| HasMember |
 Deprecated |
1 |
DEPRECATED: Location
|
| HasMember |
 Category - a CWE entry that contains a set of other entries that share a common characteristic. |
2 |
7PK - Environment
|
| HasMember |
Deprecated |
3 |
DEPRECATED: Technology-specific Environment Issues
|
| HasMember |
Deprecated |
4 |
DEPRECATED: J2EE Environment Issues
|
| HasMember |
 Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
5 |
J2EE Misconfiguration: Data Transmission Without Encryption
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
6 |
J2EE Misconfiguration: Insufficient Session-ID Length
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
7 |
J2EE Misconfiguration: Missing Custom Error Page
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
8 |
J2EE Misconfiguration: Entity Bean Declared Remote
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
9 |
J2EE Misconfiguration: Weak Access Permissions for EJB Methods
|
| HasMember |
Deprecated |
10 |
DEPRECATED: ASP.NET Environment Issues
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
11 |
ASP.NET Misconfiguration: Creating Debug Binary
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
12 |
ASP.NET Misconfiguration: Missing Custom Error Page
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
13 |
ASP.NET Misconfiguration: Password in Configuration File
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
14 |
Compiler Removal of Code to Clear Buffers
|
| HasMember |
 Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
15 |
External Control of System or Configuration Setting
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
16 |
Configuration
|
| HasMember |
Deprecated |
17 |
DEPRECATED: Code
|
| HasMember |
Deprecated |
18 |
DEPRECATED: Source Code
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
19 |
Data Processing Errors
|
| HasMember |
 Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
20 |
Improper Input Validation
|
| HasMember |
Deprecated |
21 |
DEPRECATED: Pathname Traversal and Equivalence Errors
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
22 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
23 |
Relative Path Traversal
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
24 |
Path Traversal: '../filedir'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
25 |
Path Traversal: '/../filedir'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
26 |
Path Traversal: '/dir/../filename'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
27 |
Path Traversal: 'dir/../../filename'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
28 |
Path Traversal: '..\filedir'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
29 |
Path Traversal: '\..\filename'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
30 |
Path Traversal: '\dir\..\filename'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
31 |
Path Traversal: 'dir\..\..\filename'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
32 |
Path Traversal: '...' (Triple Dot)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
33 |
Path Traversal: '....' (Multiple Dot)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
34 |
Path Traversal: '....//'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
35 |
Path Traversal: '.../...//'
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
36 |
Absolute Path Traversal
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
37 |
Path Traversal: '/absolute/pathname/here'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
38 |
Path Traversal: '\absolute\pathname\here'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
39 |
Path Traversal: 'C:dirname'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
40 |
Path Traversal: '\\UNC\share\name\' (Windows UNC Share)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
41 |
Improper Resolution of Path Equivalence
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
42 |
Path Equivalence: 'filename.' (Trailing Dot)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
43 |
Path Equivalence: 'filename....' (Multiple Trailing Dot)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
44 |
Path Equivalence: 'file.name' (Internal Dot)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
45 |
Path Equivalence: 'file...name' (Multiple Internal Dot)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
46 |
Path Equivalence: 'filename ' (Trailing Space)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
47 |
Path Equivalence: ' filename' (Leading Space)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
48 |
Path Equivalence: 'file name' (Internal Whitespace)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
49 |
Path Equivalence: 'filename/' (Trailing Slash)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
50 |
Path Equivalence: '//multiple/leading/slash'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
51 |
Path Equivalence: '/multiple//internal/slash'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
52 |
Path Equivalence: '/multiple/trailing/slash//'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
53 |
Path Equivalence: '\multiple\\internal\backslash'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
54 |
Path Equivalence: 'filedir\' (Trailing Backslash)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
55 |
Path Equivalence: '/./' (Single Dot Directory)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
56 |
Path Equivalence: 'filedir*' (Wildcard)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
57 |
Path Equivalence: 'fakedir/../realdir/filename'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
58 |
Path Equivalence: Windows 8.3 Filename
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
59 |
Improper Link Resolution Before File Access ('Link Following')
|
| HasMember |
Deprecated |
60 |
DEPRECATED: UNIX Path Link Problems
|
| HasMember |
 Composite - a Compound Element that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk. One weakness, X, can be "broken down" into component weaknesses Y and Z. There can be cases in which one weakness might not be essential to a composite, but changes the nature of the composite when it becomes a vulnerability. |
61 |
UNIX Symbolic Link (Symlink) Following
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
62 |
UNIX Hard Link
|
| HasMember |
Deprecated |
63 |
DEPRECATED: Windows Path Link Problems
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
64 |
Windows Shortcut Following (.LNK)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
65 |
Windows Hard Link
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
66 |
Improper Handling of File Names that Identify Virtual Resources
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
67 |
Improper Handling of Windows Device Names
|
| HasMember |
Deprecated |
68 |
