Skip to content
Vulnerabilities by weakness
Weaknesses
- CWE-79 Cross-site Scripting 50,080
- CWE-89 SQL Injection 21,728
- CWE-119 Buffer Overflow 15,812
- CWE-787 Out-of-bounds Write 15,629
- CWE-20 Improper Input Validation 15,190
- CWE-200 Information Disclosure 13,523
- CWE-862 Missing Authorization 11,704
- CWE-22 Path traversal 11,251
- CWE-125 Out-of-bounds Read 10,655
- CWE-352 Cross-Site Request Forgery 10,048
- CWE-416 Use After Free 9,733
- CWE-284 Improper Access Control 9,240
- CWE-94 Improper Control of Generation of Code 8,090
- CWE-78 Shell injection 7,386
- CWE-74 Injection 6,101
- CWE-476 NULL Pointer Dereference 5,953
- CWE-287 Improper Authentication 5,931
- CWE-863 Incorrect Authorization 5,740
- CWE-269 Improper Privilege Management 5,666
- CWE-264 Permissions, Privileges, and Access Controls 5,539
- CWE-400 Uncontrolled Resource Consumption 5,111
- CWE-120 Classic Buffer Overflow 4,710
- CWE-434 Unrestricted File Upload 4,682
- CWE-77 Command injection 4,622
- CWE-121 Stack-based Buffer Overflow 4,150
- CWE-918 Server-Side Request Forgery 4,146
- CWE-190 Integer Overflow or Wraparound 3,915
- CWE-306 Missing Authentication for Critical Functionality 3,835
- CWE-502 Deserialization of Untrusted Data 3,782
- CWE-122 Heap-based Buffer Overflow 3,758
- CWE-639 Insecure Direct Object Reference / IDOR 3,426
- CWE-362 Race Condition 3,069
- CWE-770 Allocation of Resources Without Limits or Throttling 2,960
- CWE-399 Resource Management Errors 2,701
- CWE-310 Cryptographic Issues 2,531
- CWE-732 Incorrect Permission Assignment for Critical Resource 2,058
- CWE-401 Memory Leak 2,041
- CWE-285 Improper Authorization 1,965
- CWE-798 Use of Hard-coded Credentials 1,954
- CWE-59 insecure temporary file 1,924
Show 688 moreShow less
- CWE-601 URL Redirection to Untrusted Site 1,903
- CWE-522 Insufficiently Protected Credentials 1,796
- CWE-295 Improper Certificate Validation 1,768
- CWE-276 Incorrect Default Permissions 1,763
- CWE-611 XXE 1,472
- CWE-532 Insertion of Sensitive Information into Log File 1,367
- CWE-98 Remote file include 1,360
- CWE-266 Incorrect Privilege Assignment 1,304
- CWE-189 Numeric Errors 1,277
- CWE-427 Uncontrolled Search Path Element 1,265
- CWE-668 Exposure of Resource to Wrong Sphere 1,229
- CWE-835 Loop with Unreachable Exit Condition 1,062
- CWE-843 Type Confusion 1,043
- CWE-347 Improper Verification of Cryptographic Signature 1,034
- CWE-693 Protection Mechanism Failure 1,025
- CWE-319 Cleartext Transmission of Sensitive Information 1,011
- CWE-908 Use of Uninitialized Resource 999
- CWE-345 Insufficient Verification of Data Authenticity 982
- CWE-415 Double Free 973
- CWE-617 Reachable Assertion 957
- CWE-367 TOCTTOU 955
- CWE-312 Cleartext Storage of Sensitive Information 936
- CWE-346 Origin Validation Error 900
- CWE-404 Improper Resource Shutdown or Release 888
- CWE-290 Authentication Bypass by Spoofing 872
- CWE-203 Observable Discrepancy 857
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm 816
- CWE-73 External Control of File Name or Path 797
- CWE-255 Credentials Management Errors 784
- CWE-426 Untrusted Search Path 782
- CWE-667 Improper Locking 774
- CWE-1321 Prototype Pollution 767
- CWE-288 Authentication Bypass Using an Alternate Path or Channel 763
- CWE-613 740
- CWE-307 Improper Restriction of Excessive Authentication Attempts 728
- CWE-754 Improper Check for Unusual or Exceptional Conditions 717
- CWE-129 Improper Validation of Array Index 713
- CWE-209 Generation of Error Message Containing Sensitive Information 694
- CWE-674 Uncontrolled Recursion 692
- CWE-80 Basic XSS 677
- CWE-191 Integer Underflow (Wrap or Wraparound) 676
- CWE-755 Improper Handling of Exceptional Conditions 663
- CWE-116 Improper Encoding or Escaping of Output 638
- CWE-1333 ReDoS 620
- CWE-326 Inadequate Encryption Strength 595
- CWE-311 Missing Encryption of Sensitive Data 594
- CWE-126 Buffer Over-read 587
- CWE-772 Missing Release of Resource after Effective Lifetime 583
- CWE-552 Files or Directories Accessible to External Parties 576
- CWE-23 Relative Path Traversal 573
- CWE-88 Argument Injection 552
- CWE-201 Insertion of Sensitive Information Into Sent Data 510
- CWE-369 Divide By Zero 497
- CWE-444 HTTP Request Smuggling 489
- CWE-384 Session Fixation 487
- CWE-1284 Improper Validation of Specified Quantity in Input 486
- CWE-428 Unquoted Search Path or Element 465
- CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere 465
- CWE-330 Use of Insufficiently Random Values 449
- CWE-451 User Interface (UI) Misrepresentation of Critical Information 445
- CWE-1021 Clickjacking 437
- CWE-134 Use of Externally-Controlled Format String 434
- CWE-321 Use of Hard-coded Cryptographic Key 427
