CWE Security Standards Supported by SAST

Language/Platform	CWE	Description
Apex	17	This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
Apex	18	This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
Apex	19	Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
Apex	20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Apex	74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Apex	77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Apex	79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Apex	89	The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
Apex	116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Apex	137	Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.
Apex	171	This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.
Apex	199	Weaknesses in this category are related to improper handling of sensitive information.
Apex	227	This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."
Apex	242	The product calls a function that can never be guaranteed to work safely.
Apex	254	Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Apex	255	Weaknesses in this category are related to the management of credentials.
Apex	259	The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
Apex	264	Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Apex	265	Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.
Apex	269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Apex	274	The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
Apex	284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Apex	287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Apex	310	Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Apex	311	The product does not encrypt sensitive or critical information before storage or transmission.
Apex	319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Apex	320	Weaknesses in this category are related to errors in the management of cryptographic keys.
Apex	321	The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
Apex	330	The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Apex	344	The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
Apex	345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Apex	352	The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Apex	361	This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."
Apex	388	This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."
Apex	389	This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.
Apex	442	This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
Apex	601	A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Apex	610	The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Apex	629	CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
Apex	632	This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
Apex	635	CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.
Apex	657	The product violates well-established principles for secure design.
Apex	664	The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
Apex	671	The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.
Apex	693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Apex	699	This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.
Apex	700	This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.
Apex	703	The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
Apex	707	The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Apex	710	The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
Apex	711	CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
Apex	712	Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.
Apex	713	Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.
Apex	716	Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.
Apex	718	Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.
Apex	719	Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.
Apex	720	Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.
Apex	722	Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.
Apex	723	Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.
Apex	724	Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.
Apex	725	Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.
Apex	727	Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.
Apex	728	Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.
Apex	729	Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.
Apex	734	CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.
Apex	738	Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).
Apex	742	Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).
Apex	746	Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).
Apex	747	Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).
Apex	748	Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).
Apex	750	CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.
Apex	751	Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.
Apex	753	Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.
Apex	798	The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
Apex	800	CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.
Apex	801	Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.
Apex	803	Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.
Apex	808	Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.
Apex	809	CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
Apex	810	Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.
Apex	811	Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.
Apex	812	Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.
Apex	814	Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.
Apex	816	Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.
Apex	818	Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.
Apex	819	Weaknesses in this category are related to the A10 category in the OWASP Top 10 2010.
Apex	844	CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.
Apex	845	Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
Apex	851	Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
Apex	858	Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
Apex	859	Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
Apex	861	Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
Apex	864	Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
Apex	866	Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
Apex	867	Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.
Apex	868	CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.
Apex	872	Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
Apex	876	Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
Apex	880	Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
Apex	883	Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
Apex	884	This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.
Apex	887	This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).
Apex	888	CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).
Apex	889	This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).
Apex	892	This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).
Apex	893	This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).
Apex	895	This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).
Apex	896	This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).
Apex	898	This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).
Apex	899	This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).
Apex	900	CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
Apex	901	This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36).
Apex	905	This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.
Apex	907	This category identifies Software Fault Patterns (SFPs) within the Other cluster.
Apex	917	The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Apex	928	CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
Apex	929	Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.
Apex	930	Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.
Apex	931	Weaknesses in this category are related to the A3 category in the OWASP Top 10 2013.
Apex	934	Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.
Apex	935	Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.
Apex	936	Weaknesses in this category are related to the A8 category in the OWASP Top 10 2013.
Apex	938	Weaknesses in this category are related to the A10 category in the OWASP Top 10 2013.
Apex	943	The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
Apex	944	This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.
Apex	947	This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.
Apex	949	This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).
Apex	950	This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).
Apex	961	This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).
Apex	963	This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).
Apex	975	This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.
Apex	978	This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.
Apex	980	This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).
Apex	984	This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.
Apex	990	This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).
Apex	992	This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.
Apex	994	This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).
Apex	1000	This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.
Apex	1001	This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).
Apex	1003	CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.
Apex	1005	This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."
Apex	1006	Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.
Apex	1008	This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.
Apex	1010	Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
Apex	1011	Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.
Apex	1012	Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.
Apex	1013	Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.
Apex	1014	Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.
Apex	1015	Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
Apex	1019	Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.
Apex	1020	Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.
Apex	1026	CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.
Apex	1027	Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.
Apex	1028	Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.
Apex	1029	Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.
Apex	1031	Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.
Apex	1033	Weaknesses in this category are related to the A7 category in the OWASP Top 10 2017.
Apex	1128	This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.
Apex	1131	Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.
Apex	1133	CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.
Apex	1134	Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.
Apex	1141	Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.
Apex	1147	Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.
Apex	1148	Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.
Apex	1152	Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.
Apex	1154	CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.
Apex	1163	Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.
Apex	1169	Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.
Apex	1170	Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.
Apex	1171	Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard.
Apex	1172	Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.
Apex	1178	CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.
Apex	1179	Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.
Apex	1194	This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.
Apex	1200	CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.
Apex	1207	Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.
Apex	1213	Weaknesses in this category are related to a software system's random number generation.
Apex	1228	Weaknesses in this category are related to the use of built-in functions or external APIs.
Apex	1305	This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.
Apex	1306	Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.
Apex	1308	Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.
Apex	1337	CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.
Apex	1340	This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.
Apex	1344	CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.
Apex	1345	Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.
Apex	1346	Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.
Apex	1347	Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.
Apex	1348	Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.
Apex	1350	CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.
Apex	1353	Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.
Apex	1354	Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.
Apex	1358	CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex	1360	Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
Apex	1361	Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
Apex	1362	Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
Apex	1363	Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
Apex	1368	Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex	1369	Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex	1370	Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex	1372	Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex	1373	Weaknesses in this category are related to the "Trust Model Problems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Assumptions made about the user during the design or construction phase may result in vulnerabilities after the system is installed if the user operates it using a different security approach or process than what was designed or built." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex	1375	Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex	1382	Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex	1383	Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex	1387	CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.
Apex	1396	Weaknesses in this category are related to access control.
Apex	1400	This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.
Apex	1402	Weaknesses in this category are related to encryption.
Apex	1405	Weaknesses in this category are related to improper check or handling of exceptional conditions.
Apex	1406	Weaknesses in this category are related to improper input validation.
Apex	1407	Weaknesses in this category are related to improper neutralization.
Apex	1409	Weaknesses in this category are related to injection.
Apex	1411	Weaknesses in this category are related to insufficient verification of data authenticity.
Apex	1412	Weaknesses in this category are related to poor coding practices.
Apex	1413	Weaknesses in this category are related to protection mechanism failure.
Apex	1414	Weaknesses in this category are related to randomness.
Apex	1416	Weaknesses in this category are related to resource lifecycle management.
Apex	1418	Weaknesses in this category are related to violation of secure design principles.
C#	2	This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."
C#	4	This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C#	5	Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.
C#	10	This category has been deprecated. It added unnecessary depth and complexity to its associated views.
C#	11	Debugging messages help attackers learn about the system and plan a form of attack.
C#	16	Weaknesses in this category are typically introduced during the configuration of the software.
C#	17	This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C#	18	This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C#	19	Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
C#	20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
C#	21	This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).
C#	22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
C#	23	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
C#	36	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
C#	73	The product allows user input to control or influence paths or file names that are used in filesystem operations.
C#	74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
C#	77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
C#	78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
C#	79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
C#	80	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
C#	82	The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.
C#	83	The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
C#	85	The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.
C#	86	The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.
C#	87	The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
C#	88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
C#	89	The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
C#	90	The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
C#	91	The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
C#	94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
C#	95	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
C#	116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
C#	117	The product does not neutralize or incorrectly neutralizes output that is written to logs.
C#	133	Weaknesses in this category are related to the creation and modification of strings.
C#	137	Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.
C#	138	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
C#	140	The product does not neutralize or incorrectly neutralizes delimiters.
C#	141	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.
C#	142	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.
C#	143	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.
C#	146	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.
C#	149	Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.
C#	150	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
C#	157	The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.
C#	171	This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.
C#	183	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
C#	189	Weaknesses in this category are related to improper calculation or conversion of numbers.
C#	190	The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.
C#	199	Weaknesses in this category are related to improper handling of sensitive information.
C#	200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
C#	201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
C#	209	The product generates an error message that includes sensitive information about its environment, users, or associated data.
C#	210	The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
C#	211	The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.
C#	215	The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
C#	221	The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
C#	223	The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
C#	226	The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
C#	227	This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."
C#	248	An exception is thrown from a function, but it is not caught.
C#	249	This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.
C#	254	Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
C#	255	Weaknesses in this category are related to the management of credentials.
C#	256	Storing a password in plaintext may result in a system compromise.
C#	257	The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
C#	259	The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
C#	260	The product stores a password in a configuration file that might be accessible to actors who do not know the password.
C#	264	Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
C#	265	Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.
C#	275	Weaknesses in this category are related to improper assignment or handling of permissions.
C#	284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
C#	285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
C#	287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
C#	295	The product does not validate, or incorrectly validates, a certificate.
C#	296	The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.
C#	299	The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
C#	300	The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
C#	304	The product implements an authentication technique, but it skips a step that weakens the technique.
C#	306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
C#	310	Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
C#	311	The product does not encrypt sensitive or critical information before storage or transmission.
C#	312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
C#	313	The product stores sensitive information in cleartext in a file, or on disk.
C#	314	The product stores sensitive information in cleartext in the registry.
C#	315	The product stores sensitive information in cleartext in a cookie.
C#	317	The product stores sensitive information in cleartext within the GUI.
C#	318	The product stores sensitive information in cleartext in an executable.
C#	319	The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
C#	320	Weaknesses in this category are related to errors in the management of cryptographic keys.
C#	321	The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
C#	326	The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
C#	327	The product uses a broken or risky cryptographic algorithm or protocol.
C#	328	The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
C#	330	The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
C#	338	The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
C#	344	The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
C#	345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
C#	352	The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
C#	353	The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
C#	355	Weaknesses in this category are related to or introduced in the User Interface (UI).
C#	359	The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
C#	361	This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."
C#	362	The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
C#	366	If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
C#	369	The product divides a value by zero.
C#	371	Weaknesses in this category are related to improper management of system state.
C#	380	This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C#	381	This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C#	388	This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."
C#	389	This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.
C#	390	The product detects a specific error, but takes no actions to handle the error.
C#	398	This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."
C#	399	Weaknesses in this category are related to improper management of system resources.
C#	402	The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.
C#	403	A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.
C#	404	The product does not release or incorrectly releases a resource before it is made available for re-use.
C#	405	The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
C#	409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
C#	411	Weaknesses in this category are related to improper handling of locks that are used to control access to resources.
C#	435	An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.
C#	436	Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
C#	438	Weaknesses in this category are related to unexpected behaviors from code that an application uses.
C#	442	This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C#	452	Weaknesses in this category occur in behaviors that are used for initialization and breakdown.
C#	459	The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
C#	465	Weaknesses in this category are related to improper handling of pointers.
C#	470	The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
C#	476	A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
C#	480	The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.
C#	483	The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.
C#	485	This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."
C#	489	The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
C#	497	The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
C#	502	The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
C#	505	This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.
C#	519	This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C#	522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
C#	523	Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
C#	532	Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
C#	536	A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.
C#	538	The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
C#	539	The web application uses persistent cookies, but the cookies contain sensitive information.
C#	540	Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.
C#	543	The product uses the singleton pattern when creating a resource within a multithreaded environment.
C#	550	Certain conditions, such as network failure, will cause a server error message to be displayed.
C#	552	The product makes files or directories accessible to unauthorized actors, even though they should not be.
C#	557	Weaknesses in this category are related to concurrent use of shared resources.
C#	558	The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.
C#	559	This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C#	561	The product contains dead code, which can never be executed.
C#	563	The variable's value is assigned but never used, making it a dead store.
C#	566	The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
C#	567	The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.
C#	569	Weaknesses in this category are related to incorrectly written expressions within code.
C#	570	The product contains an expression that will always evaluate to false.
C#	573	The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.
C#	595	The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.
C#	601	A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
C#	610	The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
C#	611	The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
C#	614	The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.
C#	615	While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.
C#	624	The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.
C#	628	The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.
C#	629	CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
C#	632	This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
C#	633	This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
C#	634	This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
C#	635	CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.
C#	639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
C#	642	The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
C#	643	The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
C#	644	The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
C#	657	The product violates well-established principles for secure design.
C#	662	The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
C#	663	The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.
C#	664	The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
C#	667	The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
C#	668	The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
C#	669	The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
C#	670	The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
C#	671	The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.
C#	674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
C#	682	The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
C#	683	The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
C#	691	The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
C#	692	The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
C#	693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
C#	697	The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
C#	699	This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.
C#	700	This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.
C#	703	The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
C#	705	The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.
C#	706	The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
C#	707	The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
C#	710	The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
C#	711	CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
C#	712	Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.
C#	713	Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.
C#	714	Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.
C#	715	Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.
C#	716	Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.
C#	717	Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.
C#	718	Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.
C#	719	Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.
C#	720	Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.
C#	721	Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.
C#	722	Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.
C#	723	Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.
C#	724	Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.
C#	725	Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.
C#	727	Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.
C#	728	Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.
C#	729	Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.
C#	730	Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.
C#	731	Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.
C#	732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
C#	734	CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.
C#	736	Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008).
C#	737	Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).
C#	738	Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).
C#	739	Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008).
C#	741	Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).
C#	742	Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).
C#	743	Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).
C#	744	Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).
C#	745	Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) chapter of the CERT C Secure Coding Standard (2008).
C#	746	Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).
C#	747	Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).
C#	748	Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).
C#	749	The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
C#	750	CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.
C#	751	Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.
C#	752	Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.
C#	753	Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.
C#	755	The product does not handle or incorrectly handles an exceptional condition.
C#	759	The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
C#	760	The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.
C#	776	The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
C#	778	When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.
C#	783	The product uses an expression in which operator precedence causes incorrect logic to be used.
C#	798	The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
C#	800	CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.
C#	801	Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.
C#	802	Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.
C#	803	Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.
C#	808	Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.
C#	809	CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
C#	810	Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.
C#	811	Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.
C#	812	Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.
C#	813	Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.
C#	814	Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.
C#	815	Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.
C#	816	Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.
C#	817	Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.
C#	818	Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.
C#	819	Weaknesses in this category are related to the A10 category in the OWASP Top 10 2010.
C#	820	The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
C#	827	The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
C#	829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
C#	833	The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
C#	834	The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
C#	835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
C#	840	Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
C#	844	CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.
C#	845	Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	847	Weaknesses in this category are related to rules in the Expressions (EXP) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	848	Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	850	Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	851	Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	852	Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	853	Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	854	Weaknesses in this category are related to rules in the Thread APIs (THI) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	855	Weaknesses in this category are related to rules in the Thread Pools (TPS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	857	Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	858	Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	859	Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	860	Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	861	Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C#	862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
C#	863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Apex

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Apex

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Apex

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

Apex

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Apex

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Apex

77

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Apex

79

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Apex

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Apex

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Apex

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

Apex

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

Apex

199

Weaknesses in this category are related to improper handling of sensitive information.

Apex

227

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."

Apex

242

The product calls a function that can never be guaranteed to work safely.

Apex

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Apex

255

Weaknesses in this category are related to the management of credentials.

Apex

259

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Apex

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Apex

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

Apex

269

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Apex

274

The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.

Apex

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Apex

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Apex

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Apex

311

The product does not encrypt sensitive or critical information before storage or transmission.

Apex

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Apex

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

Apex

321

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

Apex

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Apex

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

Apex

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Apex

352

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Apex

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

Apex

388

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

Apex

389

This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.

Apex

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Apex

601

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Apex

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Apex

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Apex

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Apex

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

Apex

657

The product violates well-established principles for secure design.

Apex

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Apex

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

Apex

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Apex

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Apex

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

Apex

703

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Apex

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

Apex

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Apex

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Apex

712

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.

Apex

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

Apex

716

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.

Apex

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

Apex

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

Apex

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

Apex

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

Apex

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

Apex

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

Apex

725

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.

Apex

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

Apex

728

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.

Apex

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

Apex

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

Apex

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

Apex

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

Apex

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

Apex

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

Apex

748

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).

Apex

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Apex

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

Apex

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

Apex

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Apex

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Apex

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

Apex

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

Apex

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Apex

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Apex

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

Apex

811

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.

Apex

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

Apex

814

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.

Apex

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

Apex

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

Apex

819

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2010.

Apex

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

Apex

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Apex

851

Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Apex

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Apex

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Apex

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Apex

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Apex

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Apex

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Apex

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

Apex

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Apex

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Apex

880

Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Apex

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Apex

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

Apex

887

This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

Apex

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

Apex

889

This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

Apex

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

Apex

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

Apex

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

Apex

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

Apex

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

Apex

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

Apex

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Apex

901

This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36).

Apex

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

Apex

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

Apex

917

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Apex

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Apex

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

Apex

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

Apex

931

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2013.

Apex

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

Apex

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

Apex

936

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2013.

Apex

938

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2013.

Apex

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Apex

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

Apex

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

Apex

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

Apex

950

This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).

Apex

961

This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).

Apex

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

Apex

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

Apex

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

Apex

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

Apex

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

Apex

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

Apex

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

Apex

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

Apex

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

Apex

1001

This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).

Apex

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

Apex

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

Apex

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

Apex

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

Apex

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Apex

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

Apex

1012

Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.

Apex

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

Apex

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

Apex

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Apex

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

Apex

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

Apex

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

Apex

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

Apex

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

Apex

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

Apex

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

Apex

1033

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2017.

Apex

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

Apex

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

Apex

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

Apex

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

Apex

1141

Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.

Apex

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

Apex

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

Apex

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

Apex

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

Apex

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

Apex

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

Apex

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

Apex

1171

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard.

Apex

1172

Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.

Apex

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

Apex

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

Apex

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Apex

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

Apex

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

Apex

1213

Weaknesses in this category are related to a software system's random number generation.

Apex

1228

Weaknesses in this category are related to the use of built-in functions or external APIs.

Apex

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

Apex

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

Apex

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

Apex

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

Apex

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

Apex

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

Apex

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

Apex

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

Apex

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

Apex

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

Apex

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

Apex

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

Apex

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

Apex

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Apex

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Apex

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Apex

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Apex

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Apex

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Apex

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Apex

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Apex

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Apex

1373

Weaknesses in this category are related to the "Trust Model Problems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Assumptions made about the user during the design or construction phase may result in vulnerabilities after the system is installed if the user operates it using a different security approach or process than what was designed or built." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Apex

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Apex

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Apex

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Apex

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

Apex

1396

Weaknesses in this category are related to access control.

Apex

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

Apex

1402

Weaknesses in this category are related to encryption.

Apex

1405

Weaknesses in this category are related to improper check or handling of exceptional conditions.

Apex

1406

Weaknesses in this category are related to improper input validation.

Apex

1407

Weaknesses in this category are related to improper neutralization.

Apex

1409

Weaknesses in this category are related to injection.

Apex

1411

Weaknesses in this category are related to insufficient verification of data authenticity.

Apex

1412

Weaknesses in this category are related to poor coding practices.

Apex

1413

Weaknesses in this category are related to protection mechanism failure.

Apex

1414

Weaknesses in this category are related to randomness.

Apex

1416

Weaknesses in this category are related to resource lifecycle management.

Apex

1418

Weaknesses in this category are related to violation of secure design principles.

C#

2

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

C#

4

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C#

5

Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

C#

10

This category has been deprecated. It added unnecessary depth and complexity to its associated views.

C#

11

Debugging messages help attackers learn about the system and plan a form of attack.

C#

16

Weaknesses in this category are typically introduced during the configuration of the software.

C#

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C#

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C#

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

C#

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

C#

21

This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).

C#

22

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

C#

23

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

C#

36

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

C#

73

The product allows user input to control or influence paths or file names that are used in filesystem operations.

C#

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

C#

77

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

C#

78

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

C#

79

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

C#

80

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

C#

82

The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

C#

83

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

C#

85

The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.

C#

86

The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

C#

87

The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

C#

88

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

C#

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

C#

90

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

C#

91

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

C#

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

C#

95

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

C#

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

C#

117

The product does not neutralize or incorrectly neutralizes output that is written to logs.

C#

133

Weaknesses in this category are related to the creation and modification of strings.

C#

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

C#

138

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

C#

140

The product does not neutralize or incorrectly neutralizes delimiters.

C#

141

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

C#

142

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

C#

143

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.

C#

146

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

C#

149

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

C#

150

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

C#

157

The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.

C#

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

C#

183

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

C#

189

Weaknesses in this category are related to improper calculation or conversion of numbers.

C#

190

The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

C#

199

Weaknesses in this category are related to improper handling of sensitive information.

C#

200

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

C#

201

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

C#

209

The product generates an error message that includes sensitive information about its environment, users, or associated data.

C#

210

The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

C#

211

The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

C#

215

The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

C#

221

The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

C#

223

The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

C#

226

The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

C#

227

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."

C#

248

An exception is thrown from a function, but it is not caught.

C#

249

This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.

C#

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

C#

255

Weaknesses in this category are related to the management of credentials.

C#

256

Storing a password in plaintext may result in a system compromise.

C#

257

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

C#

259

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

C#

260

The product stores a password in a configuration file that might be accessible to actors who do not know the password.

C#

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

C#

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

C#

275

Weaknesses in this category are related to improper assignment or handling of permissions.

C#

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

C#

285

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

C#

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

C#

295

The product does not validate, or incorrectly validates, a certificate.

C#

296

The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

C#

299

The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

C#

300

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

C#

304

The product implements an authentication technique, but it skips a step that weakens the technique.

C#

306

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

C#

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

C#

311

The product does not encrypt sensitive or critical information before storage or transmission.

C#

312

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

C#

313

The product stores sensitive information in cleartext in a file, or on disk.

C#

314

The product stores sensitive information in cleartext in the registry.

C#

315

The product stores sensitive information in cleartext in a cookie.

C#

317

The product stores sensitive information in cleartext within the GUI.

C#

318

The product stores sensitive information in cleartext in an executable.

C#

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

C#

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

C#

321

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

C#

326

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

C#

327

The product uses a broken or risky cryptographic algorithm or protocol.

C#

328

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

C#

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

C#

338

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

C#

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

C#

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

C#

352

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

C#

353

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

C#

355

Weaknesses in this category are related to or introduced in the User Interface (UI).

C#

359

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

C#

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

C#

362

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

C#

366

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

C#

369

The product divides a value by zero.

C#

371

Weaknesses in this category are related to improper management of system state.

C#

380

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C#

381

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C#

388

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

C#

389

This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.

C#

390

The product detects a specific error, but takes no actions to handle the error.

C#

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

C#

399

Weaknesses in this category are related to improper management of system resources.

C#

402

The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.

C#

403

A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.

C#

404

The product does not release or incorrectly releases a resource before it is made available for re-use.

C#

405

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

C#

409

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

C#

411

Weaknesses in this category are related to improper handling of locks that are used to control access to resources.

C#

435

An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

C#

436

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

C#

438

Weaknesses in this category are related to unexpected behaviors from code that an application uses.

C#

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C#

452

Weaknesses in this category occur in behaviors that are used for initialization and breakdown.

C#

459

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

C#

465

Weaknesses in this category are related to improper handling of pointers.

C#

470

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

C#

476

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

C#

480

The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

C#

483

The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.

C#

485

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

C#

489

The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

C#

497

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

C#

502

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

C#

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

C#

519

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C#

522

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

C#

523

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

C#

532

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

C#

536

A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.

C#

538

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

C#

539

The web application uses persistent cookies, but the cookies contain sensitive information.

C#

540

Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.

C#

543

The product uses the singleton pattern when creating a resource within a multithreaded environment.

C#

550

Certain conditions, such as network failure, will cause a server error message to be displayed.

C#

552

The product makes files or directories accessible to unauthorized actors, even though they should not be.

C#

557

Weaknesses in this category are related to concurrent use of shared resources.

C#

558

The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.

C#

559

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C#

561

The product contains dead code, which can never be executed.

C#

563

The variable's value is assigned but never used, making it a dead store.

C#

566

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

C#

567

The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.

C#

569

Weaknesses in this category are related to incorrectly written expressions within code.

C#

570

The product contains an expression that will always evaluate to false.

C#

573

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

C#

595

The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.

C#

601

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

C#

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

C#

611

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

C#

614

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

C#

615

While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.

C#

624

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

C#

628

The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

C#

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

C#

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

C#

633

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

C#

634

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

C#

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

C#

639

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

C#

642

The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.

C#

643

The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

C#

644

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

C#

657

The product violates well-established principles for secure design.

C#

662

The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

C#

663

The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.

C#

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

C#

667

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

C#

668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

C#

669

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

C#

670

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

C#

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

C#

674

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

C#

682

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

C#

683

The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.

C#

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

C#

692

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

C#

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

C#

697

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

C#

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

C#

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

C#

703

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

C#

705

The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.

C#

706

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

C#

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

C#

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

C#

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

C#

712

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.

C#

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

C#

714

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.

C#

715

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.

C#

716

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.

C#

717

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.

C#

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

C#

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

C#

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

C#

721

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.

C#

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

C#

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

C#

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

C#

725

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.

C#

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

C#

728

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.

C#

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

C#

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

C#

731

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.

C#

732

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

C#

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

C#

736

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008).

C#

737

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).

C#

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

C#

739

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008).

C#

741

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).

C#

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

C#

743

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

C#

744

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).

C#

745

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) chapter of the CERT C Secure Coding Standard (2008).

C#

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

C#

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

C#

748

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).

C#

749

The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

C#

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

C#

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

C#

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

C#

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

C#

755

The product does not handle or incorrectly handles an exceptional condition.

C#

759

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

C#

760

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.

C#

776

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

C#

778

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

C#

783

The product uses an expression in which operator precedence causes incorrect logic to be used.

C#

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

C#

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

C#

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

C#

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

C#

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

C#

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

C#

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

C#

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

C#

811

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.

C#

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

C#

813

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.

C#

814

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.

C#

815

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.

C#

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

C#

817

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.

C#

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

C#

819

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2010.

C#

820

The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

C#

827

The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.

C#

829

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

C#

833

The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

C#

834

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

C#

835

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

C#

840

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

C#

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

C#

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

847

Weaknesses in this category are related to rules in the Expressions (EXP) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

848

Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

850

Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

851

Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

852

Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

853

Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

854

Weaknesses in this category are related to rules in the Thread APIs (THI) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

855

Weaknesses in this category are related to rules in the Thread Pools (TPS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

857

Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

860

Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C#

862

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

C#

863

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

C#

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

C#

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

C#

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

C#

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

C#

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

C#

871

Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C#

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C#

873

Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C#

875

Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C#

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C#

877

Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C#

878

Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C#

879

Weaknesses in this category are related to rules in the Signals (SIG) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C#

880

Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C#

881

Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C#

882

Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C#

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C#

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

C#

885

This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

C#

886

This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).

C#

887

This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

C#

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

C#

889

This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

C#

890

This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).

C#

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

C#

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

C#

894

This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22).

C#

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

C#

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

C#

897

This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28).

C#

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

C#

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

C#

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

C#

902

This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

C#

903

This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

C#

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

C#

906

This category identifies Software Fault Patterns (SFPs) within the UI cluster.

C#

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

C#

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

C#

916

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

C#

922

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

C#

923

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

C#

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

C#

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

C#

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

C#

931

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2013.

C#

932

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.

C#

933

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.

C#

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

C#

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

C#

936

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2013.

C#

938

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2013.

C#

942

The product uses a cross-domain policy file that includes domains that should not be trusted.

C#

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

C#

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

C#

945

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).

C#

946

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster.

C#

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

C#

948

This category identifies Software Fault Patterns (SFPs) within the Digital Certificate cluster.

C#

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

C#

950

This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).

C#

952

This category identifies Software Fault Patterns (SFPs) within the Missing Authentication cluster.

C#

956

This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.

C#

957

This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.

C#

958

This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.

C#

959

This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.

C#

961

This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).

C#

962

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

C#

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

C#

966

This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.

C#

971

This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).

C#

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

C#

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

C#

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

C#

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

C#

981

This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).

C#

982

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).

C#

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

C#

985

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).

C#

986

This category identifies Software Fault Patterns (SFPs) within the Missing Lock cluster (SFP19).

C#

988

This category identifies Software Fault Patterns (SFPs) within the Race Condition Window cluster (SFP20).

C#

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

C#

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

C#

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

C#

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

C#

997

This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster.

C#

998

This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).

C#

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

C#

1001

This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).

C#

1002

This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster.