DEPRECATED: Windows Virtual File Problems
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
69 |
Improper Handling of Windows ::DATA Alternate Data Stream
|
| HasMember |
Deprecated |
70 |
DEPRECATED: Mac Virtual File Problems
|
| HasMember |
Deprecated |
71 |
DEPRECATED: Apple '.DS_Store'
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
72 |
Improper Handling of Apple HFS+ Alternate Data Stream Path
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
73 |
External Control of File Name or Path
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
74 |
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
75 |
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
76 |
Improper Neutralization of Equivalent Special Elements
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
77 |
Improper Neutralization of Special Elements used in a Command ('Command Injection')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
78 |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
79 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
80 |
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
81 |
Improper Neutralization of Script in an Error Message Web Page
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
82 |
Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
83 |
Improper Neutralization of Script in Attributes in a Web Page
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
84 |
Improper Neutralization of Encoded URI Schemes in a Web Page
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
85 |
Doubled Character XSS Manipulations
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
86 |
Improper Neutralization of Invalid Characters in Identifiers in Web Pages
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
87 |
Improper Neutralization of Alternate XSS Syntax
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
88 |
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
89 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
90 |
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
91 |
XML Injection (aka Blind XPath Injection)
|
| HasMember |
Deprecated |
92 |
DEPRECATED: Improper Sanitization of Custom Special Characters
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
93 |
Improper Neutralization of CRLF Sequences ('CRLF Injection')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
94 |
Improper Control of Generation of Code ('Code Injection')
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
95 |
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
96 |
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
97 |
Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
98 |
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
99 |
Improper Control of Resource Identifiers ('Resource Injection')
|
| HasMember |
Deprecated |
100 |
DEPRECATED: Technology-Specific Input Validation Problems
|
| HasMember |
Deprecated |
101 |
DEPRECATED: Struts Validation Problems
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
102 |
Struts: Duplicate Validation Forms
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
103 |
Struts: Incomplete validate() Method Definition
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
104 |
Struts: Form Bean Does Not Extend Validation Class
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
105 |
Struts: Form Field Without Validator
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
106 |
Struts: Plug-in Framework not in Use
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
107 |
Struts: Unused Validation Form
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
108 |
Struts: Unvalidated Action Form
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
109 |
Struts: Validator Turned Off
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
110 |
Struts: Validator Without Form Field
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
111 |
Direct Use of Unsafe JNI
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
112 |
Missing XML Validation
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
113 |
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
114 |
Process Control
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
115 |
Misinterpretation of Input
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
116 |
Improper Encoding or Escaping of Output
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
117 |
Improper Output Neutralization for Logs
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
118 |
Incorrect Access of Indexable Resource ('Range Error')
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
119 |
Improper Restriction of Operations within the Bounds of a Memory Buffer
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
120 |
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
121 |
Stack-based Buffer Overflow
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
122 |
Heap-based Buffer Overflow
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
123 |
Write-what-where Condition
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
124 |
Buffer Underwrite ('Buffer Underflow')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
125 |
Out-of-bounds Read
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
126 |
Buffer Over-read
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
127 |
Buffer Under-read
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
128 |
Wrap-around Error
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
129 |
Improper Validation of Array Index
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
130 |
Improper Handling of Length Parameter Inconsistency
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
131 |
Incorrect Calculation of Buffer Size
|
| HasMember |
Deprecated |
132 |
DEPRECATED: Miscalculated Null Termination
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
133 |
String Errors
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
134 |
Use of Externally-Controlled Format String
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
135 |
Incorrect Calculation of Multi-Byte String Length
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
136 |
Type Errors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
137 |
Data Neutralization Issues
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
138 |
Improper Neutralization of Special Elements
|
| HasMember |
Deprecated |
139 |
DEPRECATED: General Special Element Problems
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
140 |
Improper Neutralization of Delimiters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
141 |
Improper Neutralization of Parameter/Argument Delimiters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
142 |
Improper Neutralization of Value Delimiters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