- CWE-922 Insecure Storage of Sensitive Information 417
- CWE-254 7PK - Security Features 415
- CWE-248 Uncaught Exception 409
- CWE-1188 Initialization of a Resource with an Insecure Default 405
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere 405
- CWE-250 Execution with Unnecessary Privileges 401
- CWE-281 Improper Preservation of Permissions 389
- CWE-665 Improper Initialization 386
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password 363
- CWE-789 Stack Exhaustion 345
- CWE-1236 CSV Injection 334
- CWE-294 Authentication Bypass by Capture-replay 327
- CWE-16 Configuration 318
- CWE-1336 Server-Side Template Injection / SSTI 317
- CWE-824 Access of Uninitialized Pointer 315
- CWE-704 Incorrect Type Conversion or Cast 311
- CWE-822 Untrusted Pointer Dereference 307
- CWE-93 CRLF Injection 300
- CWE-256 Plaintext Storage of a Password 298
- CWE-407 Inefficient Algorithmic Complexity 295
- CWE-457 Use of Uninitialized Variable 287
- CWE-521 Weak Password Requirements 278
- CWE-184 Incomplete List of Disallowed Inputs 277
- CWE-610 Externally Controlled Reference to a Resource in Another Sphere 273
- CWE-915 Mass Assignment 273
- CWE-193 Off-by-one Error 267
- CWE-707 Improper Neutralization 267
- CWE-494 Download of Code Without Integrity Check 265
- CWE-131 Incorrect Calculation of Buffer Size 264
- CWE-425 Direct Request 258
- CWE-459 Incomplete Cleanup 257
- CWE-208 Observable Timing Discrepancy 248
- CWE-95 Eval Injection 240
- CWE-19 Data Processing Errors 239
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 239
- CWE-354 Improper Validation of Integrity Check Value 234
- CWE-749 Exposed Dangerous Method or Function 230
- CWE-436 Interpretation Conflict 229
- CWE-359 Privacy violation 227
- CWE-441 Unintended Proxy or Intermediary 225
- CWE-204 Observable Response Discrepancy 223
- CWE-259 Use of Hard-coded Password 222
- CWE-917 EL Injection 219
- CWE-252 Unchecked Return Value 213
- CWE-61 UNIX Symbolic Link (Symlink) Following 211
- CWE-697 Incorrect Comparison 211
- CWE-35 Path Traversal: '.../...//' 204
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) 200
- CWE-703 Improper Check or Handling of Exceptional Conditions 196
- CWE-280 Improper Handling of Insufficient Permissions or Privileges 192
- CWE-305 Authentication Bypass by Primary Weakness 190
- CWE-602 Client-Side Enforcement of Server-Side Security 189
- CWE-682 Incorrect Calculation 182
- CWE-1287 Improper Validation of Specified Type of Input 177
- CWE-670 Always-Incorrect Control Flow Implementation 177
- CWE-331 Insufficient Entropy 175
- CWE-788 Access of Memory Location After End of Buffer 168
- CWE-91 XML Injection 168
- CWE-472 Assumed-Immutable Parameter Tampering 167
- CWE-706 Use of Incorrectly-Resolved Name or Reference 167
- CWE-17 166
- CWE-681 Incorrect Conversion between Numeric Types 160
- CWE-916 Use of Password Hash With Insufficient Computational Effort 158
- CWE-943 NoSQL Injection, NoSQLi 155
- CWE-178 Improper Handling of Case Sensitivity 154
- CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains 154
- CWE-36 Absolute Path Traversal 153
- CWE-776 XEE 152
- CWE-117 Improper Output Neutralization for Logs 147
- CWE-377 146
- CWE-470 Reflection Injection 146
- CWE-807 Reliance on Untrusted Inputs in a Security Decision 146
- CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer 145
- CWE-130 length manipulation 144
- CWE-358 Improperly Implemented Security Check for Standard 144
- CWE-113 HTTP Request Splitting 142
- CWE-506 Embedded Malicious Code 138
- CWE-1220 Insufficient Granularity of Access Control 137
- CWE-1392 Use of Default Credentials 134
- CWE-913 Improper Control of Dynamically-Managed Code Resources 134
- CWE-1395 Dependency on Vulnerable Third-Party Component 133
- CWE-669 Incorrect Resource Transfer Between Spheres 131
- CWE-24 Path Traversal: '../filedir' 129
- CWE-763 Release of Invalid Pointer or Reference 129
- CWE-834 Excessive Iteration 128
- CWE-1390 Weak Authentication 123
- CWE-303 Incorrect Implementation of Authentication Algorithm 123
- CWE-672 Operation on a Resource after Expiration or Release 119
- CWE-275 Permission Issues 116
- CWE-680 Integer Overflow to Buffer Overflow 115
- CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory 114
- CWE-823 Use of Out-of-range Pointer Offset 113
- CWE-909 Missing Initialization of Resource 113
- CWE-1286 Improper Validation of Syntactic Correctness of Input 111
- CWE-926 Improper Export of Android Application Components 111
- CWE-620 Unverified Password Change 110
- CWE-15 External Control of System or Configuration Setting 109
- CWE-348 Use of Less Trusted Source 107
- CWE-489 Active Debug Code 107
- CWE-840 Business Logic Errors 107