C#

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

C#

1004

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

C#

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

C#

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

C#

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

C#

1009

Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.

C#

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

C#

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

C#

1012

Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.

C#

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

C#

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

C#

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

C#

1016

Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.

C#

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

C#

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

C#

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

C#

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

C#

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

C#

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

C#

1030

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2017.

C#

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

C#

1032

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.

C#

1033

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2017.

C#

1034

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2017.

C#

1036

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2017.

C#

1041

The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

C#

1078

The source code does not follow desired style or formatting for indentation, white space, comments, etc.

C#

1114

The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.

C#

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

C#

1129

Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software.

C#

1130

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.

C#

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

C#

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

C#

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

C#

1136

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.

C#

1137

Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java.

C#

1140

Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

C#

1141

Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.

C#

1142

Weaknesses in this category are related to the rules and recommendations in the Visibility and Atomicity (VNA) section of the SEI CERT Oracle Secure Coding Standard for Java.

C#

1143

Weaknesses in this category are related to the rules and recommendations in the Locking (LCK) section of the SEI CERT Oracle Secure Coding Standard for Java.

C#

1145

Weaknesses in this category are related to the rules and recommendations in the Thread Pools (TPS) section of the SEI CERT Oracle Secure Coding Standard for Java.

C#

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

C#

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

C#

1149

Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.

C#

1150

Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java.

C#

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

C#

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

C#

1157

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.

C#

1158

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard.

C#

1159

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard.

C#

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

C#

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

C#

1164

The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.

C#

1165

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.

C#

1166

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) section of the SEI CERT C Coding Standard.

C#

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

C#

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

C#

1171

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard.

C#

1172

Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.

C#

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

C#

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

C#

1180

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard.

C#

1181

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.

C#

1182

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard.

C#

1186

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.

C#

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

C#

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

C#

1202

Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).

C#

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

C#

1210

Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.

C#

1211

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

C#

1212

Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.

C#

1213

Weaknesses in this category are related to a software system's random number generation.

C#

1214

Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.

C#

1215

Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.

C#

1219

Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.

C#

1228

Weaknesses in this category are related to the use of built-in functions or external APIs.

C#

1275

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

C#

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

C#

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

C#

1307

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.

C#

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

C#

1309

Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.

C#

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

C#

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

C#

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

C#

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

C#

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

C#

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

C#

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

C#

1349

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.

C#

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

C#

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

C#

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

C#

1355

Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top 10 2021.

C#

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C#

1359

Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

C#

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

C#

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

C#

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

C#

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

C#

1364

Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C#

1366

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C#

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C#

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C#

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C#

1371

Weaknesses in this category are related to the "Poorly Documented or Undocumented Features" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Undocumented capabilities and configurations pose a risk by not having a clear understanding of what the device is specifically supposed to do and only do. Therefore possibly opening up the attack surface and vulnerabilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C#

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C#

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C#

1376

Weaknesses in this category are related to the "Security Gaps in Commissioning" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "As a large system is brought online components of the system may remain vulnerable until the entire system is operating and functional and security controls are put in place. This creates a window of opportunity for an adversary during the commissioning process." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C#

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C#

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C#

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

C#

1396

Weaknesses in this category are related to access control.

C#

1397

Weaknesses in this category are related to comparison.

C#

1398

Weaknesses in this category are related to component interaction.

C#

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

C#

1401

Weaknesses in this category are related to concurrency.

C#

1402

Weaknesses in this category are related to encryption.

C#

1403

Weaknesses in this category are related to exposed resource.

C#

1404

Weaknesses in this category are related to file handling.

C#

1405

Weaknesses in this category are related to improper check or handling of exceptional conditions.

C#

1406

Weaknesses in this category are related to improper input validation.

C#

1407

Weaknesses in this category are related to improper neutralization.

C#

1408

Weaknesses in this category are related to incorrect calculation.

C#

1409

Weaknesses in this category are related to injection.

C#

1410

Weaknesses in this category are related to insufficient control flow management.

C#

1411

Weaknesses in this category are related to insufficient verification of data authenticity.

C#

1412

Weaknesses in this category are related to poor coding practices.

C#

1413

Weaknesses in this category are related to protection mechanism failure.

C#

1414

Weaknesses in this category are related to randomness.

C#

1415

Weaknesses in this category are related to resource control.

C#

1416

Weaknesses in this category are related to resource lifecycle management.

C#

1417

Weaknesses in this category are related to sensitive information exposure.

C#

1418

Weaknesses in this category are related to violation of secure design principles.

C/C++

2

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

C/C++

4

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C/C++

5

Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

C/C++

14

Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal."

C/C++

16

Weaknesses in this category are typically introduced during the configuration of the software.

C/C++

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C/C++

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C/C++

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

C/C++

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

C/C++

21

This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).

C/C++

22

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

C/C++

23

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

C/C++

36

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

C/C++

59

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

C/C++

66

The product does not handle or incorrectly handles a file name that identifies a "virtual" resource that is not directly specified within the directory that is associated with the file name, causing the product to perform file-based operations on a resource that is not a file.

C/C++

67

The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.

C/C++

68

This category has been deprecated as it was found to be an unnecessary abstraction of platform specific details. Please refer to the category CWE-632 and weakness CWE-66 for relevant relationships.

C/C++

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

C/C++

77

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

C/C++

78

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

C/C++

88

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

C/C++

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

C/C++

91

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

C/C++

93

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

C/C++

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

C/C++

99

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

C/C++

113

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

C/C++

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

C/C++

117

The product does not neutralize or incorrectly neutralizes output that is written to logs.

C/C++

118

The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

C/C++

119

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

C/C++

120

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

C/C++

121

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

C/C++

122

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

C/C++

123

Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.

C/C++

124

The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

C/C++

125

The product reads data past the end, or before the beginning, of the intended buffer.

C/C++

126

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

C/C++

127

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.

C/C++

128

Wrap around errors occur whenever a value is incremented past the maximum value for its type and therefore "wraps around" to a very small, negative, or undefined value.

C/C++

129

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

C/C++

130

The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

C/C++

131

The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

C/C++

133

Weaknesses in this category are related to the creation and modification of strings.

C/C++

134

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

C/C++

135

The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.

C/C++

136

Weaknesses in this category are caused by improper data type transformation or improper handling of multiple data types.

C/C++

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

C/C++

138

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

C/C++

140

The product does not neutralize or incorrectly neutralizes delimiters.

C/C++

141

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

C/C++

142

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

C/C++

143

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.

C/C++

146

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

C/C++

149

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

C/C++

150

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

C/C++

157

The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.

C/C++

169

This category has been deprecated. It was originally intended as a "catch-all" for input validation problems in technologies that did not have their own CWE, but introduces unnecessary depth to the hierarchy.

C/C++

170

The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

C/C++

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

C/C++

187

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

C/C++

188

The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior.

C/C++

189

Weaknesses in this category are related to improper calculation or conversion of numbers.

C/C++

190

The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

C/C++

191

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

C/C++

192

Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.

C/C++

193

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

C/C++

194

The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.

C/C++

195

The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.

C/C++

197

Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

C/C++

198

The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used.

C/C++

199

Weaknesses in this category are related to improper handling of sensitive information.

C/C++

200

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

C/C++

201

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

C/C++

209

The product generates an error message that includes sensitive information about its environment, users, or associated data.

C/C++

210

The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

C/C++

211

The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

C/C++

216

This entry has been deprecated, as it was not effective as a weakness and was structured more like a category. In addition, the name is inappropriate, since the "container" term is widely understood by developers in different ways than originally intended by PLOVER, the original source for this entry.

C/C++

221

The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

C/C++

226

The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

C/C++

227

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."

C/C++

228

The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.

C/C++

237

The product does not handle or incorrectly handles inputs that are related to complex structures.

C/C++

240

The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.

C/C++

241

The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).

C/C++

242

The product calls a function that can never be guaranteed to work safely.

C/C++

243

The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.

C/C++

244

Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.

C/C++

247

This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.

C/C++

248

An exception is thrown from a function, but it is not caught.

C/C++

249

This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.

C/C++

252

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

C/C++

253

The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.

C/C++

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

C/C++

255

Weaknesses in this category are related to the management of credentials.

C/C++

256

Storing a password in plaintext may result in a system compromise.

C/C++

257

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

C/C++

259

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

C/C++

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

C/C++

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

C/C++

269

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

C/C++

271

The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.

C/C++

272

The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

C/C++

273

The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

C/C++

275

Weaknesses in this category are related to improper assignment or handling of permissions.

C/C++

276

During installation, installed file permissions are set to allow anyone to modify those files.

C/C++

282

The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.

C/C++

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

C/C++

285

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

C/C++

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

C/C++

290

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

C/C++

291

The product uses an IP address for authentication.

C/C++

293

The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.

C/C++

300

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

C/C++

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

C/C++

311

The product does not encrypt sensitive or critical information before storage or transmission.

C/C++

312

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

C/C++

313

The product stores sensitive information in cleartext in a file, or on disk.

C/C++

314

The product stores sensitive information in cleartext in the registry.

C/C++

315

The product stores sensitive information in cleartext in a cookie.

C/C++

317

The product stores sensitive information in cleartext within the GUI.

C/C++

318

The product stores sensitive information in cleartext in an executable.

C/C++

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

C/C++

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

C/C++

321

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

C/C++

326

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

C/C++

327

The product uses a broken or risky cryptographic algorithm or protocol.

C/C++

328

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

C/C++

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

C/C++

335

The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

C/C++

336

A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.

C/C++

337

A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.

C/C++

338

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

C/C++

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

C/C++

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

C/C++

350

The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.

C/C++

353

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

C/C++

355

Weaknesses in this category are related to or introduced in the User Interface (UI).

C/C++

359

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

C/C++

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

C/C++

362

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

C/C++

363

The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.

C/C++

364

The product uses a signal handler that introduces a race condition.

C/C++

366

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

C/C++

367

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

C/C++

369

The product divides a value by zero.

C/C++

376

This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. Consider using the File Handling Issues category (CWE-1219).

C/C++

377

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

C/C++

379

The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

C/C++

380

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C/C++

381

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C/C++

387

Weaknesses in this category are related to the improper handling of signals.

C/C++

388

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

C/C++

389

This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.

C/C++

391

[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.

C/C++

393

A function or operation returns an incorrect return value or status code that does not indicate an error, but causes the product to modify its behavior based on the incorrect result.

C/C++

394

The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.

C/C++

396

Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.

C/C++

397

Throwing overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.

C/C++

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

C/C++

399

Weaknesses in this category are related to improper management of system resources.

C/C++

400

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

C/C++

401

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

C/C++

404

The product does not release or incorrectly releases a resource before it is made available for re-use.

C/C++

411

Weaknesses in this category are related to improper handling of locks that are used to control access to resources.

C/C++

415

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

C/C++

416

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

C/C++

417

Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.

C/C++

427

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

C/C++

429

Weaknesses in this category are related to improper management of handlers.

C/C++

435

An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

C/C++

438

Weaknesses in this category are related to unexpected behaviors from code that an application uses.

C/C++

441

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

C/C++

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C/C++

452

Weaknesses in this category occur in behaviors that are used for initialization and breakdown.

C/C++

456

The product does not initialize critical variables, which causes the execution environment to use unexpected values.

C/C++

457

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

C/C++

459

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

C/C++

460

The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.

C/C++

461

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C/C++

464

The accidental addition of a data-structure sentinel can cause serious programming logic problems.

C/C++

465

Weaknesses in this category are related to improper handling of pointers.

C/C++

467

The code calls sizeof() on a malloced pointer type, which always returns the wordsize/8. This can produce an unexpected result if the programmer intended to determine how much memory has been allocated.

C/C++

468

In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.

C/C++

469

The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.

C/C++

471

The product does not properly protect an assumed-immutable element from being modified by an attacker.

C/C++

475

The behavior of this function is undefined unless its control parameter is set to a specific value.

C/C++

476

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

C/C++

477

The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.

C/C++

478

The code does not have a default case in an expression with multiple conditions, such as a switch statement.

C/C++

479

The product defines a signal handler that calls a non-reentrant function.

C/C++

480

The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

C/C++

481

The code uses an operator for assignment when the intention was to perform a comparison.

C/C++

482

The code uses an operator for comparison when the intention was to perform an assignment.

C/C++

483

The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.

C/C++

484

The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.

C/C++

485

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

C/C++

489

The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

C/C++

490

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C/C++

493

The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.

C/C++

497

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

C/C++

500

An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.

C/C++

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

C/C++

522

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

C/C++

523

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

C/C++

526

The product uses an environment variable to store unencrypted sensitive information.

C/C++

528

The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.

C/C++

532

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

C/C++

535

A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system.

C/C++

536

A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.

C/C++

538

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

C/C++

539

The web application uses persistent cookies, but the cookies contain sensitive information.

C/C++

543

The product uses the singleton pattern when creating a resource within a multithreaded environment.

C/C++

547

The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.

C/C++

550

Certain conditions, such as network failure, will cause a server error message to be displayed.

C/C++

552

The product makes files or directories accessible to unauthorized actors, even though they should not be.

C/C++

557

Weaknesses in this category are related to concurrent use of shared resources.

C/C++

558

The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.

C/C++

559

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

C/C++

561

The product contains dead code, which can never be executed.

C/C++

562

A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.

C/C++

563

The variable's value is assigned but never used, making it a dead store.

C/C++

566

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

C/C++

567

The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.

C/C++

569

Weaknesses in this category are related to incorrectly written expressions within code.

C/C++

570

The product contains an expression that will always evaluate to false.

C/C++

571

The product contains an expression that will always evaluate to true.

C/C++

573

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

C/C++

590

The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().

C/C++

592

This weakness has been deprecated because it covered redundant concepts already described in CWE-287.

C/C++

595

The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.

C/C++

597

The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.

C/C++

606

The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

C/C++

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

C/C++

617

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

C/C++

628

The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

C/C++

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

C/C++

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

C/C++

633

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

C/C++

634

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

C/C++

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

C/C++

637

The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the mechanism is not correctly understood, modeled, configured, implemented, or used.

C/C++

639

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

C/C++

643

The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

C/C++

644

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

C/C++

655

The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.

C/C++

657

The product violates well-established principles for secure design.

C/C++

662

The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

C/C++

663

The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.

C/C++

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

C/C++

665

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

C/C++

666

The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.

C/C++

667

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

C/C++

668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

C/C++

669

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

C/C++

670

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

C/C++

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

C/C++

672

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

C/C++

674

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

C/C++

675

The product performs the same operation on a resource two or more times, when the operation should only be applied once.

C/C++

676

The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.

C/C++

680

The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.

C/C++

681

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

C/C++

682

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

C/C++

683

The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.

C/C++

684

The code does not function according to its published specifications, potentially leading to incorrect usage.

C/C++

685

The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses.

C/C++

686

The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses.

C/C++

687

The product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses.

C/C++

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

C/C++

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

C/C++

694

The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

C/C++

696

The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways which may produce resultant weaknesses.

C/C++

697

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

C/C++

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

C/C++

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

C/C++

703

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

C/C++

704

The product does not correctly convert an object, resource, or structure from one type to a different type.

C/C++

705

The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.

C/C++

706

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

C/C++

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

C/C++

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

C/C++

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

C/C++

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

C/C++

714

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.

C/C++

715

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.

C/C++

717

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.

C/C++

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

C/C++

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

C/C++

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

C/C++

721

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.

C/C++

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

C/C++

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

C/C++

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

C/C++

725

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.

C/C++

726

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2004.

C/C++

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

C/C++

728

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.

C/C++

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

C/C++

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

C/C++

731

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.

C/C++

732

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

C/C++

733

The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.

C/C++

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

C/C++

735

Weaknesses in this category are related to the rules and recommendations in the Preprocessor (PRE) chapter of the CERT C Secure Coding Standard (2008).

C/C++

736

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008).

C/C++

737

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).

C/C++

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

C/C++

739

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008).

C/C++

740

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008).

C/C++

741

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).

C/C++

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

C/C++

743

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

C/C++

744

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).

C/C++

745

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) chapter of the CERT C Secure Coding Standard (2008).

C/C++

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

C/C++

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

C/C++

748

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).

C/C++

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

C/C++

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

C/C++

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

C/C++

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

C/C++

754

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

C/C++

755

The product does not handle or incorrectly handles an exceptional condition.

C/C++

758

The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.

C/C++

759

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

C/C++

760

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.

C/C++

762

The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.

C/C++

763

The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.

C/C++

764

The product locks a critical resource more times than intended, leading to an unexpected state in the system.

C/C++

765

The product unlocks a critical resource more times than intended, leading to an unexpected state in the system.

C/C++

769

This entry has been deprecated because it was a duplicate of CWE-774. All content has been transferred to CWE-774.

C/C++

770

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

C/C++

771

The product does not properly maintain a reference to a resource that has been allocated, which prevents the resource from being reclaimed.

C/C++

772

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

C/C++

775

The product does not release a file descriptor or handle after its effective lifetime has ended, i.e., after the file descriptor/handle is no longer needed.

C/C++

783

The product uses an expression in which operator precedence causes incorrect logic to be used.

C/C++

786

The product reads or writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

C/C++

787

The product writes data past the end, or before the beginning, of the intended buffer.

C/C++

788

The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.

C/C++

789

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

C/C++

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

C/C++

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

C/C++

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

C/C++

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

C/C++

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

C/C++

805

The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.

C/C++

806

The product uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.

C/C++

807

The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

C/C++

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

C/C++

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

C/C++

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

C/C++

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

C/C++

813

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.

C/C++

815

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.

C/C++

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

C/C++

817

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.

C/C++

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

C/C++

820

The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

C/C++

823

The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.

C/C++

824

The product accesses or uses a pointer that has not been initialized.

C/C++

825

The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

C/C++

828

The product defines a signal handler that contains code sequences that are not asynchronous-safe, i.e., the functionality is not reentrant, or it can be interrupted.

C/C++

833

The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

C/C++

834

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

C/C++

835

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

C/C++

839

The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.

C/C++

840

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

C/C++

843

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

C/C++

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

C/C++

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

846

Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

847

Weaknesses in this category are related to rules in the Expressions (EXP) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

848

Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

849

Weaknesses in this category are related to rules in the Object Orientation (OBJ) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

850

Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

851

Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

852

Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

853

Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

854

Weaknesses in this category are related to rules in the Thread APIs (THI) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

857

Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

860

Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

C/C++

862

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

C/C++

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

C/C++

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

C/C++

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

C/C++

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

C/C++

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

C/C++

871

Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C/C++

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C/C++

873

Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C/C++

874

Weaknesses in this category are related to rules in the Arrays and the STL (ARR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C/C++

875

Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C/C++

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C/C++

877

Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C/C++

878

Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C/C++

879

Weaknesses in this category are related to rules in the Signals (SIG) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C/C++

880

Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C/C++

881

Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C/C++

882

Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C/C++

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

C/C++

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

C/C++

885

This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

C/C++

886

This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).

C/C++

887

This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

C/C++

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

C/C++

889

This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

C/C++

890

This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).

C/C++

891

This category identifies Software Fault Patterns (SFPs) within the Memory Management cluster (SFP38).

C/C++

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

C/C++

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

C/C++

894

This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22).

C/C++

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

C/C++

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

C/C++

897

This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28).

C/C++

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

C/C++

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

C/C++

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

C/C++

901

This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36).

C/C++

902

This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

C/C++

903

This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

C/C++

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

C/C++

906

This category identifies Software Fault Patterns (SFPs) within the UI cluster.

C/C++

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

C/C++

908

The product uses or accesses a resource that has not been initialized.

C/C++

909

The product does not initialize a critical resource.

C/C++

910

The product uses or accesses a file descriptor after it has been closed.

C/C++

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

C/C++

916

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

C/C++

918

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

C/C++

922

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

C/C++

923

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

C/C++

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

C/C++

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

C/C++

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

C/C++

932

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.

C/C++

933

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.

C/C++

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

C/C++

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

C/C++

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

C/C++

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

C/C++

945

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).

C/C++

946

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster.

C/C++

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

C/C++

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

C/C++

950

This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).

C/C++

956

This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.

C/C++

957

This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.

C/C++

958

This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.

C/C++

959

This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.

C/C++

960

This category identifies Software Fault Patterns (SFPs) within the Ambiguous Exception Type cluster (SFP5).

C/C++

961

This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).

C/C++

962

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

C/C++

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

C/C++

964

This category identifies Software Fault Patterns (SFPs) within the Exposure Temporary File cluster.

C/C++

966

This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.

C/C++

969

This category identifies Software Fault Patterns (SFPs) within the Faulty Memory Release cluster (SFP12).

C/C++

970

This category identifies Software Fault Patterns (SFPs) within the Faulty Buffer Access cluster (SFP8).

C/C++

971

This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).

C/C++

973

This category identifies Software Fault Patterns (SFPs) within the Improper NULL Termination cluster (SFP11).

C/C++

974

This category identifies Software Fault Patterns (SFPs) within the Incorrect Buffer Length Computation cluster (SFP10).

C/C++

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

C/C++

976

This category identifies Software Fault Patterns (SFPs) within the Compiler cluster.

C/C++

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

C/C++

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

C/C++

979

This category identifies Software Fault Patterns (SFPs) within the Failed Chroot Jail cluster (SFP17).

C/C++

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

C/C++

981

This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).

C/C++

982

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).

C/C++

983

This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Use cluster (SFP15).

C/C++

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

C/C++

985

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).

C/C++

986

This category identifies Software Fault Patterns (SFPs) within the Missing Lock cluster (SFP19).

C/C++

987

This category identifies Software Fault Patterns (SFPs) within the Multiple Locks/Unlocks cluster (SFP21).

C/C++

988

This category identifies Software Fault Patterns (SFPs) within the Race Condition Window cluster (SFP20).

C/C++

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

C/C++

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

C/C++

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

C/C++

993

This category identifies Software Fault Patterns (SFPs) within the Incorrect Input Handling cluster.

C/C++

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

C/C++

995

This category identifies Software Fault Patterns (SFPs) within the Feature cluster.

C/C++

997

This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster.

C/C++

998

This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).

C/C++

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

C/C++

1001

This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).

C/C++

1002

This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster.

C/C++

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

C/C++

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

C/C++

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

C/C++

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

C/C++

1009

Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.

C/C++

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

C/C++

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

C/C++

1012

Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.

C/C++

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

C/C++

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

C/C++

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

C/C++

1016

Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.

C/C++

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

C/C++

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

C/C++

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

C/C++

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

C/C++

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

C/C++

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

C/C++

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

C/C++

1032

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.

C/C++

1037

The developer builds a security-critical protection mechanism into the software, but the processor optimizes the execution of the program such that the mechanism is removed or modified.

C/C++

1041

The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

C/C++

1045

A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.

C/C++

1055

The product contains a class with inheritance from more than one concrete class.

C/C++

1059

The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc.

C/C++

1061

The product does not sufficiently hide the internal representation and implementation details of data or methods, which might allow external components or modules to modify data unexpectedly, invoke unexpected functionality, or introduce dependencies that the programmer did not intend.

C/C++

1076

The product's architecture, source code, design, documentation, or other artifact does not follow required conventions.

C/C++

1077

The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision.

C/C++

1078

The source code does not follow desired style or formatting for indentation, white space, comments, etc.

C/C++

1079

A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.

C/C++

1095

The product uses a loop with a control flow condition based on a value that is updated within the body of the loop.

C/C++

1108

The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of preserving the associated information in a narrower, more local context.

C/C++

1109

The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data.

C/C++

1113

The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.

C/C++

1114

The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.

C/C++

1126

The source code declares a variable in one scope, but the variable is only used within a narrower scope.

C/C++

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

C/C++

1129

Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software.

C/C++

1130

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.

C/C++

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

C/C++

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

C/C++

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1135

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1136

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1137

Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1139

Weaknesses in this category are related to the rules and recommendations in the Object Orientation (OBJ) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1140

Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1141

Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1142

Weaknesses in this category are related to the rules and recommendations in the Visibility and Atomicity (VNA) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1143

Weaknesses in this category are related to the rules and recommendations in the Locking (LCK) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1149

Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1150

Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

C/C++

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

C/C++

1156

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT C Coding Standard.

C/C++

1157

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.

C/C++

1158

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard.

C/C++

1159

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard.

C/C++

1160

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) section of the SEI CERT C Coding Standard.

C/C++

1161

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT C Coding Standard.

C/C++

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

C/C++

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

C/C++

1164

The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.

C/C++

1165

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.

C/C++

1166

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) section of the SEI CERT C Coding Standard.

C/C++

1167

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) section of the SEI CERT C Coding Standard.

C/C++

1168

Weaknesses in this category are related to the rules and recommendations in the Application Programming Interfaces (API) section of the SEI CERT C Coding Standard.

C/C++

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

C/C++

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

C/C++

1171

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard.

C/C++

1172

Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.

C/C++

1177

The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer.

C/C++

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

C/C++

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

C/C++

1180

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard.

C/C++

1181

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.

C/C++

1182

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard.

C/C++

1185

Weaknesses in this category are related to the rules and recommendations in the File Input and Output (FIO) section of the SEI CERT Perl Coding Standard.

C/C++

1186

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.

C/C++

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

C/C++

1195

Weaknesses in this category are root-caused to defects that arise in the semiconductor-manufacturing process or during the life cycle and supply chain.

C/C++

1198

Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.

C/C++

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

C/C++

1202

Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).

C/C++

1205

Weaknesses in this category are related to hardware implementations of cryptographic protocols and other hardware-security primitives such as physical unclonable functions (PUFs) and random number generators (RNGs).

C/C++

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

C/C++

1208

Weaknesses in this category can arise in multiple areas of hardware design or can apply to a wide cross-section of components.

C/C++

1210

Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.

C/C++

1211

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

C/C++

1212

Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.

C/C++

1213

Weaknesses in this category are related to a software system's random number generation.

C/C++

1214

Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.

C/C++

1215

Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.

C/C++

1218

Weaknesses in this category are related to the handling of memory buffers within a software system.

C/C++

1219

Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.

C/C++

1226

Weaknesses in this category are associated with things being overly complex.

C/C++

1228

Weaknesses in this category are related to the use of built-in functions or external APIs.

C/C++

1237

This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Release cluster (SFP37).

C/C++

1238

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Memory cluster (SFP38).

C/C++

1241

The device uses an algorithm that is predictable and generates a pseudo-random number.

C/C++

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

C/C++

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

C/C++

1307

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.

C/C++

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

C/C++

1309

Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.

C/C++

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

C/C++

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

C/C++

1341

The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.

C/C++

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

C/C++

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

C/C++

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

C/C++

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

C/C++

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

C/C++

1349

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.

C/C++

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

C/C++

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

C/C++

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

C/C++

1355

Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top 10 2021.

C/C++

1356

Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top 10 2021.

C/C++

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1359

Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

C/C++

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

C/C++

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

C/C++

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

C/C++

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

C/C++

1364

Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1366

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1371

Weaknesses in this category are related to the "Poorly Documented or Undocumented Features" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Undocumented capabilities and configurations pose a risk by not having a clear understanding of what the device is specifically supposed to do and only do. Therefore possibly opening up the attack surface and vulnerabilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1373

Weaknesses in this category are related to the "Trust Model Problems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Assumptions made about the user during the design or construction phase may result in vulnerabilities after the system is installed if the user operates it using a different security approach or process than what was designed or built." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1376

Weaknesses in this category are related to the "Security Gaps in Commissioning" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "As a large system is brought online components of the system may remain vulnerable until the entire system is operating and functional and security controls are put in place. This creates a window of opportunity for an adversary during the commissioning process." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1379

Weaknesses in this category are related to the "Human factors in ICS environments" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Environmental factors in ICS including physical duress, system complexities, and isolation may result in security gaps or inadequacies in the performance of individual duties and responsibilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

C/C++

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

C/C++

1396

Weaknesses in this category are related to access control.

C/C++

1397

Weaknesses in this category are related to comparison.

C/C++

1398

Weaknesses in this category are related to component interaction.

C/C++

1399

Weaknesses in this category are related to memory safety.

C/C++

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

C/C++

1401

Weaknesses in this category are related to concurrency.

C/C++

1402

Weaknesses in this category are related to encryption.

C/C++

1403

Weaknesses in this category are related to exposed resource.

C/C++

1404

Weaknesses in this category are related to file handling.