143 |
Improper Neutralization of Record Delimiters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
144 |
Improper Neutralization of Line Delimiters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
145 |
Improper Neutralization of Section Delimiters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
146 |
Improper Neutralization of Expression/Command Delimiters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
147 |
Improper Neutralization of Input Terminators
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
148 |
Improper Neutralization of Input Leaders
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
149 |
Improper Neutralization of Quoting Syntax
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
150 |
Improper Neutralization of Escape, Meta, or Control Sequences
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
151 |
Improper Neutralization of Comment Delimiters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
152 |
Improper Neutralization of Macro Symbols
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
153 |
Improper Neutralization of Substitution Characters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
154 |
Improper Neutralization of Variable Name Delimiters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
155 |
Improper Neutralization of Wildcards or Matching Symbols
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
156 |
Improper Neutralization of Whitespace
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
157 |
Failure to Sanitize Paired Delimiters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
158 |
Improper Neutralization of Null Byte or NUL Character
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
159 |
Improper Handling of Invalid Use of Special Elements
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
160 |
Improper Neutralization of Leading Special Elements
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
161 |
Improper Neutralization of Multiple Leading Special Elements
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
162 |
Improper Neutralization of Trailing Special Elements
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
163 |
Improper Neutralization of Multiple Trailing Special Elements
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
164 |
Improper Neutralization of Internal Special Elements
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
165 |
Improper Neutralization of Multiple Internal Special Elements
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
166 |
Improper Handling of Missing Special Element
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
167 |
Improper Handling of Additional Special Element
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
168 |
Improper Handling of Inconsistent Special Elements
|
| HasMember |
Deprecated |
169 |
DEPRECATED: Technology-Specific Special Elements
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
170 |
Improper Null Termination
|
| HasMember |
Deprecated |
171 |
DEPRECATED: Cleansing, Canonicalization, and Comparison Errors
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
172 |
Encoding Error
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
173 |
Improper Handling of Alternate Encoding
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
174 |
Double Decoding of the Same Data
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
175 |
Improper Handling of Mixed Encoding
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
176 |
Improper Handling of Unicode Encoding
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
177 |
Improper Handling of URL Encoding (Hex Encoding)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
178 |
Improper Handling of Case Sensitivity
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
179 |
Incorrect Behavior Order: Early Validation
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
180 |
Incorrect Behavior Order: Validate Before Canonicalize
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
181 |
Incorrect Behavior Order: Validate Before Filter
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
182 |
Collapse of Data into Unsafe Value
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
183 |
Permissive List of Allowed Inputs
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
184 |
Incomplete List of Disallowed Inputs
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
185 |
Incorrect Regular Expression
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
186 |
Overly Restrictive Regular Expression
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
187 |
Partial String Comparison
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
188 |
Reliance on Data/Memory Layout
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
189 |
Numeric Errors
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
190 |
Integer Overflow or Wraparound
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
191 |
Integer Underflow (Wrap or Wraparound)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
192 |
Integer Coercion Error
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
193 |
Off-by-one Error
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
194 |
Unexpected Sign Extension
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
195 |
Signed to Unsigned Conversion Error
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
196 |
Unsigned to Signed Conversion Error
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
197 |
Numeric Truncation Error
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
198 |
Use of Incorrect Byte Ordering
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
199 |
Information Management Errors
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
200 |
Exposure of Sensitive Information to an Unauthorized Actor
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
201 |
Insertion of Sensitive Information Into Sent Data
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
202 |
Exposure of Sensitive Information Through Data Queries
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
203 |
Observable Discrepancy
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
204 |
Observable Response Discrepancy
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
205 |
Observable Behavioral Discrepancy
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
206 |
Observable Internal Behavioral Discrepancy
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
207 |
Observable Behavioral Discrepancy With Equivalent Products
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
208 |
Observable Timing Discrepancy
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
209 |
Generation of Error Message Containing Sensitive Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
210 |
