE-683 Function Call With Incorrect Order of Arguments 5
• CWE-688 Function Call With Incorrect Variable or Reference as Argument 5
• CWE-435 Improper Interaction Between Multiple Correctly-Behaving Entities 5
• CWE-437 Incomplete Model of Endpoint Features 5
• CWE-194 Unexpected Sign Extension 5
• CWE-454 External Initialization of Trusted Variables or Data Stores 5
• CWE-473 PHP External Variable Modification 5
• CWE-1245 Improper Finite State Machines (FSMs) in Hardware Logic 5
• CWE-231 Improper Handling of Extra Values 5
• CWE-1255 Comparison Logic is Vulnerable to Power Side-Channel Attacks 5
• CWE-235 Improper Handling of Extra Parameters 5
• CWE-237 Improper Handling of Structural Elements 5
• CWE-1007 Insufficient Visual Distinction of Homoglyphs Presented to User 5
• CWE-1310 Missing Ability to Patch ROM Code 4
• CWE-1059 Insufficient Technical Documentation 4
• CWE-1322 Use of Blocking Code in Single-threaded, Non-blocking Context 4
• CWE-336 Same Seed in Pseudo-Random Number Generator (PRNG) 4
• CWE-1124 Excessively Deep Nesting 4
• CWE-624 Executable Regular Expression Error 4
• CWE-386 Symbolic Name not Mapping to Correct Object 4
• CWE-1420 Exposure of Sensitive Information during Transient Execution 4
• CWE-1421 Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution 4
• CWE-925 Improper Verification of Intent by Broadcast Receiver 4
• CWE-414 Missing Lock Check 4
• CWE-168 Improper Handling of Inconsistent Special Elements 4
• CWE-433 Unparsed Raw Web Content Delivery 4
• CWE-182 Collapse of Data into Unsafe Value 4
• CWE-210 Self-generated Error Message Containing Sensitive Information 4
• CWE-1234 Hardware Internal or Debug Modes Allow Override of Locks 4
• CWE-467 Use of sizeof() on a Pointer Type 4
• CWE-468 Incorrect Pointer Scaling 4
• CWE-216 DEPRECATED: Containment Errors (Container Errors) 4
• CWE-1247 Improper Protection Against Voltage and Clock Glitches 4
• CWE-491 Public cloneable() Method Without Final 4
• CWE-1265 Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls 4
• CWE-767 Access to Critical Private Variable via Public Method 4
• CWE-1024 Comparison of Incompatible Types 3
• CWE-1280 Access Control Check Implemented After Asset is Accessed 3
• CWE-1283 Mutable Attestation or Measurement Reporting Data 3
• CWE-780 Use of RSA Algorithm without OAEP 3
• CWE-1039 Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism 3
• CWE-1298 Hardware Logic Contains Race Conditions 3
• CWE-21 DEPRECATED: Pathname Traversal and Equivalence Errors (category) 3
• CWE-534 DEPRECATED: Information Exposure Through Debug Log Files 3
• CWE-535 Exposure of Information Through Shell Error Message 3
• CWE-1049 Excessive Data Query Operations in a Large Data Table 3
• CWE-28 Path Traversal: '..\filedir' 3
• CWE-557 Concurrency Issues (category) 3
• CWE-1332 Improper Handling of Faults that Lead to Instruction Skips 3
• CWE-309 Use of Password System for Primary Authentication 3
• CWE-827 Improper Control of Document Type Definition 3
• CWE-1342 Information Exposure through Microarchitectural State after Transient Execution 3
• CWE-69 Improper Handling of Windows ::DATA Alternate Data Stream 3
• CWE-588 Attempt to Access Child of a Non-structure Pointer 3
• CWE-1103 Use of Platform-Dependent Third Party Components 3
• CWE-1108 Excessive Reliance on Global Variables 3
• CWE-597 Use of Wrong Operator in String Comparison 3
• CWE-344 Use of Invariant Value in Dynamically Changing Context 3
• CWE-605 Multiple Binds to the Same Port 3
• CWE-1119 Excessive Use of Unconditional Branching 3
• CWE-615 Inclusion of Sensitive Information in Source Code Comments 3
• CWE-623 Unsafe ActiveX Control Marked Safe For Scripting 3
• CWE-142 Improper Neutralization of Value Delimiters 3