C/C++

1405

Weaknesses in this category are related to improper check or handling of exceptional conditions.

C/C++

1406

Weaknesses in this category are related to improper input validation.

C/C++

1407

Weaknesses in this category are related to improper neutralization.

C/C++

1408

Weaknesses in this category are related to incorrect calculation.

C/C++

1409

Weaknesses in this category are related to injection.

C/C++

1410

Weaknesses in this category are related to insufficient control flow management.

C/C++

1411

Weaknesses in this category are related to insufficient verification of data authenticity.

C/C++

1412

Weaknesses in this category are related to poor coding practices.

C/C++

1413

Weaknesses in this category are related to protection mechanism failure.

C/C++

1414

Weaknesses in this category are related to randomness.

C/C++

1415

Weaknesses in this category are related to resource control.

C/C++

1416

Weaknesses in this category are related to resource lifecycle management.

C/C++

1417

Weaknesses in this category are related to sensitive information exposure.

C/C++

1418

Weaknesses in this category are related to violation of secure design principles.

CUDA

2

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

CUDA

4

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

CUDA

5

Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

CUDA

14

Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal."

CUDA

16

Weaknesses in this category are typically introduced during the configuration of the software.

CUDA

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

CUDA

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

CUDA

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

CUDA

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CUDA

21

This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).

CUDA

22

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CUDA

23

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

CUDA

36

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

CUDA

59

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

CUDA

66

The product does not handle or incorrectly handles a file name that identifies a "virtual" resource that is not directly specified within the directory that is associated with the file name, causing the product to perform file-based operations on a resource that is not a file.

CUDA

67

The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.

CUDA

68

This category has been deprecated as it was found to be an unnecessary abstraction of platform specific details. Please refer to the category CWE-632 and weakness CWE-66 for relevant relationships.

CUDA

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

CUDA

77

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

CUDA

78

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CUDA

88

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

CUDA

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

CUDA

91

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

CUDA

93

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

CUDA

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

CUDA

99

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

CUDA

113

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

CUDA

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

CUDA

117

The product does not neutralize or incorrectly neutralizes output that is written to logs.

CUDA

118

The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

CUDA

119

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

CUDA

120

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

CUDA

121

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

CUDA

122

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

CUDA

123

Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.

CUDA

124

The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

CUDA

125

The product reads data past the end, or before the beginning, of the intended buffer.

CUDA

126

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

CUDA

127

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.

CUDA

128

Wrap around errors occur whenever a value is incremented past the maximum value for its type and therefore "wraps around" to a very small, negative, or undefined value.

CUDA

129

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

CUDA

130

The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.

CUDA

131

The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

CUDA

133

Weaknesses in this category are related to the creation and modification of strings.

CUDA

134

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

CUDA

135

The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.

CUDA

136

Weaknesses in this category are caused by improper data type transformation or improper handling of multiple data types.

CUDA

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

CUDA

138

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

CUDA

140

The product does not neutralize or incorrectly neutralizes delimiters.

CUDA

141

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

CUDA

142

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

CUDA

143

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.

CUDA

146

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

CUDA

149

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

CUDA

150

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

CUDA

157

The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.

CUDA

169

This category has been deprecated. It was originally intended as a "catch-all" for input validation problems in technologies that did not have their own CWE, but introduces unnecessary depth to the hierarchy.

CUDA

170

The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.

CUDA

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

CUDA

187

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

CUDA

188

The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior.

CUDA

189

Weaknesses in this category are related to improper calculation or conversion of numbers.

CUDA

190

The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

CUDA

191

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

CUDA

192

Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.

CUDA

193

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

CUDA

194

The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.

CUDA

195

The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.

CUDA

197

Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

CUDA

198

The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used.

CUDA

199

Weaknesses in this category are related to improper handling of sensitive information.

CUDA

200

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CUDA

201

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

CUDA

209

The product generates an error message that includes sensitive information about its environment, users, or associated data.

CUDA

210

The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

CUDA

211

The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

CUDA

216

This entry has been deprecated, as it was not effective as a weakness and was structured more like a category. In addition, the name is inappropriate, since the "container" term is widely understood by developers in different ways than originally intended by PLOVER, the original source for this entry.

CUDA

221

The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

CUDA

226

The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

CUDA

227

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."

CUDA

228

The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.

CUDA

237

The product does not handle or incorrectly handles inputs that are related to complex structures.

CUDA

240

The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.

CUDA

241

The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).

CUDA

242

The product calls a function that can never be guaranteed to work safely.

CUDA

243

The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.

CUDA

244

Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.

CUDA

247

This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.

CUDA

248

An exception is thrown from a function, but it is not caught.

CUDA

249

This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.

CUDA

252

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

CUDA

253

The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.

CUDA

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

CUDA

255

Weaknesses in this category are related to the management of credentials.

CUDA

256

Storing a password in plaintext may result in a system compromise.

CUDA

257

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

CUDA

259

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

CUDA

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

CUDA

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

CUDA

269

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

CUDA

271

The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.

CUDA

272

The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

CUDA

273

The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.

CUDA

275

Weaknesses in this category are related to improper assignment or handling of permissions.

CUDA

276

During installation, installed file permissions are set to allow anyone to modify those files.

CUDA

282

The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.

CUDA

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CUDA

285

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

CUDA

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CUDA

290

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

CUDA

291

The product uses an IP address for authentication.

CUDA

293

The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.

CUDA

300

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

CUDA

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

CUDA

311

The product does not encrypt sensitive or critical information before storage or transmission.

CUDA

312

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

CUDA

313

The product stores sensitive information in cleartext in a file, or on disk.

CUDA

314

The product stores sensitive information in cleartext in the registry.

CUDA

315

The product stores sensitive information in cleartext in a cookie.

CUDA

317

The product stores sensitive information in cleartext within the GUI.

CUDA

318

The product stores sensitive information in cleartext in an executable.

CUDA

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

CUDA

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

CUDA

321

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

CUDA

326

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

CUDA

327

The product uses a broken or risky cryptographic algorithm or protocol.

CUDA

328

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

CUDA

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

CUDA

335

The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

CUDA

336

A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.

CUDA

337

A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.

CUDA

338

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

CUDA

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

CUDA

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

CUDA

350

The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.

CUDA

353

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

CUDA

355

Weaknesses in this category are related to or introduced in the User Interface (UI).

CUDA

359

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

CUDA

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

CUDA

362

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

CUDA

363

The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.

CUDA

364

The product uses a signal handler that introduces a race condition.

CUDA

366

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

CUDA

367

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.

CUDA

369

The product divides a value by zero.

CUDA

376

This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. Consider using the File Handling Issues category (CWE-1219).

CUDA

377

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

CUDA

379

The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

CUDA

380

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

CUDA

381

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

CUDA

387

Weaknesses in this category are related to the improper handling of signals.

CUDA

388

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

CUDA

389

This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.

CUDA

391

[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.

CUDA

393

A function or operation returns an incorrect return value or status code that does not indicate an error, but causes the product to modify its behavior based on the incorrect result.

CUDA

394

The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.

CUDA

396

Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.

CUDA

397

Throwing overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.

CUDA

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

CUDA

399

Weaknesses in this category are related to improper management of system resources.

CUDA

400

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CUDA

401

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

CUDA

404

The product does not release or incorrectly releases a resource before it is made available for re-use.

CUDA

411

Weaknesses in this category are related to improper handling of locks that are used to control access to resources.

CUDA

415

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

CUDA

416

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CUDA

417

Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.

CUDA

427

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

CUDA

429

Weaknesses in this category are related to improper management of handlers.

CUDA

435

An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

CUDA

438

Weaknesses in this category are related to unexpected behaviors from code that an application uses.

CUDA

441

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

CUDA

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

CUDA

452

Weaknesses in this category occur in behaviors that are used for initialization and breakdown.

CUDA

456

The product does not initialize critical variables, which causes the execution environment to use unexpected values.

CUDA

457

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

CUDA

459

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

CUDA

460

The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.

CUDA

461

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

CUDA

464

The accidental addition of a data-structure sentinel can cause serious programming logic problems.

CUDA

465

Weaknesses in this category are related to improper handling of pointers.

CUDA

467

The code calls sizeof() on a malloced pointer type, which always returns the wordsize/8. This can produce an unexpected result if the programmer intended to determine how much memory has been allocated.

CUDA

468

In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.

CUDA

469

The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.

CUDA

471

The product does not properly protect an assumed-immutable element from being modified by an attacker.

CUDA

475

The behavior of this function is undefined unless its control parameter is set to a specific value.

CUDA

476

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

CUDA

477

The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.

CUDA

478

The code does not have a default case in an expression with multiple conditions, such as a switch statement.

CUDA

479

The product defines a signal handler that calls a non-reentrant function.

CUDA

480

The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

CUDA

481

The code uses an operator for assignment when the intention was to perform a comparison.

CUDA

482

The code uses an operator for comparison when the intention was to perform an assignment.

CUDA

483

The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.

CUDA

484

The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.

CUDA

485

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

CUDA

489

The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

CUDA

490

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

CUDA

493

The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.

CUDA

497

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

CUDA

500

An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.

CUDA

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

CUDA

522

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

CUDA

523

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

CUDA

526

The product uses an environment variable to store unencrypted sensitive information.

CUDA

528

The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.

CUDA

532

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

CUDA

535

A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system.

CUDA

536

A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.

CUDA

538

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

CUDA

539

The web application uses persistent cookies, but the cookies contain sensitive information.

CUDA

543

The product uses the singleton pattern when creating a resource within a multithreaded environment.

CUDA

547

The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.

CUDA

550

Certain conditions, such as network failure, will cause a server error message to be displayed.

CUDA

552

The product makes files or directories accessible to unauthorized actors, even though they should not be.

CUDA

557

Weaknesses in this category are related to concurrent use of shared resources.

CUDA

558

The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.

CUDA

559

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

CUDA

561

The product contains dead code, which can never be executed.

CUDA

562

A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.

CUDA

563

The variable's value is assigned but never used, making it a dead store.

CUDA

566

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

CUDA

567

The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.

CUDA

569

Weaknesses in this category are related to incorrectly written expressions within code.

CUDA

570

The product contains an expression that will always evaluate to false.

CUDA

571

The product contains an expression that will always evaluate to true.

CUDA

573

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

CUDA

590

The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().

CUDA

592

This weakness has been deprecated because it covered redundant concepts already described in CWE-287.

CUDA

595

The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.

CUDA

597

The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.

CUDA

606

The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

CUDA

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

CUDA

617

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

CUDA

628

The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

CUDA

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

CUDA

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

CUDA

633

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

CUDA

634

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

CUDA

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

CUDA

637

The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the mechanism is not correctly understood, modeled, configured, implemented, or used.

CUDA

639

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

CUDA

643

The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

CUDA

644

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

CUDA

657

The product violates well-established principles for secure design.

CUDA

662

The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

CUDA

663

The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.

CUDA

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

CUDA

665

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

CUDA

666

The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.

CUDA

667

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

CUDA

668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

CUDA

669

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

CUDA

670

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

CUDA

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

CUDA

672

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

CUDA

674

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

CUDA

675

The product performs the same operation on a resource two or more times, when the operation should only be applied once.

CUDA

676

The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.

CUDA

680

The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.

CUDA

681

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

CUDA

682

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

CUDA

683

The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.

CUDA

684

The code does not function according to its published specifications, potentially leading to incorrect usage.

CUDA

685

The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses.

CUDA

686

The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses.

CUDA

687

The product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses.

CUDA

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

CUDA

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

CUDA

694

The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

CUDA

696

The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways which may produce resultant weaknesses.

CUDA

697

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

CUDA

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

CUDA

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

CUDA

703

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

CUDA

704

The product does not correctly convert an object, resource, or structure from one type to a different type.

CUDA

705

The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.

CUDA

706

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

CUDA

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

CUDA

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

CUDA

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

CUDA

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

CUDA

714

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.

CUDA

715

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.

CUDA

717

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.

CUDA

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

CUDA

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

CUDA

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

CUDA

721

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.

CUDA

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

CUDA

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

CUDA

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

CUDA

725

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.

CUDA

726

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2004.

CUDA

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

CUDA

728

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.

CUDA

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

CUDA

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

CUDA

731

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.

CUDA

732

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

CUDA

733

The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.

CUDA

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

CUDA

735

Weaknesses in this category are related to the rules and recommendations in the Preprocessor (PRE) chapter of the CERT C Secure Coding Standard (2008).

CUDA

736

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008).

CUDA

737

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).

CUDA

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

CUDA

739

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008).

CUDA

740

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008).

CUDA

741

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).

CUDA

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

CUDA

743

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

CUDA

744

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).

CUDA

745

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) chapter of the CERT C Secure Coding Standard (2008).

CUDA

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

CUDA

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

CUDA

748

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).

CUDA

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

CUDA

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

CUDA

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

CUDA

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

CUDA

754

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

CUDA

755

The product does not handle or incorrectly handles an exceptional condition.

CUDA

758

The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.

CUDA

759

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

CUDA

760

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.

CUDA

762

The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.

CUDA

763

The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.

CUDA

764

The product locks a critical resource more times than intended, leading to an unexpected state in the system.

CUDA

765

The product unlocks a critical resource more times than intended, leading to an unexpected state in the system.

CUDA

769

This entry has been deprecated because it was a duplicate of CWE-774. All content has been transferred to CWE-774.

CUDA

770

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

CUDA

771

The product does not properly maintain a reference to a resource that has been allocated, which prevents the resource from being reclaimed.

CUDA

772

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

CUDA

775

The product does not release a file descriptor or handle after its effective lifetime has ended, i.e., after the file descriptor/handle is no longer needed.

CUDA

783

The product uses an expression in which operator precedence causes incorrect logic to be used.

CUDA

786

The product reads or writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

CUDA

787

The product writes data past the end, or before the beginning, of the intended buffer.

CUDA

788

The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.

CUDA

789

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

CUDA

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

CUDA

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

CUDA

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

CUDA

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

CUDA

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

CUDA

805

The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.

CUDA

806

The product uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.

CUDA

807

The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

CUDA

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

CUDA

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

CUDA

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

CUDA

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

CUDA

813

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.

CUDA

815

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.

CUDA

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

CUDA

817

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.

CUDA

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

CUDA

820

The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

CUDA

823

The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.

CUDA

824

The product accesses or uses a pointer that has not been initialized.

CUDA

825

The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

CUDA

828

The product defines a signal handler that contains code sequences that are not asynchronous-safe, i.e., the functionality is not reentrant, or it can be interrupted.

CUDA

833

The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

CUDA

834

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

CUDA

835

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

CUDA

839

The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.

CUDA

840

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

CUDA

843

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

CUDA

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

CUDA

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

846

Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

847

Weaknesses in this category are related to rules in the Expressions (EXP) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

848

Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

849

Weaknesses in this category are related to rules in the Object Orientation (OBJ) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

850

Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

851

Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

852

Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

853

Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

854

Weaknesses in this category are related to rules in the Thread APIs (THI) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

857

Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

860

Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CUDA

862

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

CUDA

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

CUDA

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

CUDA

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

CUDA

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

CUDA

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

CUDA

871

Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

CUDA

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

CUDA

873

Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

CUDA

874

Weaknesses in this category are related to rules in the Arrays and the STL (ARR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

CUDA

875

Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

CUDA

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

CUDA

877

Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

CUDA

878

Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

CUDA

879

Weaknesses in this category are related to rules in the Signals (SIG) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

CUDA

880

Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

CUDA

881

Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

CUDA

882

Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

CUDA

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

CUDA

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

CUDA

885

This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

CUDA

886

This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).

CUDA

887

This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

CUDA

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

CUDA

889

This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

CUDA

890

This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).

CUDA

891

This category identifies Software Fault Patterns (SFPs) within the Memory Management cluster (SFP38).

CUDA

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

CUDA

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

CUDA

894

This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22).

CUDA

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

CUDA

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

CUDA

897

This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28).

CUDA

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

CUDA

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

CUDA

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

CUDA

901

This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36).

CUDA

902

This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

CUDA

903

This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

CUDA

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

CUDA

906

This category identifies Software Fault Patterns (SFPs) within the UI cluster.

CUDA

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

CUDA

908

The product uses or accesses a resource that has not been initialized.

CUDA

909

The product does not initialize a critical resource.

CUDA

910

The product uses or accesses a file descriptor after it has been closed.

CUDA

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

CUDA

916

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

CUDA

918

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

CUDA

922

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

CUDA

923

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

CUDA

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

CUDA

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

CUDA

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

CUDA

932

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.

CUDA

933

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.

CUDA

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

CUDA

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

CUDA

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

CUDA

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

CUDA

945

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).

CUDA

946

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster.

CUDA

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

CUDA

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

CUDA

950

This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).

CUDA

956

This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.

CUDA

957

This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.

CUDA

958

This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.

CUDA

959

This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.

CUDA

960

This category identifies Software Fault Patterns (SFPs) within the Ambiguous Exception Type cluster (SFP5).

CUDA

961

This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).

CUDA

962

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

CUDA

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

CUDA

964

This category identifies Software Fault Patterns (SFPs) within the Exposure Temporary File cluster.

CUDA

966

This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.

CUDA

969

This category identifies Software Fault Patterns (SFPs) within the Faulty Memory Release cluster (SFP12).

CUDA

970

This category identifies Software Fault Patterns (SFPs) within the Faulty Buffer Access cluster (SFP8).

CUDA

971

This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).

CUDA

973

This category identifies Software Fault Patterns (SFPs) within the Improper NULL Termination cluster (SFP11).

CUDA

974

This category identifies Software Fault Patterns (SFPs) within the Incorrect Buffer Length Computation cluster (SFP10).

CUDA

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

CUDA

976

This category identifies Software Fault Patterns (SFPs) within the Compiler cluster.

CUDA

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

CUDA

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

CUDA

979

This category identifies Software Fault Patterns (SFPs) within the Failed Chroot Jail cluster (SFP17).

CUDA

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

CUDA

981

This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).

CUDA

982

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).

CUDA

983

This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Use cluster (SFP15).

CUDA

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

CUDA

985

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).

CUDA

986

This category identifies Software Fault Patterns (SFPs) within the Missing Lock cluster (SFP19).

CUDA

987

This category identifies Software Fault Patterns (SFPs) within the Multiple Locks/Unlocks cluster (SFP21).

CUDA

988

This category identifies Software Fault Patterns (SFPs) within the Race Condition Window cluster (SFP20).

CUDA

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

CUDA

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

CUDA

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

CUDA

993

This category identifies Software Fault Patterns (SFPs) within the Incorrect Input Handling cluster.

CUDA

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

CUDA

997

This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster.

CUDA

998

This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).

CUDA

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

CUDA

1001

This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).

CUDA

1002

This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster.

CUDA

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

CUDA

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

CUDA

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

CUDA

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

CUDA

1009

Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.

CUDA

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

CUDA

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

CUDA

1012

Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.

CUDA

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

CUDA

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

CUDA

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

CUDA

1016

Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.

CUDA

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

CUDA

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

CUDA

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

CUDA

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

CUDA

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

CUDA

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

CUDA

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

CUDA

1032

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.

CUDA

1037

The developer builds a security-critical protection mechanism into the software, but the processor optimizes the execution of the program such that the mechanism is removed or modified.

CUDA

1041

The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

CUDA

1045

A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.

CUDA

1055

The product contains a class with inheritance from more than one concrete class.

CUDA

1059

The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc.

CUDA

1061

The product does not sufficiently hide the internal representation and implementation details of data or methods, which might allow external components or modules to modify data unexpectedly, invoke unexpected functionality, or introduce dependencies that the programmer did not intend.

CUDA

1076

The product's architecture, source code, design, documentation, or other artifact does not follow required conventions.

CUDA

1077

The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision.

CUDA

1078

The source code does not follow desired style or formatting for indentation, white space, comments, etc.

CUDA

1079

A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.

CUDA

1095

The product uses a loop with a control flow condition based on a value that is updated within the body of the loop.

CUDA

1108

The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of preserving the associated information in a narrower, more local context.

CUDA

1109

The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data.

CUDA

1113

The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.

CUDA

1114

The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.

CUDA

1126

The source code declares a variable in one scope, but the variable is only used within a narrower scope.

CUDA

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

CUDA

1129

Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software.

CUDA

1130

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.

CUDA

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

CUDA

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

CUDA

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1135

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1136

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1137

Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1139

Weaknesses in this category are related to the rules and recommendations in the Object Orientation (OBJ) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1140

Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1141

Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1142

Weaknesses in this category are related to the rules and recommendations in the Visibility and Atomicity (VNA) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1143

Weaknesses in this category are related to the rules and recommendations in the Locking (LCK) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1149

Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1150

Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

CUDA

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

CUDA

1156

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT C Coding Standard.

CUDA

1157

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.

CUDA

1158

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard.

CUDA

1159

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard.

CUDA

1160

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) section of the SEI CERT C Coding Standard.

CUDA

1161

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT C Coding Standard.

CUDA

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

CUDA

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

CUDA

1164

The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.

CUDA

1165

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.

CUDA

1166

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) section of the SEI CERT C Coding Standard.

CUDA

1167

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) section of the SEI CERT C Coding Standard.

CUDA

1168

Weaknesses in this category are related to the rules and recommendations in the Application Programming Interfaces (API) section of the SEI CERT C Coding Standard.

CUDA

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

CUDA

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

CUDA

1171

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard.

CUDA

1172

Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.

CUDA

1177

The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer.

CUDA

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

CUDA

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

CUDA

1180

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard.

CUDA

1181

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.

CUDA

1182

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard.

CUDA

1185

Weaknesses in this category are related to the rules and recommendations in the File Input and Output (FIO) section of the SEI CERT Perl Coding Standard.

CUDA

1186

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.

CUDA

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

CUDA

1195

Weaknesses in this category are root-caused to defects that arise in the semiconductor-manufacturing process or during the life cycle and supply chain.

CUDA

1198

Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.

CUDA

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

CUDA

1202

Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).

CUDA

1205

Weaknesses in this category are related to hardware implementations of cryptographic protocols and other hardware-security primitives such as physical unclonable functions (PUFs) and random number generators (RNGs).

CUDA

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

CUDA

1208

Weaknesses in this category can arise in multiple areas of hardware design or can apply to a wide cross-section of components.

CUDA

1210

Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.

CUDA

1211

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

CUDA

1212

Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.

CUDA

1213

Weaknesses in this category are related to a software system's random number generation.

CUDA

1214

Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.

CUDA

1215

Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.

CUDA

1218

Weaknesses in this category are related to the handling of memory buffers within a software system.

CUDA

1219

Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.

CUDA

1226

Weaknesses in this category are associated with things being overly complex.

CUDA

1228

Weaknesses in this category are related to the use of built-in functions or external APIs.

CUDA

1237

This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Release cluster (SFP37).

CUDA

1238

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Memory cluster (SFP38).

CUDA

1241

The device uses an algorithm that is predictable and generates a pseudo-random number.

CUDA

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

CUDA

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

CUDA

1307

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.

CUDA

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

CUDA

1309

Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.

CUDA

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

CUDA

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

CUDA

1341

The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.

CUDA

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

CUDA

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

CUDA

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

CUDA

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

CUDA

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

CUDA

1349

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.

CUDA

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

CUDA

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

CUDA

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

CUDA

1355

Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top 10 2021.

CUDA

1356

Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top 10 2021.

CUDA

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CUDA

1359

Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

CUDA

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

CUDA

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

CUDA

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

CUDA

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

CUDA

1364

Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CUDA

1366

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CUDA

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CUDA

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CUDA

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CUDA

1371

Weaknesses in this category are related to the "Poorly Documented or Undocumented Features" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Undocumented capabilities and configurations pose a risk by not having a clear understanding of what the device is specifically supposed to do and only do. Therefore possibly opening up the attack surface and vulnerabilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CUDA

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CUDA

1373

Weaknesses in this category are related to the "Trust Model Problems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Assumptions made about the user during the design or construction phase may result in vulnerabilities after the system is installed if the user operates it using a different security approach or process than what was designed or built." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CUDA

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CUDA

1376

Weaknesses in this category are related to the "Security Gaps in Commissioning" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "As a large system is brought online components of the system may remain vulnerable until the entire system is operating and functional and security controls are put in place. This creates a window of opportunity for an adversary during the commissioning process." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CUDA

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CUDA

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

CUDA

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

CUDA

1396

Weaknesses in this category are related to access control.

CUDA

1397

Weaknesses in this category are related to comparison.

CUDA

1398

Weaknesses in this category are related to component interaction.

CUDA

1399

Weaknesses in this category are related to memory safety.

CUDA

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

CUDA

1401

Weaknesses in this category are related to concurrency.

CUDA

1402

Weaknesses in this category are related to encryption.

CUDA

1403

Weaknesses in this category are related to exposed resource.

CUDA

1404

Weaknesses in this category are related to file handling.

CUDA

1405

Weaknesses in this category are related to improper check or handling of exceptional conditions.

CUDA

1406

Weaknesses in this category are related to improper input validation.

CUDA

1407

Weaknesses in this category are related to improper neutralization.

CUDA

1408

Weaknesses in this category are related to incorrect calculation.

CUDA

1409

Weaknesses in this category are related to injection.

CUDA

1410

Weaknesses in this category are related to insufficient control flow management.

CUDA

1411

Weaknesses in this category are related to insufficient verification of data authenticity.

CUDA

1412

Weaknesses in this category are related to poor coding practices.

CUDA

1413

Weaknesses in this category are related to protection mechanism failure.

CUDA

1414

Weaknesses in this category are related to randomness.

CUDA

1415

Weaknesses in this category are related to resource control.

CUDA

1416

Weaknesses in this category are related to resource lifecycle management.

CUDA

1417

Weaknesses in this category are related to sensitive information exposure.

CUDA

1418

Weaknesses in this category are related to violation of secure design principles.

Go

2

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

Go

4

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Go

5

Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

Go

16

Weaknesses in this category are typically introduced during the configuration of the software.

Go

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Go

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Go

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

Go

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Go

21

This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).

Go

22

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Go

23

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Go

36

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

Go

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Go

77

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Go

78

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Go

79

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Go

80

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Go

82

The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

Go

83

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

Go

85

The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.

Go

86

The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

Go

87

The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

Go

88

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Go

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Go

91

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Go

93

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Go

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Go

95

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Go

113

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Go

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Go

117

The product does not neutralize or incorrectly neutralizes output that is written to logs.

Go

118

The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

Go

119

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Go

133

Weaknesses in this category are related to the creation and modification of strings.

Go

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

Go

138

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

Go

140

The product does not neutralize or incorrectly neutralizes delimiters.

Go

141

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

Go

142

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

Go

143

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.

Go

146

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

Go

149

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

Go

150

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Go

157

The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.

Go

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

Go

183

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Go

189

Weaknesses in this category are related to improper calculation or conversion of numbers.

Go

199

Weaknesses in this category are related to improper handling of sensitive information.

Go

200

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Go

201

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Go

209

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Go

210

The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

Go

211

The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

Go

221

The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

Go

223

The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

Go

226

The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

Go

227

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."

Go

249

This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.

Go

252

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Go

253

The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.

Go

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Go

255

Weaknesses in this category are related to the management of credentials.

Go

256

Storing a password in plaintext may result in a system compromise.

Go

257

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

Go

259

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Go

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Go

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

Go

275

Weaknesses in this category are related to improper assignment or handling of permissions.

Go

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Go

285

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Go

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Go

295

The product does not validate, or incorrectly validates, a certificate.

Go

300

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

Go

304

The product implements an authentication technique, but it skips a step that weakens the technique.

Go

306

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Go

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Go

311

The product does not encrypt sensitive or critical information before storage or transmission.

Go

312

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Go

313

The product stores sensitive information in cleartext in a file, or on disk.

Go

314

The product stores sensitive information in cleartext in the registry.

Go

315

The product stores sensitive information in cleartext in a cookie.

Go

317

The product stores sensitive information in cleartext within the GUI.

Go

318

The product stores sensitive information in cleartext in an executable.

Go

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Go

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

Go

321

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

Go

326

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Go

327

The product uses a broken or risky cryptographic algorithm or protocol.

Go

328

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

Go

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Go

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

Go

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Go

346

The product does not properly verify that the source of data or communication is valid.

Go

352

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Go

353

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

Go

355

Weaknesses in this category are related to or introduced in the User Interface (UI).