Self-generated Error Message Containing Sensitive Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
211 |
Externally-Generated Error Message Containing Sensitive Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
212 |
Improper Removal of Sensitive Information Before Storage or Transfer
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
213 |
Exposure of Sensitive Information Due to Incompatible Policies
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
214 |
Invocation of Process Using Visible Sensitive Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
215 |
Insertion of Sensitive Information Into Debugging Code
|
| HasMember |
Deprecated |
216 |
DEPRECATED: Containment Errors (Container Errors)
|
| HasMember |
Deprecated |
217 |
DEPRECATED: Failure to Protect Stored Data from Modification
|
| HasMember |
Deprecated |
218 |
DEPRECATED: Failure to provide confidentiality for stored data
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
219 |
Storage of File with Sensitive Data Under Web Root
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
220 |
Storage of File With Sensitive Data Under FTP Root
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
221 |
Information Loss or Omission
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
222 |
Truncation of Security-relevant Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
223 |
Omission of Security-relevant Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
224 |
Obscured Security-relevant Information by Alternate Name
|
| HasMember |
Deprecated |
225 |
DEPRECATED: General Information Management Problems
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
226 |
Sensitive Information in Resource Not Removed Before Reuse
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
227 |
7PK - API Abuse
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
228 |
Improper Handling of Syntactically Invalid Structure
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
229 |
Improper Handling of Values
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
230 |
Improper Handling of Missing Values
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
231 |
Improper Handling of Extra Values
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
232 |
Improper Handling of Undefined Values
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
233 |
Improper Handling of Parameters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
234 |
Failure to Handle Missing Parameter
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
235 |
Improper Handling of Extra Parameters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
236 |
Improper Handling of Undefined Parameters
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
237 |
Improper Handling of Structural Elements
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
238 |
Improper Handling of Incomplete Structural Elements
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
239 |
Failure to Handle Incomplete Element
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
240 |
Improper Handling of Inconsistent Structural Elements
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
241 |
Improper Handling of Unexpected Data Type
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
242 |
Use of Inherently Dangerous Function
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
243 |
Creation of chroot Jail Without Changing Working Directory
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
244 |
Improper Clearing of Heap Memory Before Release ('Heap Inspection')
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
245 |
J2EE Bad Practices: Direct Management of Connections
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
246 |
J2EE Bad Practices: Direct Use of Sockets
|
| HasMember |
Deprecated |
247 |
DEPRECATED: Reliance on DNS Lookups in a Security Decision
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
248 |
Uncaught Exception
|
| HasMember |
Deprecated |
249 |
DEPRECATED: Often Misused: Path Manipulation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
250 |
Execution with Unnecessary Privileges
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
251 |
Often Misused: String Management
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
252 |
Unchecked Return Value
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
253 |
Incorrect Check of Function Return Value
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
254 |
7PK - Security Features
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
255 |
Credentials Management Errors
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
256 |
Plaintext Storage of a Password
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
257 |
Storing Passwords in a Recoverable Format
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
258 |
Empty Password in Configuration File
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
259 |
Use of Hard-coded Password
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
260 |
Password in Configuration File
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
261 |
Weak Encoding for Password
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
262 |
Not Using Password Aging
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
263 |
Password Aging with Long Expiration
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
264 |
Permissions, Privileges, and Access Controls
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
265 |
Privilege Issues
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
266 |
Incorrect Privilege Assignment
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
267 |
Privilege Defined With Unsafe Actions
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
268 |
Privilege Chaining
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
269 |
Improper Privilege Management
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
270 |
Privilege Context Switching Error
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
271 |
Privilege Dropping / Lowering Errors
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
272 |
Least Privilege Violation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
273 |
Improper Check for Dropped Privileges
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
274 |
Improper Handling of Insufficient Privileges
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
275 |
Permission Issues
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
276 |
Incorrect Default Permissions
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
277 |
Insecure Inherited Permissions
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
278 |
Insecure Preserved Inherited Permissions
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
279 |
Incorrect Execution-Assigned Permissions