• CWE-143 Improper Neutralization of Record Delimiters 3
• CWE-1426 Improper Validation of Generative AI Output 3
• CWE-148 Improper Neutralization of Input Leaders 3
• CWE-920 Improper Restriction of Power Consumption 3
• CWE-673 External Influence of Sphere Definition 3
• CWE-164 Improper Neutralization of Internal Special Elements 3
• CWE-687 Function Call With Incorrectly Specified Argument Value 3
• CWE-689 Permission Race Condition During Resource Copy 3
• CWE-186 Overly Restrictive Regular Expression 3
• CWE-446 UI Discrepancy for Security Feature 3
• CWE-447 Unimplemented or Unsupported Feature in UI 3
• CWE-448 Obsolete Feature in UI 3
• CWE-450 Multiple Interpretations of UI Input 3
• CWE-198 Use of Incorrect Byte Ordering 3
• CWE-1223 Race Condition for Write-Once Attributes 3
• CWE-205 Observable Behavioral Discrepancy 3
• CWE-463 Deletion of Data Structure Sentinel 3
• CWE-1231 Improper Prevention of Lock Bit Modification 3
• CWE-227 7PK - API Abuse (category) 3
• CWE-484 Omitted Break Statement in Switch 3
• CWE-1257 Improper Access Control Applied to Mirrored or Aliased Memory Regions 3
• CWE-239 Failure to Handle Incomplete Element 3
• CWE-1264 Hardware Logic with Insecure De-Synchronization between Control and Data Channels 3
• CWE-756 Missing Custom Error Page 3
• CWE-1269 Product Released in Non-Release Configuration 3
• CWE-1279 Cryptographic Operations are Run Before Supporting Units are Ready 3
• CWE-769 DEPRECATED: Uncontrolled File Descriptor Consumption 2
• CWE-514 Covert Channel 2
• CWE-1027 OWASP Top Ten 2017 Category A1 - Injection (category) 2
• CWE-5 J2EE Misconfiguration: Data Transmission Without Encryption 2
• CWE-263 Password Aging with Long Expiration 2
• CWE-11 ASP.NET Misconfiguration: Creating Debug Binary 2
• CWE-12 ASP.NET Misconfiguration: Missing Custom Error Page 2
• CWE-528 Exposure of Core Dump File to an Unauthorized Control Sphere 2
• CWE-531 Inclusion of Sensitive Information in Test Code 2
• CWE-1301 Insufficient or Incomplete Data Removal within Hardware Component 2
• CWE-1046 Creation of Immutable Text Using String Concatenation 2
• CWE-1304 Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation 2
• CWE-30 Path Traversal: '\dir\..\filename' 2
• CWE-32 Path Traversal: '...' (Triple Dot) 2
• CWE-1313 Hardware Allows Activation of Test or Debug Logic at Runtime 2
• CWE-34 Path Traversal: '....//' 2
• CWE-42 Path Equivalence: 'filename.' (Trailing Dot) 2
• CWE-555 J2EE Misconfiguration: Plaintext Password in Configuration File 2
• CWE-1323 Improper Management of Sensitive Trace Data 2
• CWE-815 OWASP Top Ten 2010 Category A6 - Security Misconfiguration (category) 2
• CWE-50 Path Equivalence: '//multiple/leading/slash' 2
• CWE-563 Assignment to Variable without Use 2
• CWE-1076 Insufficient Adherence to Expected Conventions 2
• CWE-1334 Unauthorized Error Injection Can Degrade Hardware Redundancy 2
• CWE-828 Signal Handler with Functionality that is not Asynchronous-Safe 2
• CWE-318 Cleartext Storage of Sensitive Information in Executable 2
• CWE-832 Unlock of a Resource that is not Locked 2
• CWE-339 Small Seed Space in PRNG 2
• CWE-1107 Insufficient Isolation of Symbolic Constant Definitions 2
• CWE-85 Doubled Character XSS Manipulations 2
• CWE-1112 Incomplete Documentation of Program Execution 2
• CWE-360 Trust of System Event Data 2
• CWE-618 Exposed Unsafe ActiveX Method 2
• CWE-621 Variable Extraction Error 2
• CWE-622 Improper Validation of Function Hook Arguments 2
• CWE-111 Direct Use of Unsafe JNI 2
• CWE-882 CERT C++ Secure Coding Section 14 - Concurrency (CON) (category) 2
• CWE-135 Incorrect Calculation of Multi-Byte String Length 2
• CWE-396 Declaration of Catch for Generic Exception 2