Go

359

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Go

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

Go

362

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

Go

366

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

Go

369

The product divides a value by zero.

Go

371

Weaknesses in this category are related to improper management of system state.

Go

388

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

Go

389

This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.

Go

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

Go

399

Weaknesses in this category are related to improper management of system resources.

Go

404

The product does not release or incorrectly releases a resource before it is made available for re-use.

Go

405

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Go

409

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Go

411

Weaknesses in this category are related to improper handling of locks that are used to control access to resources.

Go

417

Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.

Go

435

An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

Go

436

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Go

438

Weaknesses in this category are related to unexpected behaviors from code that an application uses.

Go

441

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Go

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Go

452

Weaknesses in this category occur in behaviors that are used for initialization and breakdown.

Go

459

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Go

465

Weaknesses in this category are related to improper handling of pointers.

Go

476

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Go

480

The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

Go

485

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

Go

497

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Go

502

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Go

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

Go

522

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Go

523

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

Go

532

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Go

536

A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.

Go

538

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Go

539

The web application uses persistent cookies, but the cookies contain sensitive information.

Go

548

A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers.

Go

550

Certain conditions, such as network failure, will cause a server error message to be displayed.

Go

552

The product makes files or directories accessible to unauthorized actors, even though they should not be.

Go

557

Weaknesses in this category are related to concurrent use of shared resources.

Go

561

The product contains dead code, which can never be executed.

Go

563

The variable's value is assigned but never used, making it a dead store.

Go

565

The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

Go

566

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

Go

567

The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.

Go

569

Weaknesses in this category are related to incorrectly written expressions within code.

Go

573

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

Go

601

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Go

602

The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Go

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Go

611

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Go

613

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Go

614

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

Go

617

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Go

624

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

Go

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Go

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Go

633

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Go

634

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Go

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

Go

639

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Go

642

The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.

Go

643

The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

Go

644

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

Go

657

The product violates well-established principles for secure design.

Go

662

The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

Go

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Go

666

The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.

Go

667

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Go

668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Go

669

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Go

670

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

Go

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

Go

672

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

Go

674

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Go

675

The product performs the same operation on a resource two or more times, when the operation should only be applied once.

Go

682

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Go

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

Go

692

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

Go

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Go

697

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

Go

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Go

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

Go

703

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Go

706

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Go

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

Go

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Go

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Go

712

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.

Go

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

Go

714

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.

Go

715

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.

Go

716

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.

Go

717

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.

Go

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

Go

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

Go

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

Go

721

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.

Go

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

Go

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

Go

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

Go

725

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.

Go

726

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2004.

Go

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

Go

728

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.

Go

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

Go

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

Go

731

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.

Go

732

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Go

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

Go

737

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).

Go

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

Go

739

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008).

Go

740

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008).

Go

741

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).

Go

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

Go

743

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

Go

744

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).

Go

745

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) chapter of the CERT C Secure Coding Standard (2008).

Go

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

Go

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

Go

748

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).

Go

749

The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Go

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Go

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

Go

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

Go

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

Go

754

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Go

755

The product does not handle or incorrectly handles an exceptional condition.

Go

764

The product locks a critical resource more times than intended, leading to an unexpected state in the system.

Go

765

The product unlocks a critical resource more times than intended, leading to an unexpected state in the system.

Go

776

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Go

778

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

Go

783

The product uses an expression in which operator precedence causes incorrect logic to be used.

Go

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Go

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Go

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

Go

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

Go

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

Go

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Go

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Go

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

Go

811

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.

Go

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

Go

813

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.

Go

814

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.

Go

815

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.

Go

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

Go

817

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.

Go

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

Go

819

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2010.

Go

820

The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

Go

833

The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

Go

834

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Go

835

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Go

840

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

Go

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

Go

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Go

847

Weaknesses in this category are related to rules in the Expressions (EXP) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Go

848

Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Go

850

Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Go

851

Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Go

852

Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Go

853

Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Go

855

Weaknesses in this category are related to rules in the Thread Pools (TPS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Go

857

Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Go

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Go

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Go

860

Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Go

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Go

862

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Go

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Go

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Go

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Go

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Go

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

Go

871

Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Go

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Go

873

Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Go

874

Weaknesses in this category are related to rules in the Arrays and the STL (ARR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Go

875

Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Go

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Go

877

Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Go

878

Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Go

879

Weaknesses in this category are related to rules in the Signals (SIG) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Go

880

Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Go

881

Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Go

882

Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Go

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Go

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

Go

885

This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

Go

886

This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).

Go

887

This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

Go

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

Go

889

This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

Go

890

This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).

Go

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

Go

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

Go

894

This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22).

Go

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

Go

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

Go

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

Go

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

Go

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Go

902

This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

Go

903

This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

Go

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

Go

906

This category identifies Software Fault Patterns (SFPs) within the UI cluster.

Go

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

Go

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Go

918

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Go

922

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Go

923

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Go

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Go

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

Go

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

Go

931

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2013.

Go

932

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.

Go

933

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.

Go

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

Go

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

Go

936

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2013.

Go

938

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2013.

Go

942

The product uses a cross-domain policy file that includes domains that should not be trusted.

Go

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Go

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

Go

945

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).

Go

946

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster.

Go

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

Go

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

Go

950

This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).

Go

951

This category identifies Software Fault Patterns (SFPs) within the Insecure Authentication Policy cluster.

Go

952

This category identifies Software Fault Patterns (SFPs) within the Missing Authentication cluster.

Go

956

This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.

Go

957

This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.

Go

958

This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.

Go

959

This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.

Go

961

This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).

Go

962

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

Go

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

Go

966

This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.

Go

970

This category identifies Software Fault Patterns (SFPs) within the Faulty Buffer Access cluster (SFP8).

Go

971

This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).

Go

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

Go

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

Go

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

Go

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

Go

981

This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).

Go

982

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).

Go

983

This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Use cluster (SFP15).

Go

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

Go

985

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).

Go

986

This category identifies Software Fault Patterns (SFPs) within the Missing Lock cluster (SFP19).

Go

987

This category identifies Software Fault Patterns (SFPs) within the Multiple Locks/Unlocks cluster (SFP21).

Go

988

This category identifies Software Fault Patterns (SFPs) within the Race Condition Window cluster (SFP20).

Go

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

Go

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

Go

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

Go

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

Go

997

This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster.

Go

998

This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).

Go

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

Go

1001

This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).

Go

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

Go

1004

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Go

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

Go

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

Go

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

Go

1009

Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.

Go

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Go

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

Go

1012

Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.

Go

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

Go

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

Go

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Go

1016

Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.

Go

1018

Weaknesses in this category are related to the design and architecture of session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed when designing or implementing a secure architecture.

Go

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

Go

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

Go

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

Go

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

Go

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

Go

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

Go

1030

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2017.

Go

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

Go

1032

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.

Go

1033

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2017.

Go

1034

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2017.

Go

1036

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2017.

Go

1041

The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

Go

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

Go

1129

Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software.

Go

1130

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.

Go

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

Go

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

Go

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

Go

1136

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.

Go

1137

Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java.

Go

1140

Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

Go

1141

Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.

Go

1142

Weaknesses in this category are related to the rules and recommendations in the Visibility and Atomicity (VNA) section of the SEI CERT Oracle Secure Coding Standard for Java.

Go

1143

Weaknesses in this category are related to the rules and recommendations in the Locking (LCK) section of the SEI CERT Oracle Secure Coding Standard for Java.

Go

1145

Weaknesses in this category are related to the rules and recommendations in the Thread Pools (TPS) section of the SEI CERT Oracle Secure Coding Standard for Java.

Go

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

Go

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

Go

1149

Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.

Go

1150

Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java.

Go

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

Go

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

Go

1157

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.

Go

1158

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard.

Go

1159

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard.

Go

1160

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) section of the SEI CERT C Coding Standard.

Go

1161

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT C Coding Standard.

Go

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

Go

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

Go

1164

The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.

Go

1165

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.

Go

1166

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) section of the SEI CERT C Coding Standard.

Go

1167

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) section of the SEI CERT C Coding Standard.

Go

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

Go

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

Go

1171

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard.

Go

1172

Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.

Go

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

Go

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

Go

1181

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.

Go

1182

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard.

Go

1186

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.

Go

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Go

1198

Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.

Go

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

Go

1202

Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).

Go

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

Go

1210

Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.

Go

1211

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

Go

1212

Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.

Go

1213

Weaknesses in this category are related to a software system's random number generation.

Go

1214

Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.

Go

1215

Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.

Go

1217

Weaknesses in this category are related to session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed.

Go

1219

Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.

Go

1228

Weaknesses in this category are related to the use of built-in functions or external APIs.

Go

1275

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

Go

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

Go

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

Go

1307

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.

Go

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

Go

1309

Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.

Go

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

Go

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

Go

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

Go

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

Go

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

Go

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

Go

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

Go

1349

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.

Go

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

Go

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

Go

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

Go

1355

Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top 10 2021.

Go

1356

Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top 10 2021.

Go

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Go

1359

Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Go

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Go

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Go

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Go

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Go

1364

Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Go

1366

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Go

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Go

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Go

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Go

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Go

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Go

1376

Weaknesses in this category are related to the "Security Gaps in Commissioning" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "As a large system is brought online components of the system may remain vulnerable until the entire system is operating and functional and security controls are put in place. This creates a window of opportunity for an adversary during the commissioning process." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Go

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Go

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Go

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

Go

1396

Weaknesses in this category are related to access control.

Go

1397

Weaknesses in this category are related to comparison.

Go

1398

Weaknesses in this category are related to component interaction.

Go

1399

Weaknesses in this category are related to memory safety.

Go

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

Go

1401

Weaknesses in this category are related to concurrency.

Go

1402

Weaknesses in this category are related to encryption.

Go

1403

Weaknesses in this category are related to exposed resource.

Go

1404

Weaknesses in this category are related to file handling.

Go

1405

Weaknesses in this category are related to improper check or handling of exceptional conditions.

Go

1406

Weaknesses in this category are related to improper input validation.

Go

1407

Weaknesses in this category are related to improper neutralization.

Go

1408

Weaknesses in this category are related to incorrect calculation.

Go

1409

Weaknesses in this category are related to injection.

Go

1410

Weaknesses in this category are related to insufficient control flow management.

Go

1411

Weaknesses in this category are related to insufficient verification of data authenticity.

Go

1412

Weaknesses in this category are related to poor coding practices.

Go

1413

Weaknesses in this category are related to protection mechanism failure.

Go

1414

Weaknesses in this category are related to randomness.

Go

1415

Weaknesses in this category are related to resource control.

Go

1416

Weaknesses in this category are related to resource lifecycle management.

Go

1417

Weaknesses in this category are related to sensitive information exposure.

Go

1418

Weaknesses in this category are related to violation of secure design principles.

Java

2

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

Java

4

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Java

5

Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

Java

16

Weaknesses in this category are typically introduced during the configuration of the software.

Java

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Java

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Java

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

Java

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Java

21

This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).

Java

22

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Java

23

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Java

36

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

Java

66

The product does not handle or incorrectly handles a file name that identifies a "virtual" resource that is not directly specified within the directory that is associated with the file name, causing the product to perform file-based operations on a resource that is not a file.

Java

67

The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.

Java

68

This category has been deprecated as it was found to be an unnecessary abstraction of platform specific details. Please refer to the category CWE-632 and weakness CWE-66 for relevant relationships.

Java

73

The product allows user input to control or influence paths or file names that are used in filesystem operations.

Java

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Java

77

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Java

78

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Java

79

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Java

80

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Java

81

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters that could be interpreted as web-scripting elements when they are sent to an error page.

Java

82

The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

Java

83

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

Java

85

The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.

Java

86

The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

Java

87

The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

Java

88

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Java

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Java

90

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

Java

91

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Java

93

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Java

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Java

95

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Java

96

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

Java

97

The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-side include (SSI) directive.

Java

99

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

Java

100

This category has been deprecated. It was originally intended as a "catch-all" for input validation problems in technologies that did not have their own CWE, but introduces unnecessary depth to the hierarchy.

Java

101

This category has been deprecated. It was originally used for organizing the Development View (CWE-69 9), but it introduced unnecessary complexity and depth to the resulting tree.

Java

102

The product uses multiple validation forms with the same name, which might cause the Struts Validator to validate a form that the programmer does not expect.

Java

103

The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().

Java

104

If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to other weaknesses related to insufficient input validation.

Java

106

When an application does not use an input validation framework such as the Struts Validator, there is a greater risk of introducing weaknesses related to insufficient input validation.

Java

111

When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to weaknesses in that code, even if those weaknesses cannot occur in Java.

Java

113

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Java

114

Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.

Java

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Java

117

The product does not neutralize or incorrectly neutralizes output that is written to logs.

Java

118

The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

Java

119

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Java

133

Weaknesses in this category are related to the creation and modification of strings.

Java

134

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Java

135

The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.

Java

136

Weaknesses in this category are caused by improper data type transformation or improper handling of multiple data types.

Java

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

Java

138

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

Java

140

The product does not neutralize or incorrectly neutralizes delimiters.

Java

141

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

Java

142

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

Java

143

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.

Java

146

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

Java

149

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

Java

150

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Java

157

The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.

Java

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

Java

172

The product does not properly encode or decode the data, resulting in unexpected values.

Java

176

The product does not properly handle when an input contains Unicode encoding.

Java

179

The product validates input before applying protection mechanisms that modify the input, which could allow an attacker to bypass the validation via dangerous inputs that only arise after the modification.

Java

180

The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.

Java

182

The product filters data in a way that causes it to be reduced or "collapsed" into an unsafe value that violates an expected security property.

Java

183

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Java

185

The product specifies a regular expression in a way that causes data to be improperly matched or compared.

Java

187

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

Java

188

The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior.

Java

189

Weaknesses in this category are related to improper calculation or conversion of numbers.

Java

190

The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

Java

192

Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.

Java

198

The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used.

Java

199

Weaknesses in this category are related to improper handling of sensitive information.

Java

200

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Java

201

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Java

209

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Java

210

The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

Java

211

The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

Java

216

This entry has been deprecated, as it was not effective as a weakness and was structured more like a category. In addition, the name is inappropriate, since the "container" term is widely understood by developers in different ways than originally intended by PLOVER, the original source for this entry.

Java

218

This weakness has been deprecated because it was a duplicate of CWE-493. All content has been transferred to CWE-493.

Java

221

The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

Java

223

The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

Java

226

The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

Java

227

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."

Java

242

The product calls a function that can never be guaranteed to work safely.

Java

245

The J2EE application directly manages connections, instead of using the container's connection management facilities.

Java

246

The J2EE application directly uses sockets instead of using framework method calls.

Java

247

This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.

Java

249

This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.

Java

250

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

Java

252

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Java

253

The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.

Java

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Java

255

Weaknesses in this category are related to the management of credentials.

Java

256

Storing a password in plaintext may result in a system compromise.

Java

257

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

Java

258

Using an empty string as a password is insecure.

Java

259

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Java

260

The product stores a password in a configuration file that might be accessible to actors who do not know the password.

Java

261

Obscuring a password with a trivial encoding does not protect the password.

Java

263

The product supports password aging, but the expiration period is too long.

Java

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Java

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

Java

266

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Java

269

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Java

271

The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.

Java

272

The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

Java

275

Weaknesses in this category are related to improper assignment or handling of permissions.

Java

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Java

285

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Java

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Java

290

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Java

291

The product uses an IP address for authentication.

Java

293

The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.

Java

295

The product does not validate, or incorrectly validates, a certificate.

Java

296

The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

Java

297

The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Java

299

The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

Java

300

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

Java

302

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

Java

304

The product implements an authentication technique, but it skips a step that weakens the technique.

Java

306

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Java

308

The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.

Java

309

The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.

Java

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Java

311

The product does not encrypt sensitive or critical information before storage or transmission.

Java

312

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Java

313

The product stores sensitive information in cleartext in a file, or on disk.

Java

314

The product stores sensitive information in cleartext in the registry.

Java

315

The product stores sensitive information in cleartext in a cookie.

Java

317

The product stores sensitive information in cleartext within the GUI.

Java

318

The product stores sensitive information in cleartext in an executable.

Java

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Java

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

Java

321

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

Java

324

The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

Java

326

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Java

327

The product uses a broken or risky cryptographic algorithm or protocol.

Java

328

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

Java

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Java

335

The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

Java

336

A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.

Java

337

A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.

Java

338

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Java

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

Java

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Java

346

The product does not properly verify that the source of data or communication is valid.

Java

347

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Java

350

The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.

Java

352

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Java

353

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

Java

355

Weaknesses in this category are related to or introduced in the User Interface (UI).

Java

358

The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

Java

359

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Java

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

Java

362

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

Java

366

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

Java

369

The product divides a value by zero.

Java

371

Weaknesses in this category are related to improper management of system state.

Java

374

The product sends non-cloned mutable data as an argument to a method or function.

Java

375

Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.

Java

380

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Java

381

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Java

382

A J2EE application uses System.exit(), which also shuts down its container.

Java

383

Thread management in a Web application is forbidden in some circumstances and is always highly error prone.

Java

384

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Java

388

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

Java

389

This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.

Java

390

The product detects a specific error, but takes no actions to handle the error.

Java

391

[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.

Java

392

The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.

Java

396

Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.

Java

397

Throwing overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.

Java

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

Java

399

Weaknesses in this category are related to improper management of system resources.

Java

400

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Java

401

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

Java

402

The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.

Java

403

A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.

Java

404

The product does not release or incorrectly releases a resource before it is made available for re-use.

Java

405

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Java

409

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Java

411

Weaknesses in this category are related to improper handling of locks that are used to control access to resources.

Java

413

The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.

Java

417

Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.

Java

427

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Java

435

An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

Java

436

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Java

438

Weaknesses in this category are related to unexpected behaviors from code that an application uses.

Java

440

A feature, API, or function does not perform according to its specification.

Java

441

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Java

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Java

452

Weaknesses in this category occur in behaviors that are used for initialization and breakdown.

Java

459

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Java

460

The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.

Java

461

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Java

463

The accidental deletion of a data-structure sentinel can cause serious programming logic problems.

Java

465

Weaknesses in this category are related to improper handling of pointers.

Java

470

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Java

471

The product does not properly protect an assumed-immutable element from being modified by an attacker.

Java

474

The code uses a function that has inconsistent implementations across operating systems and versions.

Java

476

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Java

480

The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

Java

481

The code uses an operator for assignment when the intention was to perform a comparison.

Java

483

The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.

Java

484

The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.

Java

485

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

Java

486

The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.

Java

487

Java packages are not inherently closed; therefore, relying on them for code security is not a good practice.

Java

488

The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Java

489

The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

Java

490

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Java

492

Inner classes are translated into classes that are accessible at package scope and may expose code that the programmer intended to keep private to attackers.

Java

493

The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.

Java

495

The product has a method that is declared public, but returns a reference to a private data structure, which could then be modified in unexpected ways.

Java

496

Assigning public data to a private array is equivalent to giving public access to the array.

Java

497

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Java

498

The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.

Java

499

The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.

Java

500

An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.

Java

501

The product mixes trusted and untrusted data in the same data structure or structured message.

Java

502

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Java

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

Java

521

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

Java

522

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Java

523

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

Java

524

The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Java

525

The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

Java

526

The product uses an environment variable to store unencrypted sensitive information.

Java

532

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Java

536

A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.

Java

537

In many cases, an attacker can leverage the conditions that cause unhandled exception errors in order to gain unauthorized access to the system.

Java

538

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Java

539

The web application uses persistent cookies, but the cookies contain sensitive information.

Java

540

Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.

Java

543

The product uses the singleton pattern when creating a resource within a multithreaded environment.

Java

548

A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers.

Java

550

Certain conditions, such as network failure, will cause a server error message to be displayed.

Java

552

The product makes files or directories accessible to unauthorized actors, even though they should not be.

Java

557

Weaknesses in this category are related to concurrent use of shared resources.

Java

558

The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.

Java

559

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Java

561

The product contains dead code, which can never be executed.

Java

563

The variable's value is assigned but never used, making it a dead store.

Java

566

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

Java

567

The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.

Java

568

The product contains a finalize() method that does not call super.finalize().

Java

569

Weaknesses in this category are related to incorrectly written expressions within code.

Java

570

The product contains an expression that will always evaluate to false.

Java

571

The product contains an expression that will always evaluate to true.

Java

572

The product calls a thread's run() method instead of calling start(), which causes the code to run in the thread of the caller instead of the callee.

Java

573

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

Java

574

The product violates the Enterprise JavaBeans (EJB) specification by using thread synchronization primitives.

Java

575

The product violates the Enterprise JavaBeans (EJB) specification by using AWT/Swing.

Java

576

The product violates the Enterprise JavaBeans (EJB) specification by using the java.io package.

Java

577

The product violates the Enterprise JavaBeans (EJB) specification by using sockets.

Java

579

The product stores a non-serializable object as an HttpSession attribute, which can hurt reliability.

Java

580

The product contains a clone() method that does not call super.clone() to obtain the new object.

Java

581

The product does not maintain equal hashcodes for equal objects.

Java

583

The product violates secure coding principles for mobile code by declaring a finalize() method public.

Java

584

The code has a return statement inside a finally block, which will cause any thrown exception in the try block to be discarded.

Java

585

The product contains an empty synchronized block.

Java

586

The product makes an explicit call to the finalize() method from outside the finalizer.

Java

589

The product uses an API function that does not exist on all versions of the target platform. This could cause portability problems or inconsistencies that allow denial of service or other consequences.

Java

592

This weakness has been deprecated because it covered redundant concepts already described in CWE-287.

Java

594

When the J2EE container attempts to write unserializable objects to disk there is no guarantee that the process will complete successfully.

Java

595

The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.

Java

596

This weakness has been deprecated. It was poorly described and difficult to distinguish from other entries. It was also inappropriate to assign a separate ID solely because of domain-specific considerations. Its closest equivalent is CWE-1023.

Java

597

The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.

Java

598

The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Java

601

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Java

607

A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package.

Java

609

The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient.

Java

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Java

611

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Java

613

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Java

614

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

Java

615

While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.

Java

617

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Java

624

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

Java

625

The product uses a regular expression that does not sufficiently restrict the set of allowed values.

Java

628

The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

Java

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Java

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Java

633

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Java

634

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Java

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

Java

639

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Java

642

The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.

Java

643

The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

Java

644

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

Java

647

The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

Java

650

The server contains a protection mechanism that assumes that any URI that is accessed using HTTP GET will not cause a state change to the associated resource. This might allow attackers to bypass intended access restrictions and conduct resource modification and deletion attacks, since some applications allow GET to modify state.

Java

654

A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.

Java

657

The product violates well-established principles for secure design.

Java

662

The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

Java

663

The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.

Java

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Java

665

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

Java

666

The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.

Java

667

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Java

668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Java

669

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Java

670

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

Java

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

Java

672

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

Java

674

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Java

676

The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.

Java

681

When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.

Java

682

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Java

683

The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.

Java

684

The code does not function according to its published specifications, potentially leading to incorrect usage.

Java

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

Java

692

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

Java

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Java

694

The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

Java

695

The product uses low-level functionality that is explicitly prohibited by the framework or specification under which the product is supposed to operate.

Java

696

The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways which may produce resultant weaknesses.

Java

697

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

Java

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Java

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

Java

703

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Java

704

The product does not correctly convert an object, resource, or structure from one type to a different type.

Java

705

The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.

Java

706

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Java

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

Java

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Java

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Java

712

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.

Java

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

Java

714

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.

Java

715

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.

Java

716

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.

Java

717

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.

Java

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

Java

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

Java

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

Java

721

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.

Java

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

Java

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

Java

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

Java

725

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.

Java

726

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2004.

Java

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

Java

728

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.

Java

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

Java

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

Java

731

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.

Java

732

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Java

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

Java

735

Weaknesses in this category are related to the rules and recommendations in the Preprocessor (PRE) chapter of the CERT C Secure Coding Standard (2008).

Java

736

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008).

Java

737

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).

Java

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

Java

739

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008).

Java

740

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008).

Java

741

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).

Java

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

Java

743

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

Java

744

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).

Java

745

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) chapter of the CERT C Secure Coding Standard (2008).

Java

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

Java

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

Java

748

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).

Java

749

The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Java

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Java

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

Java

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

Java

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

Java

754

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Java

755

The product does not handle or incorrectly handles an exceptional condition.

Java

757

A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

Java

758

The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.

Java

759

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

Java

760

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.

Java

766

The product declares a critical variable, field, or member to be public when intended security policy requires it to be private.

Java

772

The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Java

776

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Java

778

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

Java

779

The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.

Java

780

The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.

Java

783

The product uses an expression in which operator precedence causes incorrect logic to be used.

Java

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Java

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Java

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

Java

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

Java

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

Java

807

The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Java

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Java

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Java

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

Java

811

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.

Java

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

Java

813

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.

Java

814

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.

Java

815

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.

Java

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

Java

817

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.

Java

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

Java

819

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2010.

Java

820

The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

Java

821

The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.

Java

827

The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.

Java

829

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Java

833

The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

Java

834

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Java

835

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Java

838

The product uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.

Java

840

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

Java

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

Java

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

846

Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

847

Weaknesses in this category are related to rules in the Expressions (EXP) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

848

Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

849

Weaknesses in this category are related to rules in the Object Orientation (OBJ) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

850

Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

851

Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

852

Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

853

Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

854

Weaknesses in this category are related to rules in the Thread APIs (THI) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

855

Weaknesses in this category are related to rules in the Thread Pools (TPS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

857

Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

860

Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Java

862

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Java

863

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Java

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Java

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Java

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Java

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Java

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

Java

871

Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Java

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Java

873

Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Java

874

Weaknesses in this category are related to rules in the Arrays and the STL (ARR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Java

875

Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Java

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Java

877

Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Java

878

Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Java

879

Weaknesses in this category are related to rules in the Signals (SIG) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Java

880

Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Java

881

Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Java

882

Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Java

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Java

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

Java

885

This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

Java

886

This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).

Java

887

This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

Java

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

Java

889

This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

Java

890

This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).

Java

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

Java

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

Java

894

This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22).

Java

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

Java

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

Java

897

This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28).

Java

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

Java

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

Java

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Java

901

This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36).

Java

902

This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

Java

903

This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

Java

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

Java

906

This category identifies Software Fault Patterns (SFPs) within the UI cluster.

Java

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

Java

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Java

915

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Java

916

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Java

917

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Java

918

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Java

921

The product stores sensitive information in a file system or device that does not have built-in access control.

Java

922

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Java

923

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Java

925

The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.

Java

926

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Java

927

The Android application uses an implicit intent for transmitting sensitive data to other applications.

Java

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Java

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

Java

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

Java

931

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2013.

Java

932

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.

Java

933

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.

Java

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

Java

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

Java

936

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2013.

Java

938

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2013.

Java

942

The product uses a cross-domain policy file that includes domains that should not be trusted.

Java

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Java

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

Java

945

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).

Java

946

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster.

Java

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

Java

948

This category identifies Software Fault Patterns (SFPs) within the Digital Certificate cluster.

Java

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

Java

950

This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).

Java

951

This category identifies Software Fault Patterns (SFPs) within the Insecure Authentication Policy cluster.

Java

952

This category identifies Software Fault Patterns (SFPs) within the Missing Authentication cluster.

Java

956

This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.

Java

957

This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.

Java

958

This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.

Java

959

This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.

Java

960

This category identifies Software Fault Patterns (SFPs) within the Ambiguous Exception Type cluster (SFP5).

Java

961

This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).

Java

962

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

Java

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

Java

965

This category identifies Software Fault Patterns (SFPs) within the Insecure Session Management cluster.

Java

966

This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.

Java

970

This category identifies Software Fault Patterns (SFPs) within the Faulty Buffer Access cluster (SFP8).

Java

971

This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).

Java

974

This category identifies Software Fault Patterns (SFPs) within the Incorrect Buffer Length Computation cluster (SFP10).

Java

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

Java

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

Java

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

Java

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

Java

981

This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).

Java

982

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).

Java

983

This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Use cluster (SFP15).

Java

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

Java

985

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).

Java

986

This category identifies Software Fault Patterns (SFPs) within the Missing Lock cluster (SFP19).

Java

987

This category identifies Software Fault Patterns (SFPs) within the Multiple Locks/Unlocks cluster (SFP21).