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
280 |
Improper Handling of Insufficient Permissions or Privileges
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
281 |
Improper Preservation of Permissions
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
282 |
Improper Ownership Management
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
283 |
Unverified Ownership
|
| HasMember |
 Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. |
284 |
Improper Access Control
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
285 |
Improper Authorization
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
286 |
Incorrect User Management
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
287 |
Improper Authentication
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
288 |
Authentication Bypass Using an Alternate Path or Channel
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
289 |
Authentication Bypass by Alternate Name
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
290 |
Authentication Bypass by Spoofing
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
291 |
Reliance on IP Address for Authentication
|
| HasMember |
Deprecated |
292 |
DEPRECATED: Trusting Self-reported DNS Name
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
293 |
Using Referer Field for Authentication
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
294 |
Authentication Bypass by Capture-replay
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
295 |
Improper Certificate Validation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
296 |
Improper Following of a Certificate's Chain of Trust
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
297 |
Improper Validation of Certificate with Host Mismatch
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
298 |
Improper Validation of Certificate Expiration
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
299 |
Improper Check for Certificate Revocation
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
300 |
Channel Accessible by Non-Endpoint
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
301 |
Reflection Attack in an Authentication Protocol
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
302 |
Authentication Bypass by Assumed-Immutable Data
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
303 |
Incorrect Implementation of Authentication Algorithm
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
304 |
Missing Critical Step in Authentication
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
305 |
Authentication Bypass by Primary Weakness
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
306 |
Missing Authentication for Critical Function
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
307 |
Improper Restriction of Excessive Authentication Attempts
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
308 |
Use of Single-factor Authentication
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
309 |
Use of Password System for Primary Authentication
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
310 |
Cryptographic Issues
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
311 |
Missing Encryption of Sensitive Data
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
312 |
Cleartext Storage of Sensitive Information
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
313 |
Cleartext Storage in a File or on Disk
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
314 |
Cleartext Storage in the Registry
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
315 |
Cleartext Storage of Sensitive Information in a Cookie
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
316 |
Cleartext Storage of Sensitive Information in Memory
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
317 |
Cleartext Storage of Sensitive Information in GUI
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
318 |
Cleartext Storage of Sensitive Information in Executable
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
319 |
Cleartext Transmission of Sensitive Information
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
320 |
Key Management Errors
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
321 |
Use of Hard-coded Cryptographic Key
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
322 |
Key Exchange without Entity Authentication
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
323 |
Reusing a Nonce, Key Pair in Encryption
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
324 |
Use of a Key Past its Expiration Date
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
325 |
Missing Cryptographic Step
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
326 |
Inadequate Encryption Strength
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
327 |
Use of a Broken or Risky Cryptographic Algorithm
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
328 |
Use of Weak Hash
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
329 |
Generation of Predictable IV with CBC Mode
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
330 |
Use of Insufficiently Random Values
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
331 |
Insufficient Entropy
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
332 |
Insufficient Entropy in PRNG
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
333 |
Improper Handling of Insufficient Entropy in TRNG
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
334 |
Small Space of Random Values
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
335 |
Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
336 |
Same Seed in Pseudo-Random Number Generator (PRNG)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
337 |
Predictable Seed in Pseudo-Random Number Generator (PRNG)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
338 |
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
339 |
Small Seed Space in PRNG
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
340 |
Generation of Predictable Numbers or Identifiers
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
341 |
Predictable from Observable State
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
342 |
Predictable Exact Value from Previous Values
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
343 |
Predictable Value Range from Previous Values
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
344 |
Use of Invariant Value in Dynamically Changing Context
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
345 |
Insufficient Verification of Data Authenticity
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
346 |
Origin Validation Error
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
347 |
Improper Verification of Cryptographic Signature
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