- CWE-328 Use of Weak Hash 106
- CWE-297 Improper Validation of Certificate with Host Mismatch 105
- CWE-90 LDAP Injection 105
- CWE-598 Use of HTTP Request With Sensitive Query String 104
- CWE-825 Expired Pointer Dereference 102
- CWE-320 Key Management Errors 99
- CWE-799 Insufficient anti-automation 99
- CWE-912 Hidden Functionality 99
- CWE-150 ANSI injection 98
- CWE-197 Numeric Truncation Error 98
- CWE-653 Separation of Privilege 95
- CWE-524 Use of Cache Containing Sensitive Information 91
- CWE-923 Improper Restriction of Communication Channel to Intended Endpoints 91
- CWE-841 Improper Enforcement of Behavioral Workflow 90
- CWE-565 Reliance on Cookies without Validation and Integrity Checking 88
- CWE-662 Improper Synchronization 88
- CWE-636 Not Failing Securely 86
- CWE-99 Improper Control of Resource Identifiers 84
- CWE-405 Asymmetric Resource Consumption (Amplification) 83
- CWE-471 Modification of Assumed-Immutable Data (MAID) 79
- CWE-940 Improper Verification of Source of a Communication Channel 79
- CWE-379 Creation of Temporary File in Directory with Insecure Permissions 78
- CWE-267 Privilege Defined With Unsafe Actions 77
- CWE-277 Insecure Inherited Permissions 77
- CWE-591 Sensitive Data Storage in Improperly Locked Memory 77
- CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input 75
- CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute 73
- CWE-300 Channel Accessible by Non-Endpoint 72
- CWE-1391 Use of Weak Credentials 71
- CWE-257 Storing Passwords in a Recoverable Format 71
- CWE-325 Missing Cryptographic Step 71
- CWE-29 Path Traversal: '\..\filename' 70
- CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax 69
- CWE-648 Incorrect Use of Privileged APIs 69
- CWE-664 Improper Control of a Resource Through its Lifetime 68
- CWE-123 Write-what-where Condition 67
- CWE-183 Permissive List of Allowed Inputs 67
- CWE-170 Improper Null Termination 65
- CWE-340 Generation of Predictable Numbers or Identifiers 64
- CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data 64
- CWE-805 Buffer Access with Incorrect Length Value 64
- CWE-696 Incorrect Behavior Order 63
- CWE-87 Improper Neutralization of Alternate XSS Syntax 62
- CWE-548 Exposure of Information Through Directory Listing 61
- CWE-185 Incorrect Regular Expression 60
- CWE-488 Exposure of Data Element to Wrong Session 57
- CWE-353 Missing Support for Integrity Check 56
- CWE-378 Creation of Temporary File With Insecure Permissions 56
- CWE-304 Missing Critical Step in Authentication 55
- CWE-440 Expected Behavior Violation 55
- CWE-202 Exposure of Sensitive Information Through Data Queries 54
- CWE-289 Authentication Bypass by Alternate Name 54
- CWE-1289 Improper Validation of Unsafe Equivalence in Input 53
- CWE-273 Improper Check for Dropped Privileges 53
- CWE-323 Reusing a Nonce, Key Pair in Encryption 53
- CWE-1385 Missing Origin Validation in WebSockets 52
- CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag 51
- CWE-385 Covert Timing Channel 51
- CWE-606 Unchecked Input for Loop Condition 50
- CWE-1393 Use of Default Password 49
- CWE-180 Incorrect Behavior Order: Validate Before Canonicalize 49
- CWE-782 Exposed IOCTL with Insufficient Access Control 49
- CWE-124 Buffer Underwrite 48
- CWE-261 Weak Encoding for Password 48
- CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) 48
- CWE-272 Least Privilege Violation 47
- CWE-302 Authentication Bypass by Assumed-Immutable Data 47
- CWE-424 Improper Protection of Alternate Path 47
- CWE-41 Improper Resolution of Path Equivalence 46
- CWE-691 Insufficient Control Flow Management 46
- CWE-75 Special Element Injection 46
- CWE-791 Incomplete Filtering of Special Elements 46
- CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action 45
- CWE-176 Improper Handling of Unicode Encoding 44
- CWE-316 Cleartext Storage of Sensitive Information in Memory 44
- CWE-525 Use of Web Browser Cache Containing Sensitive Information 44
- CWE-757 Algorithm Downgrade 44
- CWE-214 Invocation of Process Using Visible Sensitive Information 43
- CWE-274 Improper Handling of Insufficient Privileges 43
- CWE-388 7PK - Errors 43
- CWE-420 Unprotected Alternate Channel 42
- CWE-226 Sensitive Information in Resource Not Removed Before Reuse 41
- CWE-501 Trust Boundary Violation 41
- CWE-778 Insufficient Logging 41
- CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel 41
- CWE-158 Improper Neutralization of Null Byte or NUL Character 40
- CWE-690 Unchecked Return Value to NULL Pointer Dereference 40
- CWE-1288 Improper Validation of Consistency within Input 39
- CWE-540 Inclusion of Sensitive Information in Source Code 38
- CWE-115 Misinterpretation of Input 37
- CWE-195 Signed to Unsigned Conversion Error 37