Java

988

This category identifies Software Fault Patterns (SFPs) within the Race Condition Window cluster (SFP20).

Java

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

Java

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

Java

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

Java

993

This category identifies Software Fault Patterns (SFPs) within the Incorrect Input Handling cluster.

Java

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

Java

997

This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster.

Java

998

This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).

Java

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

Java

1001

This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).

Java

1002

This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster.

Java

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

Java

1004

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Java

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

Java

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

Java

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

Java

1009

Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.

Java

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Java

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

Java

1012

Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.

Java

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

Java

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

Java

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Java

1016

Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.

Java

1018

Weaknesses in this category are related to the design and architecture of session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed when designing or implementing a secure architecture.

Java

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

Java

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

Java

1023

The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Java

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

Java

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

Java

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

Java

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

Java

1030

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2017.

Java

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

Java

1032

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.

Java

1033

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2017.

Java

1034

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2017.

Java

1036

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2017.

Java

1041

The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

Java

1071

The source code contains a block that does not contain any code, i.e., the block is empty.

Java

1078

The source code does not follow desired style or formatting for indentation, white space, comments, etc.

Java

1104

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

Java

1114

The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.

Java

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

Java

1129

Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software.

Java

1130

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.

Java

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

Java

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

Java

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1135

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1136

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1137

Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1138

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1139

Weaknesses in this category are related to the rules and recommendations in the Object Orientation (OBJ) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1140

Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1141

Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1142

Weaknesses in this category are related to the rules and recommendations in the Visibility and Atomicity (VNA) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1143

Weaknesses in this category are related to the rules and recommendations in the Locking (LCK) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1144

Weaknesses in this category are related to the rules and recommendations in the Thread APIs (THI) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1145

Weaknesses in this category are related to the rules and recommendations in the Thread Pools (TPS) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1146

Weaknesses in this category are related to the rules and recommendations in the Thread-Safety Miscellaneous (TSM) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1149

Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1150

Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1151

Weaknesses in this category are related to the rules and recommendations in the Java Native Interface (JNI) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

Java

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

Java

1157

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.

Java

1158

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard.

Java

1159

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard.

Java

1160

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) section of the SEI CERT C Coding Standard.

Java

1161

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT C Coding Standard.

Java

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

Java

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

Java

1164

The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.

Java

1165

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.

Java

1166

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) section of the SEI CERT C Coding Standard.

Java

1167

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) section of the SEI CERT C Coding Standard.

Java

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

Java

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

Java

1171

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard.

Java

1172

Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.

Java

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

Java

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

Java

1180

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard.

Java

1181

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.

Java

1182

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard.

Java

1186

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.

Java

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Java

1198

Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.

Java

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

Java

1202

Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).

Java

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

Java

1208

Weaknesses in this category can arise in multiple areas of hardware design or can apply to a wide cross-section of components.

Java

1210

Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.

Java

1211

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

Java

1212

Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.

Java

1213

Weaknesses in this category are related to a software system's random number generation.

Java

1214

Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.

Java

1215

Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.

Java

1217

Weaknesses in this category are related to session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed.

Java

1219

Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.

Java

1228

Weaknesses in this category are related to the use of built-in functions or external APIs.

Java

1238

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Memory cluster (SFP38).

Java

1275

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

Java

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

Java

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

Java

1307

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.

Java

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

Java

1309

Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.

Java

1327

The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

Java

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

Java

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

Java

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

Java

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

Java

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

Java

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

Java

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

Java

1349

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.

Java

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

Java

1352

Weaknesses in this category are related to the A06 category "Vulnerable and Outdated Components" in the OWASP Top 10 2021.

Java

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

Java

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

Java

1355

Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top 10 2021.

Java

1356

Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top 10 2021.

Java

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Java

1359

Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Java

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Java

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Java

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Java

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Java

1364

Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Java

1366

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Java

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Java

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Java

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Java

1371

Weaknesses in this category are related to the "Poorly Documented or Undocumented Features" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Undocumented capabilities and configurations pose a risk by not having a clear understanding of what the device is specifically supposed to do and only do. Therefore possibly opening up the attack surface and vulnerabilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Java

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Java

1373

Weaknesses in this category are related to the "Trust Model Problems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Assumptions made about the user during the design or construction phase may result in vulnerabilities after the system is installed if the user operates it using a different security approach or process than what was designed or built." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Java

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Java

1376

Weaknesses in this category are related to the "Security Gaps in Commissioning" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "As a large system is brought online components of the system may remain vulnerable until the entire system is operating and functional and security controls are put in place. This creates a window of opportunity for an adversary during the commissioning process." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Java

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Java

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Java

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

Java

1396

Weaknesses in this category are related to access control.

Java

1397

Weaknesses in this category are related to comparison.

Java

1398

Weaknesses in this category are related to component interaction.

Java

1399

Weaknesses in this category are related to memory safety.

Java

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

Java

1401

Weaknesses in this category are related to concurrency.

Java

1402

Weaknesses in this category are related to encryption.

Java

1403

Weaknesses in this category are related to exposed resource.

Java

1404

Weaknesses in this category are related to file handling.

Java

1405

Weaknesses in this category are related to improper check or handling of exceptional conditions.

Java

1406

Weaknesses in this category are related to improper input validation.

Java

1407

Weaknesses in this category are related to improper neutralization.

Java

1408

Weaknesses in this category are related to incorrect calculation.

Java

1409

Weaknesses in this category are related to injection.

Java

1410

Weaknesses in this category are related to insufficient control flow management.

Java

1411

Weaknesses in this category are related to insufficient verification of data authenticity.

Java

1412

Weaknesses in this category are related to poor coding practices.

Java

1413

Weaknesses in this category are related to protection mechanism failure.

Java

1414

Weaknesses in this category are related to randomness.

Java

1415

Weaknesses in this category are related to resource control.

Java

1416

Weaknesses in this category are related to resource lifecycle management.

Java

1417

Weaknesses in this category are related to sensitive information exposure.

Java

1418

Weaknesses in this category are related to violation of secure design principles.

JavaScript

2

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

JavaScript

4

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

JavaScript

5

Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

JavaScript

16

Weaknesses in this category are typically introduced during the configuration of the software.

JavaScript

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

JavaScript

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

JavaScript

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

JavaScript

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

JavaScript

21

This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).

JavaScript

22

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

JavaScript

23

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

JavaScript

36

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

JavaScript

73

The product allows user input to control or influence paths or file names that are used in filesystem operations.

JavaScript

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

JavaScript

77

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

JavaScript

78

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

JavaScript

79

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

JavaScript

80

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

JavaScript

82

The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

JavaScript

83

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

JavaScript

85

The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.

JavaScript

86

The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

JavaScript

87

The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

JavaScript

88

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

JavaScript

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

JavaScript

93

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

JavaScript

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

JavaScript

95

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

JavaScript

99

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

JavaScript

113

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

JavaScript

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

JavaScript

117

The product does not neutralize or incorrectly neutralizes output that is written to logs.

JavaScript

133

Weaknesses in this category are related to the creation and modification of strings.

JavaScript

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

JavaScript

138

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

JavaScript

140

The product does not neutralize or incorrectly neutralizes delimiters.

JavaScript

141

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

JavaScript

142

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

JavaScript

143

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.

JavaScript

146

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

JavaScript

149

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

JavaScript

150

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

JavaScript

157

The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.

JavaScript

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

JavaScript

183

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

JavaScript

185

The product specifies a regular expression in a way that causes data to be improperly matched or compared.

JavaScript

187

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

JavaScript

199

Weaknesses in this category are related to improper handling of sensitive information.

JavaScript

200

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

JavaScript

201

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

JavaScript

209

The product generates an error message that includes sensitive information about its environment, users, or associated data.

JavaScript

210

The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

JavaScript

211

The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

JavaScript

215

The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

JavaScript

221

The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

JavaScript

223

The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

JavaScript

226

The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

JavaScript

227

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."

JavaScript

228

The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.

JavaScript

233

The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.

JavaScript

248

An exception is thrown from a function, but it is not caught.

JavaScript

249

This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.

JavaScript

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

JavaScript

255

Weaknesses in this category are related to the management of credentials.

JavaScript

256

Storing a password in plaintext may result in a system compromise.

JavaScript

257

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

JavaScript

258

Using an empty string as a password is insecure.

JavaScript

260

The product stores a password in a configuration file that might be accessible to actors who do not know the password.

JavaScript

263

The product supports password aging, but the expiration period is too long.

JavaScript

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

JavaScript

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

JavaScript

269

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

JavaScript

271

The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.

JavaScript

272

The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

JavaScript

275

Weaknesses in this category are related to improper assignment or handling of permissions.

JavaScript

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

JavaScript

285

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

JavaScript

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

JavaScript

289

The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

JavaScript

290

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

JavaScript

295

The product does not validate, or incorrectly validates, a certificate.

JavaScript

296

The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

JavaScript

300

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

JavaScript

304

The product implements an authentication technique, but it skips a step that weakens the technique.

JavaScript

305

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

JavaScript

306

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

JavaScript

307

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

JavaScript

308

The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.

JavaScript

309

The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.

JavaScript

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

JavaScript

311

The product does not encrypt sensitive or critical information before storage or transmission.

JavaScript

312

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

JavaScript

313

The product stores sensitive information in cleartext in a file, or on disk.

JavaScript

314

The product stores sensitive information in cleartext in the registry.

JavaScript

315

The product stores sensitive information in cleartext in a cookie.

JavaScript

317

The product stores sensitive information in cleartext within the GUI.

JavaScript

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

JavaScript

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

JavaScript

322

The product performs a key exchange with an actor without verifying the identity of that actor.

JavaScript

324

The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

JavaScript

326

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

JavaScript

327

The product uses a broken or risky cryptographic algorithm or protocol.

JavaScript

328

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

JavaScript

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

JavaScript

338

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

JavaScript

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

JavaScript

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

JavaScript

346

The product does not properly verify that the source of data or communication is valid.

JavaScript

347

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

JavaScript

352

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

JavaScript

353

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

JavaScript

355

Weaknesses in this category are related to or introduced in the User Interface (UI).

JavaScript

358

The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

JavaScript

359

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

JavaScript

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

JavaScript

371

Weaknesses in this category are related to improper management of system state.

JavaScript

388

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

JavaScript

389

This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.

JavaScript

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

JavaScript

399

Weaknesses in this category are related to improper management of system resources.

JavaScript

400

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

JavaScript

404

The product does not release or incorrectly releases a resource before it is made available for re-use.

JavaScript

405

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

JavaScript

409

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

JavaScript

417

Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.

JavaScript

418

This category has been deprecated because it redundant with the grouping provided by CWE-417.

JavaScript

419

The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.

JavaScript

435

An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

JavaScript

436

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

JavaScript

438

Weaknesses in this category are related to unexpected behaviors from code that an application uses.

JavaScript

441

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

JavaScript

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

JavaScript

452

Weaknesses in this category occur in behaviors that are used for initialization and breakdown.

JavaScript

455

The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.

JavaScript

459

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

JavaScript

461

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

JavaScript

463

The accidental deletion of a data-structure sentinel can cause serious programming logic problems.

JavaScript

465

Weaknesses in this category are related to improper handling of pointers.

JavaScript

476

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

JavaScript

480

The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

JavaScript

483

The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.

JavaScript

484

The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.

JavaScript

485

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

JavaScript

489

The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

JavaScript

497

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

JavaScript

502

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

JavaScript

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

JavaScript

506

The product contains code that appears to be malicious in nature.

JavaScript

521

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

JavaScript

522

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

JavaScript

523

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

JavaScript

524

The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

JavaScript

525

The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

JavaScript

526

The product uses an environment variable to store unencrypted sensitive information.

JavaScript

530

A backup file is stored in a directory or archive that is made accessible to unauthorized actors.

JavaScript

532

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

JavaScript

536

A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.

JavaScript

538

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

JavaScript

539

The web application uses persistent cookies, but the cookies contain sensitive information.

JavaScript

548

A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers.

JavaScript

549

The product does not mask passwords during entry, increasing the potential for attackers to observe and capture passwords.

JavaScript

550

Certain conditions, such as network failure, will cause a server error message to be displayed.

JavaScript

552

The product makes files or directories accessible to unauthorized actors, even though they should not be.

JavaScript

559

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

JavaScript

561

The product contains dead code, which can never be executed.

JavaScript

565

The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

JavaScript

566

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

JavaScript

569

Weaknesses in this category are related to incorrectly written expressions within code.

JavaScript

573

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

JavaScript

592

This weakness has been deprecated because it covered redundant concepts already described in CWE-287.

JavaScript

601

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

JavaScript

602

The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

JavaScript

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

JavaScript

611

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

JavaScript

613

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

JavaScript

614

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

JavaScript

624

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

JavaScript

625

The product uses a regular expression that does not sufficiently restrict the set of allowed values.

JavaScript

628

The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

JavaScript

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

JavaScript

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

JavaScript

633

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

JavaScript

634

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

JavaScript

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

JavaScript

636

When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

JavaScript

639

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

JavaScript

642

The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.

JavaScript

644

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

JavaScript

654

A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.

JavaScript

657

The product violates well-established principles for secure design.

JavaScript

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

JavaScript

665

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

JavaScript

666

The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.

JavaScript

668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

JavaScript

669

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

JavaScript

670

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

JavaScript

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

JavaScript

672

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

JavaScript

674

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

JavaScript

676

The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.

JavaScript

688

The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.

JavaScript

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

JavaScript

692

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

JavaScript

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

JavaScript

697

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

JavaScript

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

JavaScript

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

JavaScript

703

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

JavaScript

705

The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.

JavaScript

706

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

JavaScript

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

JavaScript

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

JavaScript

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

JavaScript

712

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.

JavaScript

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

JavaScript

714

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.

JavaScript

715

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.

JavaScript

716

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.

JavaScript

717

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.

JavaScript

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

JavaScript

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

JavaScript

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

JavaScript

721

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.

JavaScript

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

JavaScript

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

JavaScript

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

JavaScript

725

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.

JavaScript

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

JavaScript

728

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.

JavaScript

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

JavaScript

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

JavaScript

731

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.

JavaScript

732

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

JavaScript

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

JavaScript

736

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008).

JavaScript

737

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).

JavaScript

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

JavaScript

740

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008).

JavaScript

741

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).

JavaScript

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

JavaScript

743

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

JavaScript

744

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).

JavaScript

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

JavaScript

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

JavaScript

748

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).

JavaScript

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

JavaScript

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

JavaScript

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

JavaScript

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

JavaScript

755

The product does not handle or incorrectly handles an exceptional condition.

JavaScript

757

A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

JavaScript

759

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

JavaScript

760

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.

JavaScript

776

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

JavaScript

778

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

JavaScript

779

The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.

JavaScript

783

The product uses an expression in which operator precedence causes incorrect logic to be used.

JavaScript

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

JavaScript

799

The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

JavaScript

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

JavaScript

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

JavaScript

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

JavaScript

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

JavaScript

807

The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

JavaScript

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

JavaScript

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

JavaScript

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

JavaScript

811

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.

JavaScript

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

JavaScript

813

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.

JavaScript

814

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.

JavaScript

815

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.

JavaScript

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

JavaScript

817

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.

JavaScript

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

JavaScript

819

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2010.

JavaScript

829

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

JavaScript

834

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

JavaScript

840

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

JavaScript

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

JavaScript

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

JavaScript

846

Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

JavaScript

850

Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

JavaScript

851

Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

JavaScript

854

Weaknesses in this category are related to rules in the Thread APIs (THI) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

JavaScript

855

Weaknesses in this category are related to rules in the Thread Pools (TPS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

JavaScript

857

Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

JavaScript

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

JavaScript

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

JavaScript

860

Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

JavaScript

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

JavaScript

862

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

JavaScript

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

JavaScript

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

JavaScript

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

JavaScript

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

JavaScript

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

JavaScript

871

Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

JavaScript

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

JavaScript

874

Weaknesses in this category are related to rules in the Arrays and the STL (ARR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

JavaScript

875

Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

JavaScript

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

JavaScript

877

Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

JavaScript

878

Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

JavaScript

880

Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

JavaScript

881

Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

JavaScript

882

Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

JavaScript

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

JavaScript

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

JavaScript

885

This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

JavaScript

886

This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).

JavaScript

887

This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

JavaScript

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

JavaScript

889

This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

JavaScript

890

This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).

JavaScript

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

JavaScript

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

JavaScript

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

JavaScript

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

JavaScript

897

This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28).

JavaScript

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

JavaScript

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

JavaScript

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

JavaScript

901

This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36).

JavaScript

902

This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

JavaScript

903

This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

JavaScript

904

This category identifies Software Fault Patterns (SFPs) within the Malware cluster.

JavaScript

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

JavaScript

906

This category identifies Software Fault Patterns (SFPs) within the UI cluster.

JavaScript

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

JavaScript

908

The product uses or accesses a resource that has not been initialized.

JavaScript

912

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

JavaScript

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

JavaScript

916

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

JavaScript

917

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

JavaScript

918

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

JavaScript

921

The product stores sensitive information in a file system or device that does not have built-in access control.

JavaScript

922

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

JavaScript

923

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

JavaScript

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

JavaScript

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

JavaScript

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

JavaScript

931

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2013.

JavaScript

932

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.

JavaScript

933

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.

JavaScript

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

JavaScript

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

JavaScript

936

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2013.

JavaScript

938

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2013.

JavaScript

942

The product uses a cross-domain policy file that includes domains that should not be trusted.

JavaScript

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

JavaScript

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

JavaScript

945

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).

JavaScript

946

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster.

JavaScript

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

JavaScript

948

This category identifies Software Fault Patterns (SFPs) within the Digital Certificate cluster.

JavaScript

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

JavaScript

950

This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).

JavaScript

951

This category identifies Software Fault Patterns (SFPs) within the Insecure Authentication Policy cluster.

JavaScript

952

This category identifies Software Fault Patterns (SFPs) within the Missing Authentication cluster.

JavaScript

955

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Authentication cluster (SFP34).

JavaScript

956

This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.

JavaScript

957

This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.

JavaScript

958

This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.

JavaScript

959

This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.

JavaScript

961

This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).

JavaScript

962

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

JavaScript

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

JavaScript

965

This category identifies Software Fault Patterns (SFPs) within the Insecure Session Management cluster.

JavaScript

966

This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.

JavaScript

971

This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).

JavaScript

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

JavaScript

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

JavaScript

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

JavaScript

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

JavaScript

981

This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).

JavaScript

982

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).

JavaScript

983

This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Use cluster (SFP15).

JavaScript

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

JavaScript

985

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).

JavaScript

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

JavaScript

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

JavaScript

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

JavaScript

993

This category identifies Software Fault Patterns (SFPs) within the Incorrect Input Handling cluster.

JavaScript

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

JavaScript

995

This category identifies Software Fault Patterns (SFPs) within the Feature cluster.

JavaScript

997

This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster.

JavaScript

998

This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).

JavaScript

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

JavaScript

1001

This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).

JavaScript

1002

This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster.

JavaScript

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

JavaScript

1004

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

JavaScript

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

JavaScript

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

JavaScript

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

JavaScript

1009

Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.

JavaScript

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

JavaScript

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

JavaScript

1012

Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.

JavaScript

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

JavaScript

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

JavaScript

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

JavaScript

1016

Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.

JavaScript

1018

Weaknesses in this category are related to the design and architecture of session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed when designing or implementing a secure architecture.

JavaScript

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

JavaScript

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

JavaScript

1021

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

JavaScript

1022

The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.

JavaScript

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

JavaScript

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

JavaScript

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

JavaScript

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

JavaScript

1030

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2017.

JavaScript

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

JavaScript

1032

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.

JavaScript

1033

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2017.

JavaScript

1034

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2017.

JavaScript

1036

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2017.

JavaScript

1041

The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

JavaScript

1078

The source code does not follow desired style or formatting for indentation, white space, comments, etc.

JavaScript

1104

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

JavaScript

1114

The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.

JavaScript

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

JavaScript

1129

Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software.

JavaScript

1130

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.

JavaScript

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

JavaScript

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

JavaScript

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

JavaScript

1135

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Oracle Secure Coding Standard for Java.

JavaScript

1136

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.

JavaScript

1140

Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

JavaScript

1141

Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.

JavaScript

1145

Weaknesses in this category are related to the rules and recommendations in the Thread Pools (TPS) section of the SEI CERT Oracle Secure Coding Standard for Java.

JavaScript

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

JavaScript

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

JavaScript

1149

Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.

JavaScript

1150

Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java.

JavaScript

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

JavaScript

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

JavaScript

1157

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.

JavaScript

1161

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT C Coding Standard.

JavaScript

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

JavaScript

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

JavaScript

1164

The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.

JavaScript

1165

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.

JavaScript

1167

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) section of the SEI CERT C Coding Standard.

JavaScript

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

JavaScript

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

JavaScript

1172

Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.

JavaScript

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

JavaScript

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

JavaScript

1180

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard.

JavaScript

1181

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.

JavaScript

1186

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.

JavaScript

1187

This entry has been deprecated because it was a duplicate of CWE-908. All content has been transferred to CWE-908.

JavaScript

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

JavaScript

1198

Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.

JavaScript

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

JavaScript

1202

Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).

JavaScript

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

JavaScript

1210

Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.

JavaScript

1211

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

JavaScript

1212

Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.

JavaScript

1213

Weaknesses in this category are related to a software system's random number generation.

JavaScript

1214

Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.

JavaScript

1215

Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.

JavaScript

1217

Weaknesses in this category are related to session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed.

JavaScript

1219

Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.

JavaScript

1228

Weaknesses in this category are related to the use of built-in functions or external APIs.

JavaScript

1275

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

JavaScript

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

JavaScript

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

JavaScript

1307

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.

JavaScript

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

JavaScript

1309

Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.

JavaScript

1327

The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

JavaScript

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

JavaScript

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

JavaScript

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

JavaScript

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

JavaScript

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

JavaScript

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

JavaScript

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

JavaScript

1349

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.

JavaScript

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

JavaScript

1352

Weaknesses in this category are related to the A06 category "Vulnerable and Outdated Components" in the OWASP Top 10 2021.

JavaScript

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

JavaScript

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

JavaScript

1355

Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top 10 2021.

JavaScript

1356

Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top 10 2021.

JavaScript

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

JavaScript

1359

Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

JavaScript

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

JavaScript

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

JavaScript

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

JavaScript

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

JavaScript

1364

Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

JavaScript

1366

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

JavaScript

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

JavaScript

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

JavaScript

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

JavaScript

1371

Weaknesses in this category are related to the "Poorly Documented or Undocumented Features" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Undocumented capabilities and configurations pose a risk by not having a clear understanding of what the device is specifically supposed to do and only do. Therefore possibly opening up the attack surface and vulnerabilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

JavaScript

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

JavaScript

1373

Weaknesses in this category are related to the "Trust Model Problems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Assumptions made about the user during the design or construction phase may result in vulnerabilities after the system is installed if the user operates it using a different security approach or process than what was designed or built." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

JavaScript

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

JavaScript

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

JavaScript

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

JavaScript

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

JavaScript

1396

Weaknesses in this category are related to access control.

JavaScript

1397

Weaknesses in this category are related to comparison.

JavaScript

1398

Weaknesses in this category are related to component interaction.

JavaScript

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

JavaScript

1402

Weaknesses in this category are related to encryption.

JavaScript

1403

Weaknesses in this category are related to exposed resource.

JavaScript

1404

Weaknesses in this category are related to file handling.

JavaScript

1405

Weaknesses in this category are related to improper check or handling of exceptional conditions.

JavaScript

1406

Weaknesses in this category are related to improper input validation.

JavaScript

1407

Weaknesses in this category are related to improper neutralization.

JavaScript

1409

Weaknesses in this category are related to injection.

JavaScript

1410

Weaknesses in this category are related to insufficient control flow management.

JavaScript

1411

Weaknesses in this category are related to insufficient verification of data authenticity.

JavaScript

1412

Weaknesses in this category are related to poor coding practices.

JavaScript

1413

Weaknesses in this category are related to protection mechanism failure.

JavaScript

1414

Weaknesses in this category are related to randomness.

JavaScript

1415

Weaknesses in this category are related to resource control.

JavaScript

1416

Weaknesses in this category are related to resource lifecycle management.

JavaScript

1417

Weaknesses in this category are related to sensitive information exposure.

JavaScript

1418

Weaknesses in this category are related to violation of secure design principles.

Kotlin

2

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

Kotlin

4

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Kotlin

5

Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

Kotlin

16

Weaknesses in this category are typically introduced during the configuration of the software.

Kotlin

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Kotlin

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Kotlin

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

Kotlin

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Kotlin

21

This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).

Kotlin

22

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Kotlin

23

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Kotlin

36

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

Kotlin

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Kotlin

77

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Kotlin

78

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Kotlin

88

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Kotlin

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Kotlin

91

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Kotlin

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Kotlin

95

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Kotlin

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Kotlin

117

The product does not neutralize or incorrectly neutralizes output that is written to logs.

Kotlin

118

The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.

Kotlin

119

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Kotlin

133

Weaknesses in this category are related to the creation and modification of strings.

Kotlin

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

Kotlin

138

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

Kotlin

140

The product does not neutralize or incorrectly neutralizes delimiters.

Kotlin

141

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

Kotlin

142

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

Kotlin

143

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.

Kotlin

146

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

Kotlin

149

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

Kotlin

150

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Kotlin

157

The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.

Kotlin

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

Kotlin

185

The product specifies a regular expression in a way that causes data to be improperly matched or compared.

Kotlin

189

Weaknesses in this category are related to improper calculation or conversion of numbers.

Kotlin

190

The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

Kotlin

199

Weaknesses in this category are related to improper handling of sensitive information.

Kotlin

200

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Kotlin

201

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Kotlin

209

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Kotlin

210

The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

Kotlin

211

The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

Kotlin

221

The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

Kotlin

223

The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

Kotlin

226

The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

Kotlin

227

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."

Kotlin

242

The product calls a function that can never be guaranteed to work safely.

Kotlin

249

This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.

Kotlin

252

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Kotlin

253

The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.

Kotlin

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Kotlin

255

Weaknesses in this category are related to the management of credentials.

Kotlin

256

Storing a password in plaintext may result in a system compromise.

Kotlin

257

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

Kotlin

259

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

Kotlin

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Kotlin

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

Kotlin

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Kotlin

285

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Kotlin

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Kotlin

295

The product does not validate, or incorrectly validates, a certificate.

Kotlin

296

The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

Kotlin

297

The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Kotlin

299

The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

Kotlin

300

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

Kotlin

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Kotlin

311

The product does not encrypt sensitive or critical information before storage or transmission.

Kotlin

312

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Kotlin

313

The product stores sensitive information in cleartext in a file, or on disk.

Kotlin

314

The product stores sensitive information in cleartext in the registry.

Kotlin

315

The product stores sensitive information in cleartext in a cookie.

Kotlin

317

The product stores sensitive information in cleartext within the GUI.

Kotlin

318

The product stores sensitive information in cleartext in an executable.

Kotlin

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Kotlin

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

Kotlin

321

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

Kotlin

326

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Kotlin

327

The product uses a broken or risky cryptographic algorithm or protocol.

Kotlin

328

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

Kotlin

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Kotlin

335

The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

Kotlin

336

A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.

Kotlin

337

A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.

Kotlin

338

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Kotlin

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

Kotlin

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Kotlin

353

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

Kotlin

355

Weaknesses in this category are related to or introduced in the User Interface (UI).

Kotlin

359

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Kotlin

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

Kotlin

362

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

Kotlin

366

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

Kotlin

369

The product divides a value by zero.

Kotlin

380

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Kotlin

381

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Kotlin

388

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

Kotlin

389

This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.

Kotlin

390

The product detects a specific error, but takes no actions to handle the error.

Kotlin

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

Kotlin

399

Weaknesses in this category are related to improper management of system resources.

Kotlin

402

The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.

Kotlin

403

A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.

Kotlin

404

The product does not release or incorrectly releases a resource before it is made available for re-use.

Kotlin

405

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Kotlin

409

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Kotlin

411

Weaknesses in this category are related to improper handling of locks that are used to control access to resources.

Kotlin

417

Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.

Kotlin

427

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Kotlin

438

Weaknesses in this category are related to unexpected behaviors from code that an application uses.