• CWE-652 Improper Neutralization of Data within XQuery Expressions 2
• CWE-1164 Irrelevant Code 2
• CWE-910 Use of Expired File Descriptor 2
• CWE-1422 Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution 2
• CWE-157 Failure to Sanitize Paired Delimiters 2
• CWE-422 Unprotected Windows Messaging Channel 2
• CWE-1190 DMA Device Enabled Too Early in Boot Phase 2
• CWE-685 Function Call With Incorrect Number of Arguments 2
• CWE-430 Deployment of Wrong Handler 2
• CWE-431 Missing Handler 2
• CWE-1221 Incorrect Register Defaults or Module Parameters 2
• CWE-199 Information Management Errors (category) 2
• CWE-455 Non-exit on Failed Initialization 2
• CWE-465 Pointer Issues (category) 2
• CWE-730 OWASP Top Ten 2004 Category A9 - Denial of Service (category) 2
• CWE-1246 Improper Write Handling in Limited-write Non-Volatile Memories 2
• CWE-479 Signal Handler Use of a Non-reentrant Function 2
• CWE-482 Comparing instead of Assigning 2
• CWE-1251 Mirrored Regions with Different Values 2
• CWE-234 Failure to Handle Missing Parameter 2
• CWE-236 Improper Handling of Undefined Parameters 2
• CWE-495 Private Data Structure Returned From A Public Method 2
• CWE-499 Serializable Class Containing Sensitive Data 2
• CWE-1272 Sensitive Information Uncleared Before Debug/Power State Transition 2
• CWE-761 Free of Pointer not at Start of Buffer 2
• CWE-1018 Manage User Sessions (category) 2
• CWE-508 Non-Replicating Malicious Code 2
• CWE-768 Incorrect Short Circuit Evaluation 1
• CWE-515 Covert Storage Channel 1
• CWE-6 J2EE Misconfiguration: Insufficient Session-ID Length 1
• CWE-1290 Incorrect Decoding of Security Identifiers 1
• CWE-1291 Public Key Re-Use for Signing both Debug and Production Code 1
• CWE-1294 Insecure Security Identifier Mechanism 1
• CWE-17 DEPRECATED: Code (category) 1
• CWE-529 Exposure of Access Control List Files to an Unauthorized Control Sphere 1
• CWE-533 DEPRECATED: Information Exposure Through Server Log Files 1
• CWE-1051 Initialization with Hard-Coded Network Resource Configuration Data 1
• CWE-541 Inclusion of Sensitive Information in an Include File 1
• CWE-797 Only Filtering Special Elements at an Absolute Position 1
• CWE-1055 Multiple Inheritance from Concrete Classes 1
• CWE-1056 Invokable Control Element with Variadic Parameters 1
• CWE-1312 Missing Protection for Mirrored Regions in On-Chip Fabric Firewall 1
• CWE-1057 Data Access Operations Outside of Expected Data Manager Component 1
• CWE-1058 Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element 1
• CWE-1314 Missing Write Protection for Parametric Data Values 1
• CWE-292 DEPRECATED: Trusting Self-reported DNS Name 1
• CWE-1316 Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges 1
• CWE-293 Using Referer Field for Authentication 1
• CWE-38 Path Traversal: '\absolute\pathname\here' 1
• CWE-39 Path Traversal: 'C:dirname' 1
• CWE-553 Command Shell in Externally Accessible Directory 1
• CWE-1066 Missing Serialization Control Element 1
• CWE-43 Path Equivalence: 'filename....' (Multiple Trailing Dot) 1
• CWE-1067 Excessive Execution of Sequential Searches of Data Resource 1
• CWE-44 Path Equivalence: 'file.name' (Internal Dot) 1
• CWE-556 ASP.NET Misconfiguration: Use of Identity Impersonation 1
• CWE-301 Reflection Attack in an Authentication Protocol 1
• CWE-46 Path Equivalence: 'filename ' (Trailing Space) 1
• CWE-1072 Data Resource Access without Use of Connection Pooling 1
• CWE-1330 Remanent Data Readable after Memory Erase 1
• CWE-1078 Inappropriate Source Code Style or Formatting 1
• CWE-55 Path Equivalence: '/./' (Single Dot Directory) 1
• CWE-57 Path Equivalence: 'fakedir/../realdir/filename' 1
• CWE-314 Cleartext Storage in the Registry 1
• CWE-570 Expression is Always False 1