- CWE-1300 Improper Protection of Physical Side Channels 36
- CWE-213 Exposure of Sensitive Information Due to Incompatible Policies 36
- CWE-233 Improper Handling of Parameters 36
- CWE-241 Improper Handling of Unexpected Data Type 36
- CWE-283 Unverified Ownership 36
- CWE-286 Incorrect User Management 36
- CWE-322 Key Exchange without Entity Authentication 36
- CWE-758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior 36
- CWE-83 Improper Neutralization of Script in Attributes in a Web Page 36
- CWE-1104 Use of Unmaintained Third Party Components 35
- CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation 35
- CWE-1275 Sensitive Cookie with Improper SameSite Attribute 35
- CWE-939 Improper Authorization in Handler for Custom URL Scheme 35
- CWE-1327 Binding to an Unrestricted IP Address 34
- CWE-313 Cleartext Storage in a File or on Disk 34
- CWE-390 Detection of Error Condition Without Action 34
- CWE-92 34
- CWE-282 Improper Ownership Management 33
- CWE-356 Human-in-the-Loop 33
- CWE-833 Deadlock 33
- CWE-96 Static Code Injection 32
- CWE-460 Improper Cleanup on Thrown Exception 31
- CWE-657 Violation of Secure Design Principles 31
- CWE-684 Incorrect Provision of Specified Functionality 31
- CWE-215 Insertion of Sensitive Information Into Debugging Code 30
- CWE-27 Path Traversal: 'dir/../../filename' 30
- CWE-1191 On-Chip Debug and Test Interface With Improper Access Control 29
- CWE-1325 Stack Exhaustion 29
- CWE-279 Incorrect Execution-Assigned Permissions 29
- CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization 29
- CWE-603 Use of Client-Side Authentication 29
- CWE-114 Process Control 28
- CWE-155 Improper Neutralization of Wildcards or Matching Symbols 28
- CWE-172 Improper Encoding or Decoding of Data 28
- CWE-270 Privilege Context Switching Error 28
- CWE-324 Use of a Key Past its Expiration Date 28
- CWE-391 28
- CWE-590 Free of Memory not on the Heap 28
- CWE-1230 Exposure of Sensitive Information Through Metadata 27
- CWE-228 Improper Handling of Syntactically Invalid Structure 27
- CWE-453 Insecure Default Variable Initialization 27
- CWE-523 Unprotected Transport of Credentials 27
- CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable 27
- CWE-118 Incorrect Access of Indexable Resource 26
- CWE-253 Incorrect Check of Function Return Value 26
- CWE-260 Password in Configuration File 26
- CWE-402 Resource Leak 26
- CWE-406 Insufficient Control of Network Message Volume (Network Amplification) 26
- CWE-1394 Use of Default Cryptographic Key 25
- CWE-268 Privilege Chaining 25
- CWE-366 Race Condition within a Thread 25
- CWE-625 Permissive Regular Expression 25
- CWE-1295 Debug Messages Revealing Unnecessary Information 24
- CWE-138 Improper Neutralization of Special Elements 24
- CWE-299 Improper Check for Certificate Revocation 24
- CWE-351 Insufficient Type Distinction 24
- CWE-592 24
- CWE-783 Operator Precedence Logic Error 24
- CWE-177 Improper Handling of URL Encoding (Hex Encoding) 23
- CWE-244 Heap Inspection 23
- CWE-296 Improper Following of a Certificate's Chain of Trust 23
- CWE-642 External Control of Critical State Data 23
- CWE-708 Incorrect Ownership Assignment 23
- CWE-759 Use of a One-Way Hash without a Salt 23
- CWE-779 Logging of Excessive Data 23
- CWE-84 Improper Neutralization of Encoded URI Schemes in a Web Page 23
- CWE-1025 Comparison Using Wrong Factors 22
- CWE-140 Improper Neutralization of Delimiters 22
- CWE-1427 prompt injection 22
- CWE-229 Improper Handling of Values 22
- CWE-308 Use of Single-factor Authentication 22
- CWE-410 Insufficient Resource Pool 22
- CWE-698 Execution After Redirect (EAR) 22
- CWE-838 Inappropriate Encoding for Output Context 22
- CWE-1023 Incomplete Comparison with Missing Factors 21
- CWE-1050 Excessive Platform Resource Consumption within a Loop 21
- CWE-1386 Insecure Operation on Windows Junction / Mount Point 21
- CWE-26 Path Traversal: '/dir/../filename' 21
- CWE-357 Insufficient UI Warning of Dangerous Operations 21
- CWE-475 Undefined Behavior for Input to API 21
- CWE-641 Improper Restriction of Names for Files and Other Resources 21
- CWE-804 Guessable CAPTCHA 21
- CWE-911 Improper Update of Reference Count 21
- CWE-187 Partial String Comparison 20
- CWE-341 Predictable from Observable State 20
- CWE-364 Signal Handler Race Condition 20
- CWE-413 Improper Resource Locking 20
- CWE-837 Improper Enforcement of a Single, Unique Action 20
- CWE-1259 Improper Restriction of Security Token Assignment 19
- CWE-395 Use of NullPointerException Catch to Detect NULL Pointer Dereference 19
- CWE-549 Missing Password Field Masking 19
- CWE-643 XPath Injection 19
- CWE-836 Use of Password Hash Instead of Password for Authentication 19