Kotlin

441

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Kotlin

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Kotlin

452

Weaknesses in this category occur in behaviors that are used for initialization and breakdown.

Kotlin

459

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Kotlin

465

Weaknesses in this category are related to improper handling of pointers.

Kotlin

470

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Kotlin

476

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Kotlin

480

The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

Kotlin

483

The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.

Kotlin

485

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

Kotlin

497

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Kotlin

502

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Kotlin

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

Kotlin

522

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Kotlin

523

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

Kotlin

532

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Kotlin

536

A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.

Kotlin

538

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Kotlin

539

The web application uses persistent cookies, but the cookies contain sensitive information.

Kotlin

543

The product uses the singleton pattern when creating a resource within a multithreaded environment.

Kotlin

550

Certain conditions, such as network failure, will cause a server error message to be displayed.

Kotlin

552

The product makes files or directories accessible to unauthorized actors, even though they should not be.

Kotlin

557

Weaknesses in this category are related to concurrent use of shared resources.

Kotlin

559

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Kotlin

561

The product contains dead code, which can never be executed.

Kotlin

563

The variable's value is assigned but never used, making it a dead store.

Kotlin

566

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

Kotlin

567

The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.

Kotlin

569

Weaknesses in this category are related to incorrectly written expressions within code.

Kotlin

573

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

Kotlin

596

This weakness has been deprecated. It was poorly described and difficult to distinguish from other entries. It was also inappropriate to assign a separate ID solely because of domain-specific considerations. Its closest equivalent is CWE-1023.

Kotlin

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Kotlin

611

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Kotlin

624

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

Kotlin

628

The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

Kotlin

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Kotlin

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Kotlin

633

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Kotlin

634

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Kotlin

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

Kotlin

639

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Kotlin

643

The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

Kotlin

644

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

Kotlin

657

The product violates well-established principles for secure design.

Kotlin

662

The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

Kotlin

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Kotlin

667

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Kotlin

668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Kotlin

669

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Kotlin

670

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

Kotlin

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

Kotlin

674

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Kotlin

682

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Kotlin

683

The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.

Kotlin

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

Kotlin

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Kotlin

697

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

Kotlin

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Kotlin

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

Kotlin

703

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Kotlin

706

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Kotlin

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

Kotlin

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Kotlin

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Kotlin

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

Kotlin

714

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.

Kotlin

715

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.

Kotlin

717

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.

Kotlin

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

Kotlin

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

Kotlin

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

Kotlin

721

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.

Kotlin

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

Kotlin

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

Kotlin

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

Kotlin

725

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.

Kotlin

726

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2004.

Kotlin

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

Kotlin

728

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.

Kotlin

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

Kotlin

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

Kotlin

731

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.

Kotlin

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

Kotlin

736

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008).

Kotlin

737

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).

Kotlin

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

Kotlin

739

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008).

Kotlin

740

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008).

Kotlin

741

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).

Kotlin

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

Kotlin

743

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

Kotlin

744

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).

Kotlin

745

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) chapter of the CERT C Secure Coding Standard (2008).

Kotlin

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

Kotlin

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

Kotlin

748

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).

Kotlin

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Kotlin

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

Kotlin

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

Kotlin

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

Kotlin

754

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Kotlin

755

The product does not handle or incorrectly handles an exceptional condition.

Kotlin

759

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

Kotlin

760

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.

Kotlin

776

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Kotlin

778

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

Kotlin

783

The product uses an expression in which operator precedence causes incorrect logic to be used.

Kotlin

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Kotlin

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Kotlin

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

Kotlin

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

Kotlin

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

Kotlin

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Kotlin

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Kotlin

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

Kotlin

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

Kotlin

813

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.

Kotlin

815

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.

Kotlin

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

Kotlin

817

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.

Kotlin

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

Kotlin

820

The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

Kotlin

827

The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.

Kotlin

829

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Kotlin

833

The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

Kotlin

834

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Kotlin

835

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Kotlin

840

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

Kotlin

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

Kotlin

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Kotlin

847

Weaknesses in this category are related to rules in the Expressions (EXP) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Kotlin

848

Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Kotlin

850

Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Kotlin

851

Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Kotlin

852

Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Kotlin

853

Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Kotlin

855

Weaknesses in this category are related to rules in the Thread Pools (TPS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Kotlin

857

Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Kotlin

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Kotlin

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Kotlin

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Kotlin

862

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Kotlin

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Kotlin

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Kotlin

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Kotlin

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Kotlin

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

Kotlin

871

Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Kotlin

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Kotlin

873

Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Kotlin

874

Weaknesses in this category are related to rules in the Arrays and the STL (ARR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Kotlin

875

Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Kotlin

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Kotlin

877

Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Kotlin

878

Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Kotlin

879

Weaknesses in this category are related to rules in the Signals (SIG) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Kotlin

880

Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Kotlin

881

Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Kotlin

882

Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Kotlin

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Kotlin

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

Kotlin

885

This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

Kotlin

886

This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).

Kotlin

887

This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

Kotlin

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

Kotlin

889

This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

Kotlin

890

This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).

Kotlin

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

Kotlin

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

Kotlin

894

This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22).

Kotlin

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

Kotlin

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

Kotlin

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

Kotlin

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

Kotlin

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Kotlin

902

This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

Kotlin

903

This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

Kotlin

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

Kotlin

906

This category identifies Software Fault Patterns (SFPs) within the UI cluster.

Kotlin

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

Kotlin

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Kotlin

916

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Kotlin

918

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Kotlin

921

The product stores sensitive information in a file system or device that does not have built-in access control.

Kotlin

922

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Kotlin

923

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Kotlin

925

The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.

Kotlin

926

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.

Kotlin

927

The Android application uses an implicit intent for transmitting sensitive data to other applications.

Kotlin

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Kotlin

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

Kotlin

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

Kotlin

932

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.

Kotlin

933

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.

Kotlin

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

Kotlin

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

Kotlin

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Kotlin

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

Kotlin

945

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).

Kotlin

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

Kotlin

948

This category identifies Software Fault Patterns (SFPs) within the Digital Certificate cluster.

Kotlin

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

Kotlin

950

This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).

Kotlin

956

This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.

Kotlin

957

This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.

Kotlin

958

This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.

Kotlin

959

This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.

Kotlin

961

This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).

Kotlin

962

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

Kotlin

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

Kotlin

966

This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.

Kotlin

970

This category identifies Software Fault Patterns (SFPs) within the Faulty Buffer Access cluster (SFP8).

Kotlin

971

This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).

Kotlin

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

Kotlin

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

Kotlin

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

Kotlin

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

Kotlin

981

This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).

Kotlin

982

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).

Kotlin

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

Kotlin

985

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).

Kotlin

986

This category identifies Software Fault Patterns (SFPs) within the Missing Lock cluster (SFP19).

Kotlin

988

This category identifies Software Fault Patterns (SFPs) within the Race Condition Window cluster (SFP20).

Kotlin

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

Kotlin

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

Kotlin

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

Kotlin

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

Kotlin

997

This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster.

Kotlin

998

This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).

Kotlin

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

Kotlin

1001

This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).

Kotlin

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

Kotlin

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

Kotlin

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

Kotlin

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

Kotlin

1009

Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.

Kotlin

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Kotlin

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

Kotlin

1012

Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.

Kotlin

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

Kotlin

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

Kotlin

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Kotlin

1016

Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.

Kotlin

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

Kotlin

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

Kotlin

1023

The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Kotlin

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

Kotlin

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

Kotlin

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

Kotlin

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

Kotlin

1030

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2017.

Kotlin

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

Kotlin

1032

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.

Kotlin

1034

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2017.

Kotlin

1036

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2017.

Kotlin

1041

The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

Kotlin

1078

The source code does not follow desired style or formatting for indentation, white space, comments, etc.

Kotlin

1114

The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.

Kotlin

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

Kotlin

1129

Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software.

Kotlin

1130

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.

Kotlin

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

Kotlin

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

Kotlin

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

Kotlin

1136

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.

Kotlin

1137

Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java.

Kotlin

1140

Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

Kotlin

1141

Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.

Kotlin

1142

Weaknesses in this category are related to the rules and recommendations in the Visibility and Atomicity (VNA) section of the SEI CERT Oracle Secure Coding Standard for Java.

Kotlin

1143

Weaknesses in this category are related to the rules and recommendations in the Locking (LCK) section of the SEI CERT Oracle Secure Coding Standard for Java.

Kotlin

1145

Weaknesses in this category are related to the rules and recommendations in the Thread Pools (TPS) section of the SEI CERT Oracle Secure Coding Standard for Java.

Kotlin

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

Kotlin

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

Kotlin

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

Kotlin

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

Kotlin

1157

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.

Kotlin

1158

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard.

Kotlin

1159

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard.

Kotlin

1160

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) section of the SEI CERT C Coding Standard.

Kotlin

1161

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT C Coding Standard.

Kotlin

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

Kotlin

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

Kotlin

1164

The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.

Kotlin

1165

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.

Kotlin

1166

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) section of the SEI CERT C Coding Standard.

Kotlin

1167

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) section of the SEI CERT C Coding Standard.

Kotlin

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

Kotlin

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

Kotlin

1171

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard.

Kotlin

1172

Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.

Kotlin

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

Kotlin

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

Kotlin

1180

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard.

Kotlin

1181

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.

Kotlin

1182

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard.

Kotlin

1186

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.

Kotlin

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Kotlin

1198

Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.

Kotlin

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

Kotlin

1202

Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).

Kotlin

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

Kotlin

1210

Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.

Kotlin

1211

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

Kotlin

1212

Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.

Kotlin

1213

Weaknesses in this category are related to a software system's random number generation.

Kotlin

1214

Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.

Kotlin

1219

Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.

Kotlin

1228

Weaknesses in this category are related to the use of built-in functions or external APIs.

Kotlin

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

Kotlin

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

Kotlin

1307

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.

Kotlin

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

Kotlin

1309

Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.

Kotlin

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

Kotlin

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

Kotlin

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

Kotlin

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

Kotlin

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

Kotlin

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

Kotlin

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

Kotlin

1349

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.

Kotlin

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

Kotlin

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

Kotlin

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

Kotlin

1355

Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top 10 2021.

Kotlin

1356

Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top 10 2021.

Kotlin

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Kotlin

1359

Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Kotlin

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Kotlin

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Kotlin

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Kotlin

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Kotlin

1364

Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Kotlin

1366

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Kotlin

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Kotlin

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Kotlin

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Kotlin

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Kotlin

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Kotlin

1376

Weaknesses in this category are related to the "Security Gaps in Commissioning" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "As a large system is brought online components of the system may remain vulnerable until the entire system is operating and functional and security controls are put in place. This creates a window of opportunity for an adversary during the commissioning process." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Kotlin

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Kotlin

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Kotlin

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

Kotlin

1396

Weaknesses in this category are related to access control.

Kotlin

1397

Weaknesses in this category are related to comparison.

Kotlin

1399

Weaknesses in this category are related to memory safety.

Kotlin

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

Kotlin

1401

Weaknesses in this category are related to concurrency.

Kotlin

1402

Weaknesses in this category are related to encryption.

Kotlin

1403

Weaknesses in this category are related to exposed resource.

Kotlin

1404

Weaknesses in this category are related to file handling.

Kotlin

1405

Weaknesses in this category are related to improper check or handling of exceptional conditions.

Kotlin

1406

Weaknesses in this category are related to improper input validation.

Kotlin

1407

Weaknesses in this category are related to improper neutralization.

Kotlin

1408

Weaknesses in this category are related to incorrect calculation.

Kotlin

1409

Weaknesses in this category are related to injection.

Kotlin

1410

Weaknesses in this category are related to insufficient control flow management.

Kotlin

1411

Weaknesses in this category are related to insufficient verification of data authenticity.

Kotlin

1412

Weaknesses in this category are related to poor coding practices.

Kotlin

1413

Weaknesses in this category are related to protection mechanism failure.

Kotlin

1414

Weaknesses in this category are related to randomness.

Kotlin

1415

Weaknesses in this category are related to resource control.

Kotlin

1416

Weaknesses in this category are related to resource lifecycle management.

Kotlin

1417

Weaknesses in this category are related to sensitive information exposure.

Kotlin

1418

Weaknesses in this category are related to violation of secure design principles.

PHP

2

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

PHP

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

PHP

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

PHP

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

PHP

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

PHP

21

This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).

PHP

22

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

PHP

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

PHP

77

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

PHP

78

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

PHP

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

PHP

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

PHP

95

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

PHP

99

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

PHP

115

The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.

PHP

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

PHP

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

PHP

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

PHP

183

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

PHP

199

Weaknesses in this category are related to improper handling of sensitive information.

PHP

200

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

PHP

209

The product generates an error message that includes sensitive information about its environment, users, or associated data.

PHP

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

PHP

255

Weaknesses in this category are related to the management of credentials.

PHP

261

Obscuring a password with a trivial encoding does not protect the password.

PHP

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

PHP

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

PHP

275

Weaknesses in this category are related to improper assignment or handling of permissions.

PHP

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

PHP

285

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

PHP

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

PHP

295

The product does not validate, or incorrectly validates, a certificate.

PHP

306

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

PHP

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

PHP

311

The product does not encrypt sensitive or critical information before storage or transmission.

PHP

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

PHP

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

PHP

326

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

PHP

327

The product uses a broken or risky cryptographic algorithm or protocol.

PHP

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

PHP

338

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

PHP

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

PHP

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

PHP

346

The product does not properly verify that the source of data or communication is valid.

PHP

353

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

PHP

355

Weaknesses in this category are related to or introduced in the User Interface (UI).

PHP

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

PHP

384

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

PHP

388

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

PHP

389

This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.

PHP

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

PHP

399

Weaknesses in this category are related to improper management of system resources.

PHP

400

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

PHP

417

Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.

PHP

435

An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

PHP

436

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

PHP

438

Weaknesses in this category are related to unexpected behaviors from code that an application uses.

PHP

441

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

PHP

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

PHP

452

Weaknesses in this category occur in behaviors that are used for initialization and breakdown.

PHP

470

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

PHP

485

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

PHP

489

The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

PHP

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

PHP

521

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

PHP

522

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

PHP

523

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

PHP

524

The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

PHP

525

The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

PHP

538

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

PHP

539

The web application uses persistent cookies, but the cookies contain sensitive information.

PHP

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

PHP

613

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

PHP

614

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

PHP

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

PHP

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

PHP

634

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

PHP

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

PHP

657

The product violates well-established principles for secure design.

PHP

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

PHP

665

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

PHP

666

The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.

PHP

668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

PHP

669

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

PHP

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

PHP

672

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

PHP

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

PHP

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

PHP

697

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

PHP

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

PHP

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

PHP

703

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

PHP

706

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

PHP

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

PHP

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

PHP

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

PHP

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

PHP

714

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.

PHP

715

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.

PHP

717

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.

PHP

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

PHP

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

PHP

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

PHP

721

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.

PHP

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

PHP

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

PHP

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

PHP

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

PHP

728

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.

PHP

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

PHP

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

PHP

731

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.

PHP

732

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

PHP

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

PHP

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

PHP

740

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008).

PHP

741

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).

PHP

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

PHP

743

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

PHP

744

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).

PHP

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

PHP

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

PHP

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

PHP

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

PHP

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

PHP

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

PHP

755

The product does not handle or incorrectly handles an exceptional condition.

PHP

770

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

PHP

779

The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.

PHP

780

The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.

PHP

789

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

PHP

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

PHP

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

PHP

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

PHP

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

PHP

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

PHP

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

PHP

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

PHP

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

PHP

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

PHP

813

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.

PHP

815

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.

PHP

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

PHP

817

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.

PHP

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

PHP

829

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

PHP

840

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

PHP

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

PHP

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

PHP

846

Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

PHP

851

Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

PHP

857

Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

PHP

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

PHP

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

PHP

860

Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

PHP

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

PHP

862

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

PHP

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

PHP

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

PHP

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

PHP

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

PHP

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

PHP

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

PHP

874

Weaknesses in this category are related to rules in the Arrays and the STL (ARR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

PHP

875

Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

PHP

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

PHP

877

Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

PHP

878

Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

PHP

880

Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

PHP

881

Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

PHP

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

PHP

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

PHP

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

PHP

889

This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

PHP

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

PHP

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

PHP

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

PHP

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

PHP

897

This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28).

PHP

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

PHP

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

PHP

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

PHP

902

This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

PHP

903

This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

PHP

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

PHP

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

PHP

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

PHP

916

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

PHP

917

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

PHP

918

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

PHP

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

PHP

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

PHP

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

PHP

932

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.

PHP

933

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.

PHP

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

PHP

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

PHP

942

The product uses a cross-domain policy file that includes domains that should not be trusted.

PHP

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

PHP

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

PHP

945

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).

PHP

946

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster.

PHP

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

PHP

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

PHP

951

This category identifies Software Fault Patterns (SFPs) within the Insecure Authentication Policy cluster.

PHP

952

This category identifies Software Fault Patterns (SFPs) within the Missing Authentication cluster.

PHP

956

This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.

PHP

957

This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.

PHP

958

This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.

PHP

959

This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.

PHP

961

This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).

PHP

962

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

PHP

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

PHP

965

This category identifies Software Fault Patterns (SFPs) within the Insecure Session Management cluster.

PHP

966

This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.

PHP

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

PHP

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

PHP

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

PHP

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

PHP

981

This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).

PHP

983

This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Use cluster (SFP15).

PHP

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

PHP

985

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).

PHP

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

PHP

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

PHP

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

PHP

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

PHP

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

PHP

1002

This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster.

PHP

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

PHP

1004

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

PHP

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

PHP

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

PHP

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

PHP

1009

Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.

PHP

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

PHP

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

PHP

1012

Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.

PHP

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

PHP

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

PHP

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

PHP

1016

Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.

PHP

1018

Weaknesses in this category are related to the design and architecture of session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed when designing or implementing a secure architecture.

PHP

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

PHP

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

PHP

1021

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

PHP

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

PHP

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

PHP

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

PHP

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

PHP

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

PHP

1032

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.

PHP

1104

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

PHP

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

PHP

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

PHP

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

PHP

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

PHP

1135

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Oracle Secure Coding Standard for Java.

PHP

1140

Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

PHP

1141

Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.

PHP

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

PHP

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

PHP

1149

Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.

PHP

1150

Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java.

PHP

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

PHP

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

PHP

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

PHP

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

PHP

1165

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.

PHP

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

PHP

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

PHP

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

PHP

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

PHP

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

PHP

1198

Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.

PHP

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

PHP

1204

The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.

PHP

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

PHP

1210

Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.

PHP

1211

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

PHP

1213

Weaknesses in this category are related to a software system's random number generation.

PHP

1214

Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.

PHP

1215

Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.

PHP

1217

Weaknesses in this category are related to session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed.

PHP

1219

Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.

PHP

1275

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

PHP

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

PHP

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

PHP

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

PHP

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

PHP

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

PHP

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

PHP

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

PHP

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

PHP

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

PHP

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

PHP

1349

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.

PHP

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

PHP

1352

Weaknesses in this category are related to the A06 category "Vulnerable and Outdated Components" in the OWASP Top 10 2021.

PHP

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

PHP

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

PHP

1356

Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top 10 2021.

PHP

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

PHP

1359

Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

PHP

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

PHP

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

PHP

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

PHP

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

PHP

1364

Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

PHP

1366

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

PHP

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

PHP

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

PHP

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

PHP

1371

Weaknesses in this category are related to the "Poorly Documented or Undocumented Features" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Undocumented capabilities and configurations pose a risk by not having a clear understanding of what the device is specifically supposed to do and only do. Therefore possibly opening up the attack surface and vulnerabilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

PHP

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

PHP

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

PHP

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

PHP

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

PHP

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

PHP

1396

Weaknesses in this category are related to access control.

PHP

1397

Weaknesses in this category are related to comparison.

PHP

1398

Weaknesses in this category are related to component interaction.

PHP

1399

Weaknesses in this category are related to memory safety.

PHP

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

PHP

1402

Weaknesses in this category are related to encryption.

PHP

1403

Weaknesses in this category are related to exposed resource.

PHP

1404

Weaknesses in this category are related to file handling.

PHP

1405

Weaknesses in this category are related to improper check or handling of exceptional conditions.

PHP

1406

Weaknesses in this category are related to improper input validation.

PHP

1407

Weaknesses in this category are related to improper neutralization.

PHP

1409

Weaknesses in this category are related to injection.

PHP

1410

Weaknesses in this category are related to insufficient control flow management.

PHP

1411

Weaknesses in this category are related to insufficient verification of data authenticity.

PHP

1412

Weaknesses in this category are related to poor coding practices.

PHP

1413

Weaknesses in this category are related to protection mechanism failure.

PHP

1414

Weaknesses in this category are related to randomness.

PHP

1415

Weaknesses in this category are related to resource control.

PHP

1416

Weaknesses in this category are related to resource lifecycle management.

PHP

1417

Weaknesses in this category are related to sensitive information exposure.

PHP

1418

Weaknesses in this category are related to violation of secure design principles.

Python

2

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

Python

4

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Python

5

Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

Python

16

Weaknesses in this category are typically introduced during the configuration of the software.

Python

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Python

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Python

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

Python

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Python

21

This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).

Python

22

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Python

23

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Python

36

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

Python

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Python

77

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Python

78

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Python

79

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Python

80

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Python

82

The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

Python

83

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

Python

85

The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.

Python

86

The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

Python

87

The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

Python

88

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Python

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Python

91

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Python

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Python

95

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Python

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Python

117

The product does not neutralize or incorrectly neutralizes output that is written to logs.

Python

133

Weaknesses in this category are related to the creation and modification of strings.

Python

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

Python

138

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

Python

140

The product does not neutralize or incorrectly neutralizes delimiters.

Python

141

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

Python

142

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

Python

143

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.

Python

146

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

Python

149

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

Python

150

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Python

157

The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.

Python

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

Python

185

The product specifies a regular expression in a way that causes data to be improperly matched or compared.

Python

187

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

Python

199

Weaknesses in this category are related to improper handling of sensitive information.

Python

200

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Python

201

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Python

209

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Python

210

The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

Python

211

The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

Python

215

The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

Python

221

The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

Python

223

The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

Python

226

The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

Python

227

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."

Python

249

This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.

Python

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Python

255

Weaknesses in this category are related to the management of credentials.

Python

256

Storing a password in plaintext may result in a system compromise.

Python

257

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

Python

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Python

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

Python

275

Weaknesses in this category are related to improper assignment or handling of permissions.

Python

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Python

285

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Python

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Python

290

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Python

295

The product does not validate, or incorrectly validates, a certificate.

Python

300

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

Python

304

The product implements an authentication technique, but it skips a step that weakens the technique.

Python

306

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Python

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Python

311

The product does not encrypt sensitive or critical information before storage or transmission.

Python

312

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Python

313

The product stores sensitive information in cleartext in a file, or on disk.

Python

314

The product stores sensitive information in cleartext in the registry.

Python

315

The product stores sensitive information in cleartext in a cookie.

Python

317

The product stores sensitive information in cleartext within the GUI.

Python

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Python

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

Python

326

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Python

327

The product uses a broken or risky cryptographic algorithm or protocol.

Python

328

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

Python

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Python

338

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Python

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

Python

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Python

346

The product does not properly verify that the source of data or communication is valid.

Python

352

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Python

353

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

Python

355

Weaknesses in this category are related to or introduced in the User Interface (UI).

Python

359

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Python

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

Python

376

This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. Consider using the File Handling Issues category (CWE-1219).

Python

377

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Python

388

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

Python

389

This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.

Python

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

Python

399

Weaknesses in this category are related to improper management of system resources.

Python

404

The product does not release or incorrectly releases a resource before it is made available for re-use.

Python

417

Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.

Python

435

An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

Python

436

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Python

438

Weaknesses in this category are related to unexpected behaviors from code that an application uses.

Python

441

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Python

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Python

452

Weaknesses in this category occur in behaviors that are used for initialization and breakdown.

Python

459

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Python

465

Weaknesses in this category are related to improper handling of pointers.

Python

476

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Python

480

The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

Python

485

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

Python

489

The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

Python

497

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Python

502

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Python

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

Python

521

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

Python

522

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Python

523

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

Python

532

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Python

536

A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.

Python

538

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

Python

539

The web application uses persistent cookies, but the cookies contain sensitive information.

Python

550

Certain conditions, such as network failure, will cause a server error message to be displayed.

Python

552

The product makes files or directories accessible to unauthorized actors, even though they should not be.

Python

559

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Python

561

The product contains dead code, which can never be executed.

Python

566

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

Python

569

Weaknesses in this category are related to incorrectly written expressions within code.

Python

573

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

Python

592

This weakness has been deprecated because it covered redundant concepts already described in CWE-287.

Python

601

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Python

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Python

611

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Python

614

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

Python

624

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

Python

625

The product uses a regular expression that does not sufficiently restrict the set of allowed values.

Python

628

The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

Python

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Python

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Python

633

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Python

634

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Python

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

Python

639

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Python

644

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

Python

657

The product violates well-established principles for secure design.

Python

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Python

668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Python

669

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Python

670

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

Python

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

Python

688

The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.

Python

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

Python

692

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

Python

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Python

697

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

Python

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Python

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

Python

703

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Python

706

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Python

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

Python

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Python

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Python

712

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.

Python

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

Python

714

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.

Python

715

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.

Python

716

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.

Python

717

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.

Python

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

Python

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

Python

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

Python

721

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.

Python

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

Python

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

Python

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

Python

725

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.

Python

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

Python

728

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.

Python

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

Python

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

Python

731

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.

Python

732

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Python

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

Python

736

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008).

Python

737

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).

Python

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

Python

741

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).

Python

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

Python

743

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

Python

744

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).

Python

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

Python

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

Python

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Python

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

Python

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

Python

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

Python

755

The product does not handle or incorrectly handles an exceptional condition.

Python

760

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.

Python

778

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

Python

783

The product uses an expression in which operator precedence causes incorrect logic to be used.

Python

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Python

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Python

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

Python

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

Python

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

Python

807

The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

Python

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Python

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Python

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

Python

811

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.

Python

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

Python

813

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.

Python

814

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.

Python

815

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.

Python

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

Python

817

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.

Python

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

Python

819

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2010.

Python

827

The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.

Python

829

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Python

840

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

Python

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

Python

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Python

850

Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Python

851

Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Python

857

Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Python

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Python

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Python

860

Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Python

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Python

862

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Python

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Python

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Python

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Python

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Python

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

Python

871

Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Python

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Python

875

Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Python

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Python

877

Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Python

878

Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Python

880

Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Python

881

Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Python

882

Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Python

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Python

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

Python

885

This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

Python

886

This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).

Python

887

This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

Python

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

Python

889

This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

Python

890

This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).

Python

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

Python

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

Python

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

Python

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

Python

897

This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28).

Python

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

Python

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

Python

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Python

902

This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

Python

903

This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

Python

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

Python

906

This category identifies Software Fault Patterns (SFPs) within the UI cluster.

Python

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

Python

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Python

916

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Python

918

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Python

922

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Python

923

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Python

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Python

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

Python

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

Python

931

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2013.

Python

932

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.

Python

933

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.

Python

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

Python

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

Python

936

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2013.

Python

938

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2013.

Python

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Python

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

Python

945

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).

Python

946

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster.

Python

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

Python

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

Python

951

This category identifies Software Fault Patterns (SFPs) within the Insecure Authentication Policy cluster.

Python

952

This category identifies Software Fault Patterns (SFPs) within the Missing Authentication cluster.

Python

956

This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.

Python

957

This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.

Python

958

This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.

Python

959

This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.

Python

961

This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).

Python

962

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

Python

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

Python

964

This category identifies Software Fault Patterns (SFPs) within the Exposure Temporary File cluster.

Python

966

This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.

Python

971

This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).

Python

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

Python

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

Python

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

Python

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

Python

981

This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).

Python

982

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).

Python

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

Python

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

Python

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

Python

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

Python

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

Python

997

This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster.

Python

998

This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).

Python

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

Python

1001

This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).

Python

1002

This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster.

Python

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

Python

1004

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Python

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

Python

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

Python

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

Python

1009

Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.

Python

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Python

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

Python

1012

Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.

Python

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

Python

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

Python

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Python

1016

Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.