• CWE-571 Expression is Always True 1
• CWE-1083 Data Access from Outside Expected Data Manager Component 1
• CWE-1339 Insufficient Precision or Accuracy of a Real Number 1
• CWE-66 Improper Handling of File Names that Identify Virtual Resources 1
• CWE-1091 Use of Object without Invoking Destructor Method 1
• CWE-1352 OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components (category) 1
• CWE-587 Assignment of a Fixed Address to a Pointer 1
• CWE-333 Improper Handling of Insufficient Entropy in TRNG 1
• CWE-1102 Reliance on Machine-Dependent Data Representation 1
• CWE-1106 Insufficient Use of Symbolic Constants 1
• CWE-595 Comparison of Object References Instead of Object Contents 1
• CWE-1366 ICS Communications: Frail Security in Protocols (category) 1
• CWE-600 Uncaught Exception in Servlet 1
• CWE-1113 Inappropriate Comment Style 1
• CWE-1118 Insufficient Documentation of Error Handling Techniques 1
• CWE-355 User Interface Security Issues (category) 1
• CWE-102 Struts: Duplicate Validation Forms 1
• CWE-365 DEPRECATED: Race Condition in Switch 1
• CWE-370 Missing Check for Certificate Revocation after Initial Check 1
• CWE-374 Passing Mutable Objects to an Untrusted Method 1
• CWE-637 Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') 1
• CWE-1149 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC) (category) 1
• CWE-638 Not Using Complete Mediation 1
• CWE-895 SFP Primary Cluster: Information Leak (category) 1
• CWE-654 Reliance on a Single Factor in a Security Decision 1
• CWE-655 Insufficient Psychological Acceptability 1
• CWE-145 Improper Neutralization of Section Delimiters 1
• CWE-1174 ASP.NET Misconfiguration: Improper Model Validation 1
• CWE-663 Use of a Non-reentrant Function in a Concurrent Context 1
• CWE-154 Improper Neutralization of Variable Name Delimiters 1
• CWE-160 Improper Neutralization of Leading Special Elements 1
• CWE-162 Improper Neutralization of Trailing Special Elements 1
• CWE-175 Improper Handling of Mixed Encoding 1
• CWE-695 Use of Low-Level Functionality 1
• CWE-1463 Insufficient Session Timeout Value 1
• CWE-952 SFP Secondary Cluster: Missing Authentication (category) 1
• CWE-1464 Improper Session Invalidation 1
• CWE-1466 Improper Session Invalidation after Authentication Credential Change 1
• CWE-443 DEPRECATED: HTTP response splitting 1
• CWE-1218 Memory Buffer Errors (category) 1
• CWE-1222 Insufficient Granularity of Address Regions Protected by Register Locks 1
• CWE-1224 Improper Restriction of Write-Once Bit Fields 1
• CWE-714 OWASP Top Ten 2007 Category A3 - Malicious File Execution (category) 1
• CWE-206 Observable Internal Behavioral Discrepancy 1
• CWE-462 Duplicate Key in Associative List (Alist) 1
• CWE-207 Observable Behavioral Discrepancy With Equivalent Products 1
• CWE-469 Use of Pointer Subtraction to Determine Size 1
• CWE-222 Truncation of Security-relevant Information 1
• CWE-478 Missing Default Case in Multiple Condition Expression 1
• CWE-224 Obscured Security-relevant Information by Alternate Name 1
• CWE-1249 Application-Level Admin Tool with Inconsistent View of Underlying Operating System 1
• CWE-483 Incorrect Block Delimitation 1
• CWE-485 7PK - Encapsulation (category) 1
• CWE-1253 Incorrect Selection of Fuse Values 1
• CWE-1268 Policy Privileges are not Assigned Consistently Between Control and Data Agents 1
• CWE-507 Trojan Horse 1
• CWE-764 Multiple Locks of a Critical Resource 1
• CWE-1276 Hardware Child Block Incorrectly Connected to Parent System 1
• CWE-509 Replicating Malicious Code (Virus or Worm) 1
• CWE-765 Multiple Unlocks of a Critical Resource 1
• CWE-1277 Firmware Not Updateable 1
• CWE-1278 Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques 1
• CWE-511 Logic/Time Bomb 1