- CWE-1022 tabnabbing 18
- CWE-1260 Improper Handling of Overlap Between Protected Memory Ranges 18
- CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG) 18
- CWE-564 HQL Injection 18
- CWE-820 Missing Synchronization 18
- CWE-927 Use of Implicit Intent for Sensitive Communication 18
- CWE-25 Path Traversal: '/../filedir' 17
- CWE-394 Unexpected Status Code or Return Value 17
- CWE-647 Use of Non-Canonical URL Paths for Authorization Decisions 17
- CWE-694 Use of Multiple Resources with Duplicate Identifier 17
- CWE-1242 Inclusion of Undocumented Features or Chicken Bits 16
- CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information 16
- CWE-1263 Improper Physical Access Control 16
- CWE-31 Path Traversal: 'dir\..\..\filename' 16
- CWE-334 Small Space of Random Values 16
- CWE-363 Race Condition Enabling Link Following 16
- CWE-477 Use of Obsolete Function 16
- CWE-599 Missing Validation of OpenSSL Certificate 16
- CWE-76 Improper Neutralization of Equivalent Special Elements 16
- CWE-790 Improper Filtering of Special Elements 16
- CWE-821 Incorrect Synchronization 16
- CWE-265 Privilege Issues 15
- CWE-329 Generation of Predictable IV with CBC Mode 15
- CWE-393 Return of Wrong Status Code 15
- CWE-417 Communication Channel Errors 15
- CWE-112 Missing XML Validation 14
- CWE-1241 Use of Predictable Algorithm in Random Number Generator 14
- CWE-1244 Internal Asset Exposed to Unsafe Debug Access Level or State 14
- CWE-230 Improper Handling of Missing Values 14
- CWE-449 The UI Performs the Wrong Action 14
- CWE-474 Use of Function with Inconsistent Implementations 14
- CWE-64 Windows Shortcut Following (.LNK) 14
- CWE-762 Mismatched Memory Management Routines 14
- CWE-86 Improper Neutralization of Invalid Characters in Identifiers in Web Pages 14
- CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities 13
- CWE-1341 Multiple Releases of Same Resource or Handle 13
- CWE-1419 Incorrect Initialization of Resource 13
- CWE-159 Improper Handling of Invalid Use of Special Elements 13
- CWE-258 Empty Password in Configuration File 13
- CWE-271 Privilege Dropping / Lowering Errors 13
- CWE-332 Insufficient Entropy in PRNG 13
- CWE-372 Incomplete Internal State Distinction 13
- CWE-392 Missing Report of Error Condition 13
- CWE-530 Exposure of Backup File to an Unauthorized Control Sphere 13
- CWE-547 Use of Hard-coded, Security-relevant Constants 13
- CWE-567 Unsynchronized Access to Shared Data in a Multithreaded Context 13
- CWE-646 Reliance on File Name or Extension of Externally-Supplied File 13
- CWE-650 Trusting HTTP Permission Methods on the Server Side 13
- CWE-656 Reliance on Security Through Obscurity 13
- CWE-830 Inclusion of Web Functionality from an Untrusted Source 13
- CWE-941 Incorrectly Specified Destination in a Communication Channel 13
- CWE-1173 Improper Use of Validation Framework 12
- CWE-1262 Improper Access Control for Register Interface 12
- CWE-127 Buffer Under-read 12
- CWE-141 Improper Neutralization of Parameter/Argument Delimiters 12
- CWE-223 Omission of Security-relevant Information 12
- CWE-232 Improper Handling of Undefined Values 12
- CWE-291 Reliance on IP Address for Authentication 12
- CWE-419 Unprotected Primary Channel 12
- CWE-480 Use of Incorrect Operator 12
- CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key 12
- CWE-612 Improper Authorization of Index Containing Sensitive Information 12
- CWE-676 Use of Potentially Dangerous Function 12
- CWE-701 12
- CWE-842 Placement of User into Incorrect Group 12
- CWE-1270 Generation of Incorrect Security Tokens 11
- CWE-1299 Missing Protection Mechanism for Alternate Hardware Interface 11
- CWE-146 Improper Neutralization of Expression/Command Delimiters 11
- CWE-242 Use of Inherently Dangerous Function 11
- CWE-573 Improper Following of Specification by Caller 11
- CWE-616 Incomplete Identification of Uploaded File Variables (PHP) 11
- CWE-628 Function Call with Incorrectly Specified Arguments 11
- CWE-692 Incomplete Denylist to Cross-Site Scripting 11
- CWE-705 Incorrect Control Flow Scoping 11
- CWE-760 Use of a One-Way Hash with a Predictable Salt 11
- CWE-826 Premature Release of Resource During Expected Lifetime 11
- CWE-1357 Reliance on Insufficiently Trustworthy Component 10
- CWE-14 Compiler Removal of Code to Clear Buffers 10
- CWE-173 Improper Handling of Alternate Encoding 10
- CWE-179 Incorrect Behavior Order: Early Validation 10
- CWE-196 Unsigned to Signed Conversion Error 10
- CWE-298 Improper Validation of Certificate Expiration 10
- CWE-733 Compiler Optimization Removal or Modification of Security-critical Code 10
- CWE-775 Missing Release of File Descriptor or Handle after Effective Lifetime 10