348 |
Use of Less Trusted Source
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
349 |
Acceptance of Extraneous Untrusted Data With Trusted Data
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
350 |
Reliance on Reverse DNS Resolution for a Security-Critical Action
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
351 |
Insufficient Type Distinction
|
| HasMember |
Composite - a Compound Element that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk. One weakness, X, can be "broken down" into component weaknesses Y and Z. There can be cases in which one weakness might not be essential to a composite, but changes the nature of the composite when it becomes a vulnerability. |
352 |
Cross-Site Request Forgery (CSRF)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
353 |
Missing Support for Integrity Check
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
354 |
Improper Validation of Integrity Check Value
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
355 |
User Interface Security Issues
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
356 |
Product UI does not Warn User of Unsafe Actions
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
357 |
Insufficient UI Warning of Dangerous Operations
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
358 |
Improperly Implemented Security Check for Standard
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
359 |
Exposure of Private Personal Information to an Unauthorized Actor
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
360 |
Trust of System Event Data
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
361 |
7PK - Time and State
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
362 |
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
363 |
Race Condition Enabling Link Following
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
364 |
Signal Handler Race Condition
|
| HasMember |
Deprecated |
365 |
DEPRECATED: Race Condition in Switch
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
366 |
Race Condition within a Thread
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
367 |
Time-of-check Time-of-use (TOCTOU) Race Condition
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
368 |
Context Switching Race Condition
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
369 |
Divide By Zero
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
370 |
Missing Check for Certificate Revocation after Initial Check
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
371 |
State Issues
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
372 |
Incomplete Internal State Distinction
|
| HasMember |
Deprecated |
373 |
DEPRECATED: State Synchronization Error
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
374 |
Passing Mutable Objects to an Untrusted Method
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
375 |
Returning a Mutable Object to an Untrusted Caller
|
| HasMember |
Deprecated |
376 |
DEPRECATED: Temporary File Issues
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
377 |
Insecure Temporary File
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
378 |
Creation of Temporary File With Insecure Permissions
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
379 |
Creation of Temporary File in Directory with Insecure Permissions
|
| HasMember |
Deprecated |
380 |
DEPRECATED: Technology-Specific Time and State Issues
|
| HasMember |
Deprecated |
381 |
DEPRECATED: J2EE Time and State Issues
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
382 |
J2EE Bad Practices: Use of System.exit()
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
383 |
J2EE Bad Practices: Direct Use of Threads
|
| HasMember |
Composite - a Compound Element that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk. One weakness, X, can be "broken down" into component weaknesses Y and Z. There can be cases in which one weakness might not be essential to a composite, but changes the nature of the composite when it becomes a vulnerability. |
384 |
Session Fixation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
385 |
Covert Timing Channel
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
386 |
Symbolic Name not Mapping to Correct Object
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
387 |
Signal Errors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
388 |
7PK - Errors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
389 |
Error Conditions, Return Values, Status Codes
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
390 |
Detection of Error Condition Without Action
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
391 |
Unchecked Error Condition
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
392 |
Missing Report of Error Condition
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
393 |
Return of Wrong Status Code
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
394 |
Unexpected Status Code or Return Value
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
395 |
Use of NullPointerException Catch to Detect NULL Pointer Dereference
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
396 |
Declaration of Catch for Generic Exception
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
397 |
Declaration of Throws for Generic Exception
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
398 |
7PK - Code Quality
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
399 |
Resource Management Errors
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
400 |
Uncontrolled Resource Consumption
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
401 |
Missing Release of Memory after Effective Lifetime
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
402 |
Transmission of Private Resources into a New Sphere ('Resource Leak')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
403 |
Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
404 |
Improper Resource Shutdown or Release
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
405 |
Asymmetric Resource Consumption (Amplification)
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
406 |
Insufficient Control of Network Message Volume (Network Amplification)
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
407 |
Inefficient Algorithmic Complexity
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
408 |
Incorrect Behavior Order: Early Amplification
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
409 |
Improper Handling of Highly Compressed Data (Data Amplification)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
410 |
Insufficient Resource Pool
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
411 |
Resource Locking Problems
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
412 |