Python

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

Python

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

Python

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

Python

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

Python

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

Python

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

Python

1030

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2017.

Python

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

Python

1032

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.

Python

1033

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2017.

Python

1034

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2017.

Python

1036

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2017.

Python

1041

The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

Python

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

Python

1130

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.

Python

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

Python

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

Python

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

Python

1136

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.

Python

1140

Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

Python

1141

Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.

Python

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

Python

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

Python

1149

Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.

Python

1150

Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java.

Python

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

Python

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

Python

1157

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.

Python

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

Python

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

Python

1164

The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.

Python

1165

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.

Python

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

Python

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

Python

1172

Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.

Python

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

Python

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

Python

1180

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard.

Python

1181

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.

Python

1186

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.

Python

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Python

1198

Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.

Python

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

Python

1202

Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).

Python

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

Python

1210

Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.

Python

1211

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

Python

1212

Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.

Python

1213

Weaknesses in this category are related to a software system's random number generation.

Python

1214

Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.

Python

1219

Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.

Python

1275

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

Python

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

Python

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

Python

1307

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.

Python

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

Python

1309

Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.

Python

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

Python

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

Python

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

Python

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

Python

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

Python

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

Python

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

Python

1349

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.

Python

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

Python

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

Python

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

Python

1355

Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top 10 2021.

Python

1356

Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top 10 2021.

Python

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Python

1359

Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Python

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Python

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Python

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Python

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Python

1364

Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Python

1366

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Python

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Python

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Python

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Python

1371

Weaknesses in this category are related to the "Poorly Documented or Undocumented Features" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Undocumented capabilities and configurations pose a risk by not having a clear understanding of what the device is specifically supposed to do and only do. Therefore possibly opening up the attack surface and vulnerabilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Python

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Python

1373

Weaknesses in this category are related to the "Trust Model Problems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Assumptions made about the user during the design or construction phase may result in vulnerabilities after the system is installed if the user operates it using a different security approach or process than what was designed or built." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Python

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Python

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Python

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Python

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

Python

1396

Weaknesses in this category are related to access control.

Python

1397

Weaknesses in this category are related to comparison.

Python

1398

Weaknesses in this category are related to component interaction.

Python

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

Python

1402

Weaknesses in this category are related to encryption.

Python

1403

Weaknesses in this category are related to exposed resource.

Python

1404

Weaknesses in this category are related to file handling.

Python

1405

Weaknesses in this category are related to improper check or handling of exceptional conditions.

Python

1406

Weaknesses in this category are related to improper input validation.

Python

1407

Weaknesses in this category are related to improper neutralization.

Python

1409

Weaknesses in this category are related to injection.

Python

1410

Weaknesses in this category are related to insufficient control flow management.

Python

1411

Weaknesses in this category are related to insufficient verification of data authenticity.

Python

1412

Weaknesses in this category are related to poor coding practices.

Python

1413

Weaknesses in this category are related to protection mechanism failure.

Python

1414

Weaknesses in this category are related to randomness.

Python

1415

Weaknesses in this category are related to resource control.

Python

1416

Weaknesses in this category are related to resource lifecycle management.

Python

1417

Weaknesses in this category are related to sensitive information exposure.

Python

1418

Weaknesses in this category are related to violation of secure design principles.

Ruby

2

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

Ruby

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Ruby

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Ruby

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

Ruby

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Ruby

21

This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).

Ruby

22

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Ruby

23

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

Ruby

36

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

Ruby

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Ruby

77

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Ruby

78

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Ruby

79

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Ruby

80

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Ruby

82

The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

Ruby

83

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

Ruby

85

The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.

Ruby

86

The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

Ruby

87

The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

Ruby

88

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Ruby

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Ruby

93

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

Ruby

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Ruby

95

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Ruby

113

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Ruby

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Ruby

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

Ruby

138

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

Ruby

140

The product does not neutralize or incorrectly neutralizes delimiters.

Ruby

141

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

Ruby

142

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

Ruby

146

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

Ruby

149

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

Ruby

150

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

Ruby

157

The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.

Ruby

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

Ruby

184

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

Ruby

185

The product specifies a regular expression in a way that causes data to be improperly matched or compared.

Ruby

189

Weaknesses in this category are related to improper calculation or conversion of numbers.

Ruby

199

Weaknesses in this category are related to improper handling of sensitive information.

Ruby

200

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Ruby

249

This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.

Ruby

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Ruby

255

Weaknesses in this category are related to the management of credentials.

Ruby

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Ruby

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

Ruby

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Ruby

285

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Ruby

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Ruby

295

The product does not validate, or incorrectly validates, a certificate.

Ruby

300

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

Ruby

307

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

Ruby

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Ruby

311

The product does not encrypt sensitive or critical information before storage or transmission.

Ruby

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Ruby

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

Ruby

327

The product uses a broken or risky cryptographic algorithm or protocol.

Ruby

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Ruby

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

Ruby

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Ruby

352

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Ruby

353

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

Ruby

359

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Ruby

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

Ruby

369

The product divides a value by zero.

Ruby

371

Weaknesses in this category are related to improper management of system state.

Ruby

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

Ruby

399

Weaknesses in this category are related to improper management of system resources.

Ruby

404

The product does not release or incorrectly releases a resource before it is made available for re-use.

Ruby

435

An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

Ruby

436

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Ruby

438

Weaknesses in this category are related to unexpected behaviors from code that an application uses.

Ruby

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Ruby

470

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

Ruby

502

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Ruby

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

Ruby

521

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

Ruby

522

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Ruby

523

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

Ruby

601

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Ruby

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Ruby

624

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

Ruby

625

The product uses a regular expression that does not sufficiently restrict the set of allowed values.

Ruby

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Ruby

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Ruby

634

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Ruby

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

Ruby

639

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Ruby

642

The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.

Ruby

657

The product violates well-established principles for secure design.

Ruby

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Ruby

668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Ruby

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

Ruby

682

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Ruby

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

Ruby

692

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

Ruby

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Ruby

697

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

Ruby

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Ruby

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

Ruby

706

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Ruby

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

Ruby

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Ruby

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Ruby

712

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.

Ruby

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

Ruby

714

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.

Ruby

715

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.

Ruby

716

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.

Ruby

717

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.

Ruby

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

Ruby

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

Ruby

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

Ruby

721

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.

Ruby

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

Ruby

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

Ruby

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

Ruby

725

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.

Ruby

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

Ruby

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

Ruby

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

Ruby

731

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.

Ruby

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

Ruby

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

Ruby

739

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008).

Ruby

741

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).

Ruby

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

Ruby

743

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

Ruby

744

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).

Ruby

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

Ruby

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

Ruby

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Ruby

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

Ruby

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

Ruby

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

Ruby

777

The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through.

Ruby

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Ruby

799

The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

Ruby

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Ruby

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

Ruby

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

Ruby

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

Ruby

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Ruby

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Ruby

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

Ruby

811

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.

Ruby

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

Ruby

813

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.

Ruby

814

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.

Ruby

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

Ruby

817

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.

Ruby

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

Ruby

819

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2010.

Ruby

840

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

Ruby

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

Ruby

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Ruby

848

Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Ruby

857

Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Ruby

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Ruby

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Ruby

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Ruby

862

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Ruby

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Ruby

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Ruby

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Ruby

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Ruby

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

Ruby

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Ruby

873

Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Ruby

875

Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Ruby

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Ruby

877

Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Ruby

878

Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Ruby

882

Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Ruby

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Ruby

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

Ruby

885

This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

Ruby

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

Ruby

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

Ruby

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

Ruby

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

Ruby

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

Ruby

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

Ruby

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

Ruby

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Ruby

902

This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

Ruby

903

This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

Ruby

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

Ruby

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

Ruby

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Ruby

915

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Ruby

916

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Ruby

923

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Ruby

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Ruby

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

Ruby

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

Ruby

931

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2013.

Ruby

932

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.

Ruby

933

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.

Ruby

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

Ruby

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

Ruby

936

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2013.

Ruby

937

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2013.

Ruby

938

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2013.

Ruby

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Ruby

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

Ruby

945

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).

Ruby

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

Ruby

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

Ruby

951

This category identifies Software Fault Patterns (SFPs) within the Insecure Authentication Policy cluster.

Ruby

955

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Authentication cluster (SFP34).

Ruby

956

This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.

Ruby

957

This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.

Ruby

958

This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.

Ruby

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

Ruby

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

Ruby

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

Ruby

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

Ruby

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

Ruby

981

This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).

Ruby

982

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).

Ruby

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

Ruby

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

Ruby

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

Ruby

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

Ruby

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

Ruby

998

This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).

Ruby

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

Ruby

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

Ruby

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

Ruby

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

Ruby

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

Ruby

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Ruby

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

Ruby

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

Ruby

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

Ruby

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Ruby

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

Ruby

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

Ruby

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

Ruby

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

Ruby

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

Ruby

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

Ruby

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

Ruby

1033

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2017.

Ruby

1034

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2017.

Ruby

1035

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2017.

Ruby

1104

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

Ruby

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

Ruby

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

Ruby

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

Ruby

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

Ruby

1137

Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java.

Ruby

1140

Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

Ruby

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

Ruby

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

Ruby

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

Ruby

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

Ruby

1158

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard.

Ruby

1159

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard.

Ruby

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

Ruby

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

Ruby

1165

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.

Ruby

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

Ruby

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

Ruby

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

Ruby

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

Ruby

1182

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard.

Ruby

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Ruby

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

Ruby

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

Ruby

1211

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

Ruby

1212

Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.

Ruby

1213

Weaknesses in this category are related to a software system's random number generation.

Ruby

1214

Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.

Ruby

1215

Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.

Ruby

1219

Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.

Ruby

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

Ruby

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

Ruby

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

Ruby

1309

Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.

Ruby

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

Ruby

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

Ruby

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

Ruby

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

Ruby

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

Ruby

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

Ruby

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

Ruby

1349

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.

Ruby

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

Ruby

1352

Weaknesses in this category are related to the A06 category "Vulnerable and Outdated Components" in the OWASP Top 10 2021.

Ruby

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

Ruby

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

Ruby

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Ruby

1359

Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Ruby

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Ruby

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Ruby

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Ruby

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Ruby

1364

Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Ruby

1366

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Ruby

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Ruby

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Ruby

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Ruby

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Ruby

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Ruby

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Ruby

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Ruby

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

Ruby

1396

Weaknesses in this category are related to access control.

Ruby

1397

Weaknesses in this category are related to comparison.

Ruby

1398

Weaknesses in this category are related to component interaction.

Ruby

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

Ruby

1402

Weaknesses in this category are related to encryption.

Ruby

1403

Weaknesses in this category are related to exposed resource.

Ruby

1404

Weaknesses in this category are related to file handling.

Ruby

1406

Weaknesses in this category are related to improper input validation.

Ruby

1407

Weaknesses in this category are related to improper neutralization.

Ruby

1408

Weaknesses in this category are related to incorrect calculation.

Ruby

1409

Weaknesses in this category are related to injection.

Ruby

1410

Weaknesses in this category are related to insufficient control flow management.

Ruby

1411

Weaknesses in this category are related to insufficient verification of data authenticity.

Ruby

1412

Weaknesses in this category are related to poor coding practices.

Ruby

1413

Weaknesses in this category are related to protection mechanism failure.

Ruby

1414

Weaknesses in this category are related to randomness.

Ruby

1415

Weaknesses in this category are related to resource control.

Ruby

1416

Weaknesses in this category are related to resource lifecycle management.

Ruby

1417

Weaknesses in this category are related to sensitive information exposure.

Ruby

1418

Weaknesses in this category are related to violation of secure design principles.

Scala

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Scala

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Scala

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

Scala

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Scala

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Scala

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Scala

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Scala

133

Weaknesses in this category are related to the creation and modification of strings.

Scala

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

Scala

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

Scala

189

Weaknesses in this category are related to improper calculation or conversion of numbers.

Scala

190

The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

Scala

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Scala

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

Scala

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

Scala

399

Weaknesses in this category are related to improper management of system resources.

Scala

438

Weaknesses in this category are related to unexpected behaviors from code that an application uses.

Scala

452

Weaknesses in this category occur in behaviors that are used for initialization and breakdown.

Scala

465

Weaknesses in this category are related to improper handling of pointers.

Scala

476

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Scala

480

The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

Scala

483

The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.

Scala

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

Scala

561

The product contains dead code, which can never be executed.

Scala

569

Weaknesses in this category are related to incorrectly written expressions within code.

Scala

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

Scala

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Scala

665

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

Scala

670

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

Scala

682

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Scala

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

Scala

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Scala

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Scala

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

Scala

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

Scala

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Scala

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Scala

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

Scala

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

Scala

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

Scala

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

Scala

737

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).

Scala

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

Scala

739

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008).

Scala

740

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008).

Scala

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

Scala

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

Scala

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

Scala

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Scala

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

Scala

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

Scala

783

The product uses an expression in which operator precedence causes incorrect logic to be used.

Scala

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Scala

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

Scala

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Scala

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

Scala

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Scala

846

Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Scala

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Scala

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Scala

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

Scala

871

Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Scala

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Scala

873

Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Scala

874

Weaknesses in this category are related to rules in the Arrays and the STL (ARR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Scala

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Scala

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Scala

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

Scala

885

This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

Scala

886

This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).

Scala

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

Scala

889

This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

Scala

890

This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).

Scala

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

Scala

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

Scala

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Scala

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

Scala

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Scala

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Scala

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

Scala

962

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

Scala

971

This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).

Scala

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

Scala

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

Scala

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

Scala

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

Scala

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

Scala

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

Scala

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

Scala

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

Scala

998

This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).

Scala

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

Scala

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

Scala

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

Scala

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

Scala

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

Scala

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

Scala

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

Scala

1041

The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

Scala

1078

The source code does not follow desired style or formatting for indentation, white space, comments, etc.

Scala

1114

The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.

Scala

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

Scala

1130

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.

Scala

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

Scala

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

Scala

1135

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Oracle Secure Coding Standard for Java.

Scala

1136

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.

Scala

1137

Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java.

Scala

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

Scala

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

Scala

1157

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.

Scala

1158

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard.

Scala

1159

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard.

Scala

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

Scala

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

Scala

1164

The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.

Scala

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

Scala

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

Scala

1181

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.

Scala

1182

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard.

Scala

1186

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.

Scala

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

Scala

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

Scala

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

Scala

1307

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.

Scala

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

Scala

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

Scala

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

Scala

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

Scala

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

Scala

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

Scala

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

Scala

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Scala

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Scala

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Scala

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Scala

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Scala

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Scala

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Scala

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Scala

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

Scala

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

Scala

1406

Weaknesses in this category are related to improper input validation.

Scala

1407

Weaknesses in this category are related to improper neutralization.

Scala

1408

Weaknesses in this category are related to incorrect calculation.

Scala

1409

Weaknesses in this category are related to injection.

Scala

1410

Weaknesses in this category are related to insufficient control flow management.

Scala

1412

Weaknesses in this category are related to poor coding practices.

Scala

1413

Weaknesses in this category are related to protection mechanism failure.

Scala

1416

Weaknesses in this category are related to resource lifecycle management.

Swift

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Swift

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Swift

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

Swift

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Swift

21

This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).

Swift

22

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Swift

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Swift

79

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Swift

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

Swift

91

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Swift

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Swift

95

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Swift

99

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

Swift

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Swift

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

Swift

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

Swift

172

The product does not properly encode or decode the data, resulting in unexpected values.

Swift

176

The product does not properly handle when an input contains Unicode encoding.

Swift

199

Weaknesses in this category are related to improper handling of sensitive information.

Swift

200

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Swift

212

The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.

Swift

227

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."

Swift

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

Swift

255

Weaknesses in this category are related to the management of credentials.

Swift

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Swift

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

Swift

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Swift

285

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Swift

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Swift

295

The product does not validate, or incorrectly validates, a certificate.

Swift

296

The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

Swift

300

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

Swift

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

Swift

311

The product does not encrypt sensitive or critical information before storage or transmission.

Swift

312

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Swift

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Swift

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

Swift

326

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Swift

327

The product uses a broken or risky cryptographic algorithm or protocol.

Swift

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Swift

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

Swift

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Swift

346

The product does not properly verify that the source of data or communication is valid.

Swift

352

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Swift

359

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Swift

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

Swift

376

This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. Consider using the File Handling Issues category (CWE-1219).

Swift

377

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Swift

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

Swift

399

Weaknesses in this category are related to improper management of system resources.

Swift

400

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Swift

417

Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.

Swift

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

Swift

452

Weaknesses in this category occur in behaviors that are used for initialization and breakdown.

Swift

485

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

Swift

497

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Swift

502

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Swift

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

Swift

524

The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

Swift

525

The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

Swift

573

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

Swift

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

Swift

611

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Swift

613

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Swift

614

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

Swift

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Swift

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

Swift

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

Swift

643

The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

Swift

657

The product violates well-established principles for secure design.

Swift

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Swift

666

The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.

Swift

668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

Swift

669

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

Swift

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

Swift

672

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

Swift

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

Swift

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Swift

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Swift

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

Swift

706

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Swift

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

Swift

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

Swift

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Swift

712

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.

Swift

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

Swift

714

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.

Swift

715

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.

Swift

716

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.

Swift

717

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.

Swift

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

Swift

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

Swift

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

Swift

721

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.

Swift

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

Swift

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

Swift

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

Swift

725

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.

Swift

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

Swift

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

Swift

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

Swift

731

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.

Swift

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

Swift

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

Swift

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

Swift

743

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

Swift

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

Swift

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

Swift

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Swift

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

Swift

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

Swift

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

Swift

759

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

Swift

779

The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.

Swift

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

Swift

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

Swift

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

Swift

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

Swift

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

Swift

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Swift

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Swift

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

Swift

811

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.

Swift

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

Swift

813

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.

Swift

814

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.

Swift

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

Swift

817

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.

Swift

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

Swift

829

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Swift

840

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

Swift

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

Swift

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Swift

850

Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Swift

851

Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Swift

857

Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Swift

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Swift

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Swift

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

Swift

863

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

Swift

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Swift

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Swift

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Swift

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

Swift

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

Swift

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Swift

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Swift

877

Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Swift

880

Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Swift

881

Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Swift

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

Swift

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

Swift

887

This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

Swift

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

Swift

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

Swift

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

Swift

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

Swift

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

Swift

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

Swift

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

Swift

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

Swift

902

This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

Swift

903

This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

Swift

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

Swift

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

Swift

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Swift

916

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Swift

921

The product stores sensitive information in a file system or device that does not have built-in access control.

Swift

922

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Swift

923

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

Swift

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

Swift

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

Swift

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

Swift

931

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2013.

Swift

932

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.

Swift

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

Swift

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

Swift

936

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2013.

Swift

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

Swift

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

Swift

945

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).

Swift

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

Swift

948

This category identifies Software Fault Patterns (SFPs) within the Digital Certificate cluster.

Swift

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

Swift

951

This category identifies Software Fault Patterns (SFPs) within the Insecure Authentication Policy cluster.

Swift

956

This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.

Swift

958

This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.

Swift

959

This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.

Swift

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

Swift

964

This category identifies Software Fault Patterns (SFPs) within the Exposure Temporary File cluster.

Swift

965

This category identifies Software Fault Patterns (SFPs) within the Insecure Session Management cluster.

Swift

966

This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.

Swift

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

Swift

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

Swift

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

Swift

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

Swift

981

This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).

Swift

983

This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Use cluster (SFP15).

Swift

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

Swift

985

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).

Swift

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

Swift

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

Swift

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

Swift

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

Swift

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

Swift

1001

This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).

Swift

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

Swift

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

Swift

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

Swift

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

Swift

1009

Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.

Swift

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Swift

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

Swift

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

Swift

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

Swift

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

Swift

1016

Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.

Swift

1018

Weaknesses in this category are related to the design and architecture of session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed when designing or implementing a secure architecture.

Swift

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

Swift

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

Swift

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

Swift

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

Swift

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

Swift

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

Swift

1030

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2017.

Swift

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

Swift

1033

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2017.

Swift

1034

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2017.

Swift

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

Swift

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

Swift

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

Swift

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

Swift

1140

Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

Swift

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

Swift

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

Swift

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

Swift

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

Swift

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

Swift

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

Swift

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

Swift

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

Swift

1172

Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.

Swift

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

Swift

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

Swift

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Swift

1199

Weaknesses in this category are related to hardware-circuit design and logic (e.g., CMOS transistors, finite state machines, and registers) as well as issues related to hardware description languages such as System Verilog and VHDL.

Swift

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

Swift

1204

The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.

Swift

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

Swift

1210

Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.

Swift

1211

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

Swift

1213

Weaknesses in this category are related to a software system's random number generation.

Swift

1214

Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.

Swift

1217

Weaknesses in this category are related to session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed.

Swift

1219

Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.

Swift

1250

The product has or supports multiple distributed components or sub-systems that are each required to keep their own local copy of shared data - such as state or cache - but the product does not ensure that all local copies remain consistent with each other.

Swift

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

Swift

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

Swift

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

Swift

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

Swift

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

Swift

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

Swift

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

Swift

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

Swift

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

Swift

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

Swift

1349

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.

Swift

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

Swift

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

Swift

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

Swift

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Swift

1359

Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Swift

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Swift

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Swift

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Swift

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

Swift

1364

Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Swift

1366

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Swift

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Swift

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Swift

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Swift

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Swift

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Swift

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Swift

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

Swift

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

Swift

1396

Weaknesses in this category are related to access control.

Swift

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

Swift

1402

Weaknesses in this category are related to encryption.

Swift

1403

Weaknesses in this category are related to exposed resource.

Swift

1404

Weaknesses in this category are related to file handling.

Swift

1406

Weaknesses in this category are related to improper input validation.

Swift

1407

Weaknesses in this category are related to improper neutralization.

Swift

1409

Weaknesses in this category are related to injection.

Swift

1410

Weaknesses in this category are related to insufficient control flow management.

Swift

1411

Weaknesses in this category are related to insufficient verification of data authenticity.

Swift

1412

Weaknesses in this category are related to poor coding practices.

Swift

1413

Weaknesses in this category are related to protection mechanism failure.

Swift

1414

Weaknesses in this category are related to randomness.

Swift

1415

Weaknesses in this category are related to resource control.

Swift

1416

Weaknesses in this category are related to resource lifecycle management.

Swift

1417

Weaknesses in this category are related to sensitive information exposure.

Swift

1418

Weaknesses in this category are related to violation of secure design principles.

TypeScript

2

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

TypeScript

4

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

TypeScript

5

Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

TypeScript

16

Weaknesses in this category are typically introduced during the configuration of the software.

TypeScript

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

TypeScript

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

TypeScript

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

TypeScript

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

TypeScript

21

This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).

TypeScript

22

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

TypeScript

23

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

TypeScript

36

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

TypeScript

73

The product allows user input to control or influence paths or file names that are used in filesystem operations.

TypeScript

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

TypeScript

77

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

TypeScript

78

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

TypeScript

79

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

TypeScript

80

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

TypeScript

82

The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

TypeScript

83

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

TypeScript

85

The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.

TypeScript

86

The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

TypeScript

87

The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

TypeScript

88

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

TypeScript

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

TypeScript

93

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

TypeScript

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

TypeScript

95

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

TypeScript

99

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

TypeScript

113

The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

TypeScript

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

TypeScript

117

The product does not neutralize or incorrectly neutralizes output that is written to logs.

TypeScript

133

Weaknesses in this category are related to the creation and modification of strings.

TypeScript

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

TypeScript

138

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

TypeScript

140

The product does not neutralize or incorrectly neutralizes delimiters.

TypeScript

141

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

TypeScript

142

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

TypeScript

143

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.

TypeScript

146

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

TypeScript

149

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

TypeScript

150

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

TypeScript

157

The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.

TypeScript

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

TypeScript

183

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

TypeScript

185

The product specifies a regular expression in a way that causes data to be improperly matched or compared.

TypeScript

187

The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.

TypeScript

199

Weaknesses in this category are related to improper handling of sensitive information.

TypeScript

200

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

TypeScript

201

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

TypeScript

209

The product generates an error message that includes sensitive information about its environment, users, or associated data.

TypeScript

210

The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

TypeScript

211

The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

TypeScript

215

The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

TypeScript

221

The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

TypeScript

223

The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

TypeScript

226

The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

TypeScript

227

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."

TypeScript

228

The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.

TypeScript

233

The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in input, or if those parameters are undefined.

TypeScript

248

An exception is thrown from a function, but it is not caught.

TypeScript

249

This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.

TypeScript

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

TypeScript

255

Weaknesses in this category are related to the management of credentials.

TypeScript

256

Storing a password in plaintext may result in a system compromise.

TypeScript

257

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

TypeScript

258

Using an empty string as a password is insecure.

TypeScript

260

The product stores a password in a configuration file that might be accessible to actors who do not know the password.

TypeScript

263

The product supports password aging, but the expiration period is too long.

TypeScript

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

TypeScript

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

TypeScript

269

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

TypeScript

271

The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.

TypeScript

272

The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.

TypeScript

275

Weaknesses in this category are related to improper assignment or handling of permissions.

TypeScript

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

TypeScript

285

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

TypeScript

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

TypeScript

289

The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.

TypeScript

290

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

TypeScript

295

The product does not validate, or incorrectly validates, a certificate.

TypeScript

296

The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

TypeScript

300

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

TypeScript

304

The product implements an authentication technique, but it skips a step that weakens the technique.

TypeScript

305

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

TypeScript

306

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

TypeScript

307

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

TypeScript

308

The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.

TypeScript

309

The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings, each reducing the effectiveness of the mechanism.

TypeScript

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

TypeScript

311

The product does not encrypt sensitive or critical information before storage or transmission.

TypeScript

312

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

TypeScript

313

The product stores sensitive information in cleartext in a file, or on disk.

TypeScript

314

The product stores sensitive information in cleartext in the registry.

TypeScript

315

The product stores sensitive information in cleartext in a cookie.

TypeScript

317

The product stores sensitive information in cleartext within the GUI.

TypeScript

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

TypeScript

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

TypeScript

322

The product performs a key exchange with an actor without verifying the identity of that actor.

TypeScript

324

The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.

TypeScript

326

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

TypeScript

327

The product uses a broken or risky cryptographic algorithm or protocol.

TypeScript

328

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

TypeScript

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

TypeScript

338

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

TypeScript

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

TypeScript

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

TypeScript

346

The product does not properly verify that the source of data or communication is valid.

TypeScript

347

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

TypeScript

352

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

TypeScript

353

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

TypeScript

355

Weaknesses in this category are related to or introduced in the User Interface (UI).

TypeScript

358

The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique.

TypeScript

359

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

TypeScript

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

TypeScript

371

Weaknesses in this category are related to improper management of system state.

TypeScript

388

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

TypeScript

389

This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.

TypeScript

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

TypeScript

399

Weaknesses in this category are related to improper management of system resources.

TypeScript

400

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

TypeScript

404

The product does not release or incorrectly releases a resource before it is made available for re-use.

TypeScript

405

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

TypeScript

409

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

TypeScript

417

Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.

TypeScript

418

This category has been deprecated because it redundant with the grouping provided by CWE-417.

TypeScript

419

The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.

TypeScript

435

An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

TypeScript

436

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

TypeScript

438

Weaknesses in this category are related to unexpected behaviors from code that an application uses.

TypeScript

441

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

TypeScript

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

TypeScript

452

Weaknesses in this category occur in behaviors that are used for initialization and breakdown.

TypeScript

455

The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.

TypeScript

459

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

TypeScript

461

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

TypeScript

463

The accidental deletion of a data-structure sentinel can cause serious programming logic problems.

TypeScript

465

Weaknesses in this category are related to improper handling of pointers.

TypeScript

476

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

TypeScript

480

The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.

TypeScript

483

The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.

TypeScript

484

The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.

TypeScript

485

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

TypeScript

489

The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

TypeScript

497

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

TypeScript

502

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

TypeScript

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

TypeScript

506

The product contains code that appears to be malicious in nature.

TypeScript

521

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

TypeScript

522

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

TypeScript

523

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

TypeScript

524

The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.

TypeScript

525

The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.

TypeScript

526

The product uses an environment variable to store unencrypted sensitive information.

TypeScript

530

A backup file is stored in a directory or archive that is made accessible to unauthorized actors.

TypeScript

532

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

TypeScript

536

A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.