- CWE-81 Improper Neutralization of Script in an Error Message Web Page 10
- CWE-921 Storage of Sensitive Data in a Mechanism without Access Control 10
- CWE-1088 Synchronous Access of Remote Resource without Timeout 9
- CWE-1274 Improper Access Control for Volatile Memory Containing Boot Code 9
- CWE-1326 Missing Immutable Root of Trust in Hardware 9
- CWE-315 Cleartext Storage of Sensitive Information in a Cookie 9
- CWE-371 State Issues 9
- CWE-40 Path Traversal: '\\UNC\share\name\' (Windows UNC Share) 9
- CWE-408 Incorrect Behavior Order: Early Amplification 9
- CWE-456 Missing Initialization of a Variable 9
- CWE-466 Return of Pointer Value Outside of Expected Range 9
- CWE-544 Missing Standardized Error Handling Mechanism 9
- CWE-561 Dead Code 9
- CWE-626 Null Byte Interaction Error (Poison Null Byte) 9
- CWE-645 Overly Restrictive Account Lockout Mechanism 9
- CWE-786 Access of Memory Location Before Start of Buffer 9
- CWE-914 Improper Control of Dynamically-Identified Variables 9
- CWE-1254 Incorrect Comparison Logic Granularity 8
- CWE-1281 Sequence of Processor Instructions Leads to Unexpected Behavior 8
- CWE-1282 Assumed-Immutable Data is Stored in Writable Memory 8
- CWE-1335 Incorrect Bitwise Shift of Integer 8
- CWE-147 Improper Neutralization of Input Terminators 8
- CWE-199 Information Management Errors 8
- CWE-219 Storage of File with Sensitive Data Under Web Root 8
- CWE-278 Insecure Preserved Inherited Permissions 8
- CWE-317 Cleartext Storage of Sensitive Information in GUI 8
- CWE-403 File descriptor leak 8
- CWE-421 Race Condition During Access to Alternate Channel 8
- CWE-539 Use of Persistent Cookies Containing Sensitive Information 8
- CWE-562 Return of Stack Variable Address 8
- CWE-649 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking 8
- CWE-710 Improper Adherence to Coding Standards 8
- CWE-82 Improper Neutralization of Script in Attributes of IMG Tags in a Web Page 8
- CWE-839 Signed comparison 8
- CWE-1038 Insecure Automated Optimizations 7
- CWE-1077 Floating Point Comparison with Incorrect Operator 7
- CWE-1256 Improper Restriction of Software Interfaces to Hardware Features 7
- CWE-1320 Improper Protection for Outbound Error Messages and Alert Signals 7
- CWE-174 Double Decoding of the Same Data 7
- CWE-188 Reliance on Data/Memory Layout 7
- CWE-192 Integer Coercion Error 7
- CWE-342 Predictable Exact Value from Previous Values 7
- CWE-361 7PK - Time and State 7
- CWE-368 Context Switching Race Condition 7
- CWE-412 Unrestricted Externally Accessible Lock 7
- CWE-627 Dynamic Variable Evaluation 7
- CWE-65 Windows Hard Link 7
- CWE-67 Improper Handling of Windows Device Names 7
- CWE-671 Lack of Administrator Control over Security 7
- CWE-686 Function Call With Incorrect Argument Type 7
- CWE-771 Missing Reference to Active Allocated Resource 7
- CWE-777 Regular Expression without Anchors 7
- CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page 7
- CWE-1007 Homograph Attack 6
- CWE-1189 Improper Isolation of Shared Resources on System-on-a-Chip (SoC) 6
- CWE-1204 Generation of Weak Initialization Vector (IV) 6
- CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection 6
- CWE-1250 Improper Preservation of Consistency Between Independent Representations of Shared State 6
- CWE-1319 Improper Protection against Electromagnetic Fault Injection (EM-FI) 6
- CWE-1328 Security Version Number Mutable to Older Versions 6
- CWE-1329 Reliance on Component That is Not Updateable 6
- CWE-1384 Improper Handling of Physical or Environmental Conditions 6
- CWE-1389 Incorrect Parsing of Numbers with Different Radices 6
- CWE-1423 Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution 6
- CWE-149 Improper Neutralization of Quoting Syntax 6
- CWE-18 6
- CWE-21 6
- CWE-221 Information Loss or Omission 6
- CWE-240 Improper Handling of Inconsistent Structural Elements 6
- CWE-249 6
- CWE-262 Not Using Password Aging 6
- CWE-37 Path Traversal: '/absolute/pathname/here' 6
- CWE-774 File Descriptor Exhaustion 6
- CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision 6
- CWE-1032 OWASP Top Ten 2017 Category A6 - Security Misconfiguration 5
- CWE-1037 Processor Optimization Removal or Modification of Security-critical Code 5
- CWE-1068 Inconsistency Between Implementation and Documented Design 5
- CWE-1100 Insufficient Isolation of System-Dependent Functions 5
- CWE-1116 Inaccurate Source Code Comments 5
- CWE-1125 Excessive Attack Surface 5
- CWE-1176 Inefficient CPU Computation 5
- CWE-1245 Improper Finite State Machines (FSMs) in Hardware Logic 5
- CWE-1255 Comparison Logic is Vulnerable to Power Side-Channel Attacks 5
- CWE-128 Wrap-around Error 5
- CWE-1303 Non-Transparent Sharing of Microarchitectural Resources 5