Unrestricted Externally Accessible Lock
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
413 |
Improper Resource Locking
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
414 |
Missing Lock Check
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
415 |
Double Free
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
416 |
Use After Free
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
417 |
Communication Channel Errors
|
| HasMember |
Deprecated |
418 |
DEPRECATED: Channel Errors
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
419 |
Unprotected Primary Channel
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
420 |
Unprotected Alternate Channel
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
421 |
Race Condition During Access to Alternate Channel
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
422 |
Unprotected Windows Messaging Channel ('Shatter')
|
| HasMember |
Deprecated |
423 |
DEPRECATED: Proxied Trusted Channel
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
424 |
Improper Protection of Alternate Path
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
425 |
Direct Request ('Forced Browsing')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
426 |
Untrusted Search Path
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
427 |
Uncontrolled Search Path Element
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
428 |
Unquoted Search Path or Element
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
429 |
Handler Errors
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
430 |
Deployment of Wrong Handler
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
431 |
Missing Handler
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
432 |
Dangerous Signal Handler not Disabled During Sensitive Operations
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
433 |
Unparsed Raw Web Content Delivery
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
434 |
Unrestricted Upload of File with Dangerous Type
|
| HasMember |
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. |
435 |
Improper Interaction Between Multiple Correctly-Behaving Entities
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
436 |
Interpretation Conflict
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
437 |
Incomplete Model of Endpoint Features
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
438 |
Behavioral Problems
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
439 |
Behavioral Change in New Version or Environment
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
440 |
Expected Behavior Violation
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
441 |
Unintended Proxy or Intermediary ('Confused Deputy')
|
| HasMember |
Deprecated |
442 |
DEPRECATED: Web Problems
|
| HasMember |
Deprecated |
443 |
DEPRECATED: HTTP response splitting
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
444 |
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
|
| HasMember |
Deprecated |
445 |
DEPRECATED: User Interface Errors
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
446 |
UI Discrepancy for Security Feature
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
447 |
Unimplemented or Unsupported Feature in UI
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
448 |
Obsolete Feature in UI
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
449 |
The UI Performs the Wrong Action
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
450 |
Multiple Interpretations of UI Input
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
451 |
User Interface (UI) Misrepresentation of Critical Information
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
452 |
Initialization and Cleanup Errors
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
453 |
Insecure Default Variable Initialization
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
454 |
External Initialization of Trusted Variables or Data Stores
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
455 |
Non-exit on Failed Initialization
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
456 |
Missing Initialization of a Variable
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
457 |
Use of Uninitialized Variable
|
| HasMember |
Deprecated |
458 |
DEPRECATED: Incorrect Initialization
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
459 |
Incomplete Cleanup
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
460 |
Improper Cleanup on Thrown Exception
|
| HasMember |
Deprecated |
461 |
DEPRECATED: Data Structure Issues
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
462 |
Duplicate Key in Associative List (Alist)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
463 |
Deletion of Data Structure Sentinel
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
464 |
Addition of Data Structure Sentinel
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
465 |
Pointer Issues
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
466 |
Return of Pointer Value Outside of Expected Range
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
467 |
Use of sizeof() on a Pointer Type
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
468 |
Incorrect Pointer Scaling
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
469 |
Use of Pointer Subtraction to Determine Size
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
470 |
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
471 |
Modification of Assumed-Immutable Data (MAID)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
472 |
External Control of Assumed-Immutable Web Parameter
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
473 |
PHP External Variable Modification
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
474 |
Use of Function with Inconsistent Implementations
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
475 |
Undefined Behavior for Input to API
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
476 |
NULL Pointer Dereference
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
477 |
Use of Obsolete Function
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
478 |
Missing Default Case in Multiple Condition Expression
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
479 |
Signal Handler Use of a Non-reentrant Function
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
480 |
Use of Incorrect Operator
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
481 |
Assigning instead of Comparing
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
482 |
Comparing instead of Assigning
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
483 |
Incorrect Block Delimitation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
484 |
Omitted Break Statement in Switch
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
485 |