TypeScript

538

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

TypeScript

539

The web application uses persistent cookies, but the cookies contain sensitive information.

TypeScript

548

A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers.

TypeScript

550

Certain conditions, such as network failure, will cause a server error message to be displayed.

TypeScript

552

The product makes files or directories accessible to unauthorized actors, even though they should not be.

TypeScript

559

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

TypeScript

561

The product contains dead code, which can never be executed.

TypeScript

565

The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.

TypeScript

566

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

TypeScript

569

Weaknesses in this category are related to incorrectly written expressions within code.

TypeScript

573

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

TypeScript

592

This weakness has been deprecated because it covered redundant concepts already described in CWE-287.

TypeScript

601

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

TypeScript

602

The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

TypeScript

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

TypeScript

611

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

TypeScript

613

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

TypeScript

614

The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.

TypeScript

624

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

TypeScript

625

The product uses a regular expression that does not sufficiently restrict the set of allowed values.

TypeScript

628

The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

TypeScript

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

TypeScript

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

TypeScript

633

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

TypeScript

634

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

TypeScript

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

TypeScript

636

When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

TypeScript

639

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

TypeScript

642

The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.

TypeScript

644

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

TypeScript

654

A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.

TypeScript

657

The product violates well-established principles for secure design.

TypeScript

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

TypeScript

665

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

TypeScript

666

The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.

TypeScript

668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

TypeScript

669

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

TypeScript

670

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

TypeScript

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

TypeScript

672

The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.

TypeScript

674

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

TypeScript

676

The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.

TypeScript

688

The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one of the arguments, which may lead to undefined behavior and resultant weaknesses.

TypeScript

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

TypeScript

692

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

TypeScript

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

TypeScript

697

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.

TypeScript

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

TypeScript

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

TypeScript

703

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

TypeScript

705

The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.

TypeScript

706

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

TypeScript

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

TypeScript

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

TypeScript

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

TypeScript

712

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.

TypeScript

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

TypeScript

714

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.

TypeScript

715

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.

TypeScript

716

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.

TypeScript

717

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.

TypeScript

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

TypeScript

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

TypeScript

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

TypeScript

721

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.

TypeScript

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

TypeScript

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

TypeScript

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

TypeScript

725

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.

TypeScript

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

TypeScript

728

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.

TypeScript

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

TypeScript

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

TypeScript

731

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.

TypeScript

732

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

TypeScript

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

TypeScript

736

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008).

TypeScript

737

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).

TypeScript

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

TypeScript

740

Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008).

TypeScript

741

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).

TypeScript

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

TypeScript

743

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

TypeScript

744

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).

TypeScript

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

TypeScript

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

TypeScript

748

Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).

TypeScript

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

TypeScript

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

TypeScript

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

TypeScript

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

TypeScript

755

The product does not handle or incorrectly handles an exceptional condition.

TypeScript

757

A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

TypeScript

759

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

TypeScript

760

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.

TypeScript

776

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

TypeScript

778

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

TypeScript

779

The product logs too much information, making log files hard to process and possibly hindering recovery efforts or forensic analysis after an attack.

TypeScript

783

The product uses an expression in which operator precedence causes incorrect logic to be used.

TypeScript

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

TypeScript

799

The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

TypeScript

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

TypeScript

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

TypeScript

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

TypeScript

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

TypeScript

807

The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.

TypeScript

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

TypeScript

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

TypeScript

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

TypeScript

811

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.

TypeScript

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

TypeScript

813

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.

TypeScript

814

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.

TypeScript

815

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.

TypeScript

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

TypeScript

817

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.

TypeScript

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

TypeScript

819

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2010.

TypeScript

829

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

TypeScript

834

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

TypeScript

840

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

TypeScript

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

TypeScript

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

TypeScript

846

Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

TypeScript

850

Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

TypeScript

851

Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

TypeScript

854

Weaknesses in this category are related to rules in the Thread APIs (THI) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

TypeScript

855

Weaknesses in this category are related to rules in the Thread Pools (TPS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

TypeScript

857

Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

TypeScript

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

TypeScript

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

TypeScript

860

Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

TypeScript

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

TypeScript

862

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

TypeScript

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

TypeScript

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

TypeScript

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

TypeScript

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

TypeScript

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

TypeScript

871

Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

TypeScript

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

TypeScript

874

Weaknesses in this category are related to rules in the Arrays and the STL (ARR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

TypeScript

875

Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

TypeScript

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

TypeScript

877

Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

TypeScript

878

Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

TypeScript

880

Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

TypeScript

881

Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

TypeScript

882

Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

TypeScript

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

TypeScript

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

TypeScript

885

This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

TypeScript

886

This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).

TypeScript

887

This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

TypeScript

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

TypeScript

889

This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

TypeScript

890

This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).

TypeScript

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

TypeScript

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

TypeScript

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

TypeScript

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

TypeScript

897

This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28).

TypeScript

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

TypeScript

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

TypeScript

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

TypeScript

901

This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36).

TypeScript

902

This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

TypeScript

903

This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

TypeScript

904

This category identifies Software Fault Patterns (SFPs) within the Malware cluster.

TypeScript

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

TypeScript

906

This category identifies Software Fault Patterns (SFPs) within the UI cluster.

TypeScript

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

TypeScript

908

The product uses or accesses a resource that has not been initialized.

TypeScript

912

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators.

TypeScript

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

TypeScript

916

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

TypeScript

917

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

TypeScript

918

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

TypeScript

921

The product stores sensitive information in a file system or device that does not have built-in access control.

TypeScript

922

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

TypeScript

923

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

TypeScript

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

TypeScript

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

TypeScript

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

TypeScript

931

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2013.

TypeScript

932

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.

TypeScript

933

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.

TypeScript

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

TypeScript

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

TypeScript

936

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2013.

TypeScript

938

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2013.

TypeScript

942

The product uses a cross-domain policy file that includes domains that should not be trusted.

TypeScript

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

TypeScript

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

TypeScript

945

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).

TypeScript

946

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster.

TypeScript

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

TypeScript

948

This category identifies Software Fault Patterns (SFPs) within the Digital Certificate cluster.

TypeScript

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

TypeScript

950

This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).

TypeScript

951

This category identifies Software Fault Patterns (SFPs) within the Insecure Authentication Policy cluster.

TypeScript

952

This category identifies Software Fault Patterns (SFPs) within the Missing Authentication cluster.

TypeScript

955

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Authentication cluster (SFP34).

TypeScript

956

This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.

TypeScript

957

This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.

TypeScript

958

This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.

TypeScript

959

This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.

TypeScript

961

This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).

TypeScript

962

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

TypeScript

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

TypeScript

965

This category identifies Software Fault Patterns (SFPs) within the Insecure Session Management cluster.

TypeScript

966

This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.

TypeScript

971

This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).

TypeScript

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

TypeScript

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

TypeScript

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

TypeScript

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

TypeScript

981

This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).

TypeScript

982

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).

TypeScript

983

This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Use cluster (SFP15).

TypeScript

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

TypeScript

985

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).

TypeScript

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

TypeScript

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

TypeScript

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

TypeScript

993

This category identifies Software Fault Patterns (SFPs) within the Incorrect Input Handling cluster.

TypeScript

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

TypeScript

997

This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster.

TypeScript

998

This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).

TypeScript

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

TypeScript

1001

This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).

TypeScript

1002

This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster.

TypeScript

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

TypeScript

1004

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

TypeScript

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

TypeScript

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

TypeScript

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

TypeScript

1009

Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.

TypeScript

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

TypeScript

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

TypeScript

1012

Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.

TypeScript

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

TypeScript

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

TypeScript

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

TypeScript

1016

Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.

TypeScript

1018

Weaknesses in this category are related to the design and architecture of session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed when designing or implementing a secure architecture.

TypeScript

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

TypeScript

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

TypeScript

1021

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

TypeScript

1022

The web application produces links to untrusted external sites outside of its sphere of control, but it does not properly prevent the external site from modifying security-critical properties of the window.opener object, such as the location property.

TypeScript

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

TypeScript

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

TypeScript

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

TypeScript

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

TypeScript

1030

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2017.

TypeScript

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

TypeScript

1032

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.

TypeScript

1033

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2017.

TypeScript

1034

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2017.

TypeScript

1036

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2017.

TypeScript

1041

The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

TypeScript

1078

The source code does not follow desired style or formatting for indentation, white space, comments, etc.

TypeScript

1104

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

TypeScript

1114

The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.

TypeScript

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

TypeScript

1129

Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software.

TypeScript

1130

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.

TypeScript

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

TypeScript

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

TypeScript

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

TypeScript

1135

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Oracle Secure Coding Standard for Java.

TypeScript

1136

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.

TypeScript

1140

Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

TypeScript

1141

Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.

TypeScript

1145

Weaknesses in this category are related to the rules and recommendations in the Thread Pools (TPS) section of the SEI CERT Oracle Secure Coding Standard for Java.

TypeScript

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

TypeScript

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

TypeScript

1149

Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.

TypeScript

1150

Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java.

TypeScript

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

TypeScript

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

TypeScript

1157

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.

TypeScript

1161

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT C Coding Standard.

TypeScript

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

TypeScript

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

TypeScript

1164

The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.

TypeScript

1165

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.

TypeScript

1167

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) section of the SEI CERT C Coding Standard.

TypeScript

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

TypeScript

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

TypeScript

1172

Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.

TypeScript

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

TypeScript

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

TypeScript

1180

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard.

TypeScript

1181

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.

TypeScript

1186

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.

TypeScript

1187

This entry has been deprecated because it was a duplicate of CWE-908. All content has been transferred to CWE-908.

TypeScript

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

TypeScript

1198

Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.

TypeScript

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

TypeScript

1202

Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).

TypeScript

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

TypeScript

1210

Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.

TypeScript

1211

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

TypeScript

1212

Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.

TypeScript

1213

Weaknesses in this category are related to a software system's random number generation.

TypeScript

1214

Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.

TypeScript

1215

Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.

TypeScript

1217

Weaknesses in this category are related to session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed.

TypeScript

1219

Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.

TypeScript

1228

Weaknesses in this category are related to the use of built-in functions or external APIs.

TypeScript

1275

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

TypeScript

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

TypeScript

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

TypeScript

1307

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.

TypeScript

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

TypeScript

1309

Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.

TypeScript

1327

The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

TypeScript

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

TypeScript

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

TypeScript

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

TypeScript

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

TypeScript

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

TypeScript

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

TypeScript

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

TypeScript

1349

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.

TypeScript

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

TypeScript

1352

Weaknesses in this category are related to the A06 category "Vulnerable and Outdated Components" in the OWASP Top 10 2021.

TypeScript

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

TypeScript

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

TypeScript

1355

Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top 10 2021.

TypeScript

1356

Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top 10 2021.

TypeScript

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

TypeScript

1359

Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

TypeScript

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

TypeScript

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

TypeScript

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

TypeScript

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

TypeScript

1364

Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

TypeScript

1366

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

TypeScript

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

TypeScript

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

TypeScript

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

TypeScript

1371

Weaknesses in this category are related to the "Poorly Documented or Undocumented Features" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Undocumented capabilities and configurations pose a risk by not having a clear understanding of what the device is specifically supposed to do and only do. Therefore possibly opening up the attack surface and vulnerabilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

TypeScript

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

TypeScript

1373

Weaknesses in this category are related to the "Trust Model Problems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Assumptions made about the user during the design or construction phase may result in vulnerabilities after the system is installed if the user operates it using a different security approach or process than what was designed or built." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

TypeScript

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

TypeScript

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

TypeScript

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

TypeScript

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

TypeScript

1396

Weaknesses in this category are related to access control.

TypeScript

1397

Weaknesses in this category are related to comparison.

TypeScript

1398

Weaknesses in this category are related to component interaction.

TypeScript

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

TypeScript

1402

Weaknesses in this category are related to encryption.

TypeScript

1403

Weaknesses in this category are related to exposed resource.

TypeScript

1404

Weaknesses in this category are related to file handling.

TypeScript

1405

Weaknesses in this category are related to improper check or handling of exceptional conditions.

TypeScript

1406

Weaknesses in this category are related to improper input validation.

TypeScript

1407

Weaknesses in this category are related to improper neutralization.

TypeScript

1409

Weaknesses in this category are related to injection.

TypeScript

1410

Weaknesses in this category are related to insufficient control flow management.

TypeScript

1411

Weaknesses in this category are related to insufficient verification of data authenticity.

TypeScript

1412

Weaknesses in this category are related to poor coding practices.

TypeScript

1413

Weaknesses in this category are related to protection mechanism failure.

TypeScript

1414

Weaknesses in this category are related to randomness.

TypeScript

1415

Weaknesses in this category are related to resource control.

TypeScript

1416

Weaknesses in this category are related to resource lifecycle management.

TypeScript

1417

Weaknesses in this category are related to sensitive information exposure.

TypeScript

1418

Weaknesses in this category are related to violation of secure design principles.

VB.NET

2

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

VB.NET

4

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

VB.NET

5

Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.

VB.NET

16

Weaknesses in this category are typically introduced during the configuration of the software.

VB.NET

17

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

VB.NET

18

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

VB.NET

19

Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.

VB.NET

20

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

VB.NET

21

This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).

VB.NET

22

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

VB.NET

23

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

VB.NET

36

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.

VB.NET

73

The product allows user input to control or influence paths or file names that are used in filesystem operations.

VB.NET

74

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

VB.NET

77

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

VB.NET

78

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

VB.NET

79

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

VB.NET

80

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

VB.NET

82

The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.

VB.NET

83

The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.

VB.NET

85

The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.

VB.NET

86

The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.

VB.NET

87

The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.

VB.NET

88

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

VB.NET

89

The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

VB.NET

90

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.

VB.NET

91

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

VB.NET

94

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

VB.NET

95

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

VB.NET

116

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

VB.NET

117

The product does not neutralize or incorrectly neutralizes output that is written to logs.

VB.NET

137

Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.

VB.NET

138

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.

VB.NET

140

The product does not neutralize or incorrectly neutralizes delimiters.

VB.NET

141

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

VB.NET

142

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.

VB.NET

143

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.

VB.NET

146

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.

VB.NET

149

Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.

VB.NET

150

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

VB.NET

157

The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.

VB.NET

171

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.

VB.NET

189

Weaknesses in this category are related to improper calculation or conversion of numbers.

VB.NET

199

Weaknesses in this category are related to improper handling of sensitive information.

VB.NET

200

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

VB.NET

201

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

VB.NET

209

The product generates an error message that includes sensitive information about its environment, users, or associated data.

VB.NET

210

The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.

VB.NET

211

The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.

VB.NET

221

The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.

VB.NET

223

The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.

VB.NET

226

The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.

VB.NET

227

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."

VB.NET

249

This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.

VB.NET

254

Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

VB.NET

255

Weaknesses in this category are related to the management of credentials.

VB.NET

256

Storing a password in plaintext may result in a system compromise.

VB.NET

257

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

VB.NET

259

The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.

VB.NET

264

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

VB.NET

265

Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.

VB.NET

284

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

VB.NET

285

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

VB.NET

287

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

VB.NET

295

The product does not validate, or incorrectly validates, a certificate.

VB.NET

296

The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.

VB.NET

299

The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

VB.NET

300

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.

VB.NET

304

The product implements an authentication technique, but it skips a step that weakens the technique.

VB.NET

306

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

VB.NET

310

Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.

VB.NET

311

The product does not encrypt sensitive or critical information before storage or transmission.

VB.NET

312

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

VB.NET

313

The product stores sensitive information in cleartext in a file, or on disk.

VB.NET

314

The product stores sensitive information in cleartext in the registry.

VB.NET

315

The product stores sensitive information in cleartext in a cookie.

VB.NET

317

The product stores sensitive information in cleartext within the GUI.

VB.NET

318

The product stores sensitive information in cleartext in an executable.

VB.NET

319

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

VB.NET

320

Weaknesses in this category are related to errors in the management of cryptographic keys.

VB.NET

321

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

VB.NET

326

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

VB.NET

327

The product uses a broken or risky cryptographic algorithm or protocol.

VB.NET

328

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

VB.NET

330

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

VB.NET

338

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

VB.NET

344

The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.

VB.NET

345

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

VB.NET

352

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

VB.NET

353

The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.

VB.NET

355

Weaknesses in this category are related to or introduced in the User Interface (UI).

VB.NET

359

The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

VB.NET

361

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

VB.NET

369

The product divides a value by zero.

VB.NET

371

Weaknesses in this category are related to improper management of system state.

VB.NET

380

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

VB.NET

381

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

VB.NET

388

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

VB.NET

389

This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.

VB.NET

398

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

VB.NET

399

Weaknesses in this category are related to improper management of system resources.

VB.NET

402

The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.

VB.NET

403

A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.

VB.NET

404

The product does not release or incorrectly releases a resource before it is made available for re-use.

VB.NET

405

The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

VB.NET

409

The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

VB.NET

435

An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.

VB.NET

436

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

VB.NET

438

Weaknesses in this category are related to unexpected behaviors from code that an application uses.

VB.NET

442

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

VB.NET

452

Weaknesses in this category occur in behaviors that are used for initialization and breakdown.

VB.NET

459

The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

VB.NET

465

Weaknesses in this category are related to improper handling of pointers.

VB.NET

470

The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.

VB.NET

476

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

VB.NET

485

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

VB.NET

497

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

VB.NET

502

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

VB.NET

505

This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.

VB.NET

522

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

VB.NET

523

Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.

VB.NET

532

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

VB.NET

536

A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.

VB.NET

538

The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.

VB.NET

539

The web application uses persistent cookies, but the cookies contain sensitive information.

VB.NET

540

Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.

VB.NET

543

The product uses the singleton pattern when creating a resource within a multithreaded environment.

VB.NET

550

Certain conditions, such as network failure, will cause a server error message to be displayed.

VB.NET

552

The product makes files or directories accessible to unauthorized actors, even though they should not be.

VB.NET

557

Weaknesses in this category are related to concurrent use of shared resources.

VB.NET

559

This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.

VB.NET

561

The product contains dead code, which can never be executed.

VB.NET

566

The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.

VB.NET

573

The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.

VB.NET

601

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

VB.NET

610

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

VB.NET

611

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

VB.NET

615

While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.

VB.NET

624

The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.

VB.NET

628

The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.

VB.NET

629

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

VB.NET

632

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

VB.NET

633

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

VB.NET

634

This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.

VB.NET

635

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

VB.NET

639

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

VB.NET

642

The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.

VB.NET

643

The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.

VB.NET

644

The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.

VB.NET

657

The product violates well-established principles for secure design.

VB.NET

662

The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.

VB.NET

664

The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

VB.NET

668

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

VB.NET

669

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

VB.NET

671

The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.

VB.NET

674

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

VB.NET

682

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

VB.NET

683

The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.

VB.NET

691

The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.

VB.NET

692

The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.

VB.NET

693

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

VB.NET

699

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

VB.NET

700

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

VB.NET

703

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

VB.NET

706

The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

VB.NET

707

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

VB.NET

710

The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.

VB.NET

711

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

VB.NET

712

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.

VB.NET

713

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.

VB.NET

714

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.

VB.NET

715

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.

VB.NET

716

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.

VB.NET

717

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.

VB.NET

718

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.

VB.NET

719

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.

VB.NET

720

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.

VB.NET

721

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.

VB.NET

722

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.

VB.NET

723

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.

VB.NET

724

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.

VB.NET

725

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.

VB.NET

727

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.

VB.NET

728

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.

VB.NET

729

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.

VB.NET

730

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.

VB.NET

731

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.

VB.NET

734

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.

VB.NET

736

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008).

VB.NET

737

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).

VB.NET

738

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).

VB.NET

739

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008).

VB.NET

741

Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).

VB.NET

742

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).

VB.NET

743

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).

VB.NET

744

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).

VB.NET

745

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) chapter of the CERT C Secure Coding Standard (2008).

VB.NET

746

Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).

VB.NET

747

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).

VB.NET

750

CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

VB.NET

751

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.

VB.NET

752

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.

VB.NET

753

Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.

VB.NET

755

The product does not handle or incorrectly handles an exceptional condition.

VB.NET

759

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

VB.NET

760

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.

VB.NET

776

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

VB.NET

778

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

VB.NET

798

The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

VB.NET

800

CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.

VB.NET

801

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.

VB.NET

802

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.

VB.NET

803

Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.

VB.NET

808

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

VB.NET

809

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

VB.NET

810

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.

VB.NET

811

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.

VB.NET

812

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.

VB.NET

813

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.

VB.NET

814

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.

VB.NET

815

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.

VB.NET

816

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.

VB.NET

817

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.

VB.NET

818

Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.

VB.NET

819

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2010.

VB.NET

820

The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

VB.NET

827

The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.

VB.NET

829

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

VB.NET

834

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

VB.NET

835

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

VB.NET

840

Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.

VB.NET

844

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

VB.NET

845

Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

VB.NET

848

Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

VB.NET

850

Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

VB.NET

851

Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

VB.NET

852

Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

VB.NET

853

Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

VB.NET

855

Weaknesses in this category are related to rules in the Thread Pools (TPS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

VB.NET

857

Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

VB.NET

858

Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

VB.NET

859

Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

VB.NET

861

Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

VB.NET

862

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

VB.NET

864

Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

VB.NET

865

Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

VB.NET

866

Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

VB.NET

867

Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.

VB.NET

868

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

VB.NET

871

Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

VB.NET

872

Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

VB.NET

873

Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

VB.NET

875

Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

VB.NET

876

Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

VB.NET

877

Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

VB.NET

878

Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

VB.NET

879

Weaknesses in this category are related to rules in the Signals (SIG) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

VB.NET

880

Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

VB.NET

881

Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

VB.NET

882

Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

VB.NET

883

Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.

VB.NET

884

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

VB.NET

885

This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).

VB.NET

886

This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).

VB.NET

887

This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).

VB.NET

888

CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).

VB.NET

889

This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).

VB.NET

890

This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).

VB.NET

892

This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).

VB.NET

893

This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).

VB.NET

894

This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22).

VB.NET

895

This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).

VB.NET

896

This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).

VB.NET

898

This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).

VB.NET

899

This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).

VB.NET

900

CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.

VB.NET

902

This category identifies Software Fault Patterns (SFPs) within the Channel cluster.

VB.NET

903

This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.

VB.NET

905

This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.

VB.NET

906

This category identifies Software Fault Patterns (SFPs) within the UI cluster.

VB.NET

907

This category identifies Software Fault Patterns (SFPs) within the Other cluster.

VB.NET

913

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

VB.NET

916

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

VB.NET

922

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

VB.NET

923

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

VB.NET

928

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.

VB.NET

929

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.

VB.NET

930

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.

VB.NET

931

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2013.

VB.NET

932

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.

VB.NET

933

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.

VB.NET

934

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.

VB.NET

935

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.

VB.NET

936

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2013.

VB.NET

938

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2013.

VB.NET

943

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.

VB.NET

944

This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.

VB.NET

945

This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).

VB.NET

947

This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.

VB.NET

948

This category identifies Software Fault Patterns (SFPs) within the Digital Certificate cluster.

VB.NET

949

This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).

VB.NET

950

This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).

VB.NET

952

This category identifies Software Fault Patterns (SFPs) within the Missing Authentication cluster.

VB.NET

956

This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.

VB.NET

957

This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.

VB.NET

958

This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.

VB.NET

959

This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.

VB.NET

961

This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).

VB.NET

962

This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).

VB.NET

963

This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).

VB.NET

966

This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.

VB.NET

971

This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).

VB.NET

975

This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.

VB.NET

977

This category identifies Software Fault Patterns (SFPs) within the Design cluster.

VB.NET

978

This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.

VB.NET

980

This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).

VB.NET

981

This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).

VB.NET

982

This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).

VB.NET

984

This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.

VB.NET

985

This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).

VB.NET

986

This category identifies Software Fault Patterns (SFPs) within the Missing Lock cluster (SFP19).

VB.NET

990

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).

VB.NET

991

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).

VB.NET

992

This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.

VB.NET

994

This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).

VB.NET

997

This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster.

VB.NET

998

This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).

VB.NET

1000

This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.

VB.NET

1001

This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).

VB.NET

1003

CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.

VB.NET

1005

This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

VB.NET

1006

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

VB.NET

1008

This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.

VB.NET

1009

Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.

VB.NET

1010

Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

VB.NET

1011

Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.

VB.NET

1012

Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.

VB.NET

1013

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

VB.NET

1014

Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.

VB.NET

1015

Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.

VB.NET

1016

Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.

VB.NET

1019

Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.

VB.NET

1020

Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.

VB.NET

1026

CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.

VB.NET

1027

Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.

VB.NET

1028

Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.

VB.NET

1029

Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.

VB.NET

1030

Weaknesses in this category are related to the A4 category in the OWASP Top 10 2017.

VB.NET

1031

Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.

VB.NET

1032

Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.

VB.NET

1033

Weaknesses in this category are related to the A7 category in the OWASP Top 10 2017.

VB.NET

1034

Weaknesses in this category are related to the A8 category in the OWASP Top 10 2017.

VB.NET

1036

Weaknesses in this category are related to the A10 category in the OWASP Top 10 2017.

VB.NET

1041

The product has multiple functions, methods, procedures, macros, etc. that contain the same code.

VB.NET

1128

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.

VB.NET

1129

Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software.

VB.NET

1130

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.

VB.NET

1131

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

VB.NET

1133

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

VB.NET

1134

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

VB.NET

1136

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.

VB.NET

1137

Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java.

VB.NET

1140

Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

VB.NET

1141

Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.

VB.NET

1142

Weaknesses in this category are related to the rules and recommendations in the Visibility and Atomicity (VNA) section of the SEI CERT Oracle Secure Coding Standard for Java.

VB.NET

1143

Weaknesses in this category are related to the rules and recommendations in the Locking (LCK) section of the SEI CERT Oracle Secure Coding Standard for Java.

VB.NET

1145

Weaknesses in this category are related to the rules and recommendations in the Thread Pools (TPS) section of the SEI CERT Oracle Secure Coding Standard for Java.

VB.NET

1147

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

VB.NET

1148

Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

VB.NET

1152

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

VB.NET

1154

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.

VB.NET

1157

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.

VB.NET

1158

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard.

VB.NET

1159

Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard.

VB.NET

1162

Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.

VB.NET

1163

Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.

VB.NET

1164

The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.

VB.NET

1165

Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.

VB.NET

1166

Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) section of the SEI CERT C Coding Standard.

VB.NET

1169

Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.

VB.NET

1170

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.

VB.NET

1172

Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.

VB.NET

1178

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.

VB.NET

1179

Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.

VB.NET

1180

Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard.

VB.NET

1181

Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.

VB.NET

1182

Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard.

VB.NET

1186

Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.

VB.NET

1194

This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

VB.NET

1200

CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.

VB.NET

1202

Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).

VB.NET

1207

Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.

VB.NET

1210

Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.

VB.NET

1211

Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.

VB.NET

1212

Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.

VB.NET

1213

Weaknesses in this category are related to a software system's random number generation.

VB.NET

1214

Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.

VB.NET

1219

Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.

VB.NET

1305

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

VB.NET

1306

Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.

VB.NET

1307

Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.

VB.NET

1308

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

VB.NET

1309

Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.

VB.NET

1337

CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.

VB.NET

1340

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

VB.NET

1344

CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.

VB.NET

1345

Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.

VB.NET

1346

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.

VB.NET

1347

Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.

VB.NET

1348

Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.

VB.NET

1349

Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.

VB.NET

1350

CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.

VB.NET

1353

Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.

VB.NET

1354

Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.

VB.NET

1355

Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top 10 2021.

VB.NET

1358

CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.

VB.NET

1359

Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

VB.NET

1360

Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

VB.NET

1361

Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

VB.NET

1362

Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

VB.NET

1363

Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.

VB.NET

1364

Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

VB.NET

1366

Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

VB.NET

1368

Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

VB.NET

1369

Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

VB.NET

1370

Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

VB.NET

1372

Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

VB.NET

1375

Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

VB.NET

1382

Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

VB.NET

1383

Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.

VB.NET

1387

CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.

VB.NET

1396

Weaknesses in this category are related to access control.

VB.NET

1398

Weaknesses in this category are related to component interaction.

VB.NET

1400

This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.

VB.NET

1401

Weaknesses in this category are related to concurrency.

VB.NET

1402

Weaknesses in this category are related to encryption.

VB.NET

1403

Weaknesses in this category are related to exposed resource.

VB.NET

1404

Weaknesses in this category are related to file handling.