- CWE-144 Improper Neutralization of Line Delimiters 5
- CWE-153 Improper Neutralization of Substitution Characters 5
- CWE-156 Improper Neutralization of Whitespace 5
- CWE-166 Improper Handling of Missing Special Element 5
- CWE-167 Improper Handling of Additional Special Element 5
- CWE-194 Unexpected Sign Extension 5
- CWE-231 Improper Handling of Extra Values 5
- CWE-235 Improper Handling of Extra Parameters 5
- CWE-237 Improper Handling of Structural Elements 5
- CWE-343 Predictable Value Range from Previous Values 5
- CWE-414 Missing Lock Check 5
- CWE-435 Interaction Error 5
- CWE-437 Incomplete Model of Endpoint Features 5
- CWE-454 External Initialization of Trusted Variables or Data Stores 5
- CWE-473 PHP External Variable Modification 5
- CWE-520 .NET Misconfiguration: Use of Impersonation 5
- CWE-527 Exposure of Version-Control Repository to an Unauthorized Control Sphere 5
- CWE-534 5
- CWE-550 Server-generated Error Message Containing Sensitive Information 5
- CWE-62 UNIX Hard Link 5
- CWE-666 Operation on Resource in Wrong Phase of Lifetime 5
- CWE-675 Multiple Operations on Resource in Single-Operation Context 5
- CWE-683 Function Call With Incorrect Order of Arguments 5
- CWE-688 Function Call With Incorrect Variable or Reference as Argument 5
- CWE-792 Incomplete Filtering of One or More Instances of Special Elements 5
- CWE-794 Incomplete Filtering of Multiple Instances of Special Elements 5
- CWE-920 Improper Restriction of Power Consumption 5
- CWE-925 Intent Spoofing 5
- CWE-1059 Insufficient Technical Documentation 4
- CWE-1108 Excessive Reliance on Global Variables 4
- CWE-1124 Excessively Deep Nesting 4
- CWE-1234 Hardware Internal or Debug Modes Allow Override of Locks 4
- CWE-1247 Improper Protection Against Voltage and Clock Glitches 4
- CWE-1310 Missing Ability to Patch ROM Code 4
- CWE-1322 Use of Blocking Code in Single-threaded, Non-blocking Context 4
- CWE-1420 Exposure of Sensitive Information during Transient Execution 4
- CWE-1421 Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution 4
- CWE-1428 Reliance on HTTP instead of HTTPS 4
- CWE-168 Improper Handling of Inconsistent Special Elements 4
- CWE-182 Collapse of Data into Unsafe Value 4
- CWE-198 Use of Incorrect Byte Ordering 4
- CWE-210 Self-generated Error Message Containing Sensitive Information 4
- CWE-216 4
- CWE-336 Same Seed in Pseudo-Random Number Generator (PRNG) 4
- CWE-386 Symbolic Name not Mapping to Correct Object 4
- CWE-433 Unparsed Raw Web Content Delivery 4
- CWE-467 Use of sizeof() on a Pointer Type 4
- CWE-468 Incorrect Pointer Scaling 4
- CWE-484 Omitted Break Statement in Switch 4
- CWE-491 Public cloneable() Method Without Final 4
- CWE-624 Executable Regular Expression Error 4
- CWE-767 Access to Critical Private Variable via Public Method 4
- CWE-769 4
- CWE-1039 Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism 3
- CWE-1049 Excessive Data Query Operations in a Large Data Table 3
- CWE-1103 Use of Platform-Dependent Third Party Components 3
- CWE-1119 Excessive Use of Unconditional Branching 3
- CWE-1187 3
- CWE-12 ASP.NET Misconfiguration: Missing Custom Error Page 3
- CWE-1223 Race Condition for Write-Once Attributes 3
- CWE-1231 Improper Prevention of Lock Bit Modification 3
- CWE-1257 Improper Access Control Applied to Mirrored or Aliased Memory Regions 3
- CWE-1264 Hardware Logic with Insecure De-Synchronization between Control and Data Channels 3
- CWE-1265 Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls 3
- CWE-1269 Product Released in Non-Release Configuration 3
- CWE-1279 Cryptographic Operations are Run Before Supporting Units are Ready 3
- CWE-1280 Access Control Check Implemented After Asset is Accessed 3
- CWE-1283 Mutable Attestation or Measurement Reporting Data 3
- CWE-1298 Hardware Logic Contains Race Conditions 3
- CWE-1332 Improper Handling of Faults that Lead to Instruction Skips 3
- CWE-1342 Information Exposure through Microarchitectural State after Transient Execution 3
- CWE-142 Improper Neutralization of Value Delimiters 3
- CWE-1426 Improper Validation of Generative AI Output 3
- CWE-143 Improper Neutralization of Record Delimiters 3
- CWE-148 Improper Neutralization of Input Leaders 3
- CWE-164 Improper Neutralization of Internal Special Elements 3
- CWE-205 Observable Behavioral Discrepancy 3
- CWE-227 7PK - API Abuse 3
- CWE-239 Failure to Handle Incomplete Element 3
- CWE-28 Path Traversal: '..\filedir' 3
- CWE-309 Use of Password System for Primary Authentication 3
- CWE-344 Use of Invariant Value in Dynamically Changing Context 3
- CWE-446 UI Discrepancy for Security Feature 3
- CWE-447 Unimplemented or Unsupported Feature in UI 3
- CWE-448 Obsolete Feature in UI 3
- CWE-450 Multiple Interpretations of UI Input 3
- CWE-463 Deletion of Data Structure Sentinel 3
- CWE-557 Concurrency Issues 3
- CWE-588 Attempt to Access Child of a Non-structure Pointer 3
- CWE-597 Use of Wrong Operator in String Comparison 3
- CWE-605 Multiple Binds to the Same Port 3
- CWE-615 Inclusion of Sensitive Information in Source Code Comments 3
- CWE-623 Unsafe ActiveX Control Marked Safe For Scripting 3
- CWE-673 External Influence of Sphere Definition 3
- CWE-687 Function Call With Incorrectly Specified Argument Value 3
- CWE-689 Permission Race Condition During Resource Copy 3
- CWE-69 Improper Handling of Windows ::DATA Alternate Data Stream 3
- CWE-756 Missing Custom Error Page 3
- CWE-780 Use of RSA Algorithm without OAEP 3
- CWE-827 Improper Control of Document Type Definition 3
- CWE-1 2
- CWE-1018 Manage User Sessions 2
- CWE-1024 Comparison of Incompatible Types 2
- CWE-1027 OWASP Top Ten 2017 Category A1 - Injection 2
- CWE-1046 Creation of Immutable Text Using String Concatenation 2
- CWE-1076 Insufficient Adherence to Expected Conventions 2
- CWE-11 ASP.NET Misconfiguration: Creating Debug Binary 2
- CWE-1107 Insufficient Isolation of Symbolic Constant Definitions 2
- CWE-111 Direct Use of Unsafe JNI 2
- CWE-1112 Incomplete Documentation of Program Execution 2
- CWE-1164 Irrelevant Code 2
- CWE-1190 DMA Device Enabled Too Early in Boot Phase 2
- CWE-1221 Incorrect Register Defaults or Module Parameters 2
- CWE-1222 Insufficient Granularity of Address Regions Protected by Register Locks 2
- CWE-1246 Improper Write Handling in Limited-write Non-Volatile Memories 2
- CWE-1251 Mirrored Regions with Different Values 2
- CWE-1272 Sensitive Information Uncleared Before Debug/Power State Transition 2
- CWE-1301 Insufficient or Incomplete Data Removal within Hardware Component 2
- CWE-1304 Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation 2
- CWE-1313 Hardware Allows Activation of Test or Debug Logic at Runtime 2
- CWE-1314 Missing Write Protection for Parametric Data Values 2
- CWE-1323 Improper Management of Sensitive Trace Data 2
- CWE-1334 Unauthorized Error Injection Can Degrade Hardware Redundancy 2
- CWE-135 Incorrect Calculation of Multi-Byte String Length 2
- CWE-1422 Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution 2
- CWE-157 Failure to Sanitize Paired Delimiters 2
- CWE-186 Overly Restrictive Regular Expression 2
- CWE-234 Failure to Handle Missing Parameter 2
- CWE-236 Improper Handling of Undefined Parameters 2
- CWE-263 Password Aging with Long Expiration 2
- CWE-30 Path Traversal: '\dir\..\filename' 2
- CWE-318 Cleartext Storage of Sensitive Information in Executable 2
- CWE-32 Path Traversal: '...' (Triple Dot) 2
- CWE-339 Small Seed Space in PRNG 2
- CWE-34 Path Traversal: '....//' 2
- CWE-360 Trust of System Event Data 2
- CWE-39 Path Traversal: 'C:dirname' 2
- CWE-396 Declaration of Catch for Generic Exception 2
- CWE-42 Path Equivalence: 'filename.' (Trailing Dot) 2
- CWE-422 Unprotected Windows Messaging Channel 2
- CWE-430 Deployment of Wrong Handler 2
- CWE-431 Missing Handler 2
- CWE-455 Non-exit on Failed Initialization 2
- CWE-465 Pointer Issues 2
- CWE-479 Signal Handler Use of a Non-reentrant Function 2
- CWE-482 Comparing instead of Assigning 2
- CWE-495 Private Data Structure Returned From A Public Method 2
- CWE-499 Serializable Class Containing Sensitive Data 2
- CWE-5 J2EE Misconfiguration: Data Transmission Without Encryption 2
- CWE-50 Path Equivalence: '//multiple/leading/slash' 2
- CWE-508 Non-Replicating Malicious Code 2
- CWE-514 Covert Channel 2
- CWE-528 Exposure of Core Dump File to an Unauthorized Control Sphere 2
- CWE-531 Inclusion of Sensitive Information in Test Code 2
- CWE-535 Exposure of Information Through Shell Error Message 2
- CWE-55 Path Equivalence: '/./' (Single Dot Directory) 2
- CWE-555 J2EE Misconfiguration: Plaintext Password in Configuration File 2
- CWE-563 Assignment to Variable without Use 2
- CWE-618 Exposed Unsafe ActiveX Method 2
- CWE-621 Variable Extraction Error 2
- CWE-622 Improper Validation of Function Hook Arguments 2
- CWE-652 XQuery Injection 2
- CWE-685 Function Call With Incorrect Number of Arguments 2
- CWE-730 OWASP Top Ten 2004 Category A9 - Denial of Service 2
- CWE-761 Free of Pointer not at Start of Buffer 2
- CWE-764 Multiple Locks of a Critical Resource 2
- CWE-815 OWASP Top Ten 2010 Category A6 - Security Misconfiguration 2
- CWE-828 Signal Handler with Functionality that is not Asynchronous-Safe 2
- CWE-832 Unlock of a Resource that is not Locked 2
- CWE-85 Doubled Character XSS Manipulations 2
- CWE-882 CERT C++ Secure Coding Section 14 - Concurrency (CON) 2
- CWE-910 Use of Expired File Descriptor 2