7PK - Encapsulation
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
486 |
Comparison of Classes by Name
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
487 |
Reliance on Package-level Scope
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
488 |
Exposure of Data Element to Wrong Session
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
489 |
Active Debug Code
|
| HasMember |
Deprecated |
490 |
DEPRECATED: Mobile Code Issues
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
491 |
Public cloneable() Method Without Final ('Object Hijack')
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
492 |
Use of Inner Class Containing Sensitive Data
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
493 |
Critical Public Variable Without Final Modifier
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
494 |
Download of Code Without Integrity Check
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
495 |
Private Data Structure Returned From A Public Method
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
496 |
Public Data Assigned to Private Array-Typed Field
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
497 |
Exposure of Sensitive System Information to an Unauthorized Control Sphere
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
498 |
Cloneable Class Containing Sensitive Information
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
499 |
Serializable Class Containing Sensitive Data
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
500 |
Public Static Field Not Marked Final
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
501 |
Trust Boundary Violation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
502 |
Deserialization of Untrusted Data
|
| HasMember |
Deprecated |
503 |
DEPRECATED: Byte/Object Code
|
| HasMember |
Deprecated |
504 |
DEPRECATED: Motivation/Intent
|
| HasMember |
Deprecated |
505 |
DEPRECATED: Intentionally Introduced Weakness
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
506 |
Embedded Malicious Code
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
507 |
Trojan Horse
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
508 |
Non-Replicating Malicious Code
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
509 |
Replicating Malicious Code (Virus or Worm)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
510 |
Trapdoor
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
511 |
Logic/Time Bomb
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
512 |
Spyware
|
| HasMember |
Deprecated |
513 |
DEPRECATED: Intentionally Introduced Nonmalicious Weakness
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
514 |
Covert Channel
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
515 |
Covert Storage Channel
|
| HasMember |
Deprecated |
516 |
DEPRECATED: Covert Timing Channel
|
| HasMember |
Deprecated |
517 |
DEPRECATED: Other Intentional, Nonmalicious Weakness
|
| HasMember |
Deprecated |
518 |
DEPRECATED: Inadvertently Introduced Weakness
|
| HasMember |
Deprecated |
519 |
DEPRECATED: .NET Environment Issues
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
520 |
.NET Misconfiguration: Use of Impersonation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
521 |
Weak Password Requirements
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
522 |
Insufficiently Protected Credentials
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
523 |
Unprotected Transport of Credentials
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
524 |
Use of Cache Containing Sensitive Information
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
525 |
Use of Web Browser Cache Containing Sensitive Information
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
526 |
Cleartext Storage of Sensitive Information in an Environment Variable
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
527 |
Exposure of Version-Control Repository to an Unauthorized Control Sphere
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
528 |
Exposure of Core Dump File to an Unauthorized Control Sphere
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
529 |
Exposure of Access Control List Files to an Unauthorized Control Sphere
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
530 |
Exposure of Backup File to an Unauthorized Control Sphere
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
531 |
Inclusion of Sensitive Information in Test Code
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
532 |
Insertion of Sensitive Information into Log File
|
| HasMember |
Deprecated |
533 |
DEPRECATED: Information Exposure Through Server Log Files
|
| HasMember |
Deprecated |
534 |
DEPRECATED: Information Exposure Through Debug Log Files
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
535 |
Exposure of Information Through Shell Error Message
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
536 |
Servlet Runtime Error Message Containing Sensitive Information
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
537 |
Java Runtime Error Message Containing Sensitive Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
538 |
Insertion of Sensitive Information into Externally-Accessible File or Directory
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
539 |
Use of Persistent Cookies Containing Sensitive Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
540 |
Inclusion of Sensitive Information in Source Code
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
541 |
Inclusion of Sensitive Information in an Include File
|
| HasMember |
Deprecated |
542 |
DEPRECATED: Information Exposure Through Cleanup Log Files
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
543 |
Use of Singleton Pattern Without Synchronization in a Multithreaded Context
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
544 |
Missing Standardized Error Handling Mechanism
|
| HasMember |
Deprecated |
545 |
DEPRECATED: Use of Dynamic Class Loading
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
546 |
Suspicious Comment
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
547 |
Use of Hard-coded, Security-relevant Constants
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
548 |
Exposure of Information Through Directory Listing
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
549 |
Missing Password Field Masking
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
550 |
Server-generated Error Message Containing Sensitive Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
551 |
Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
552 |
Files or Directories Accessible to External Parties
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
553 |
Command Shell in Externally Accessible Directory
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
554 |
ASP.NET Misconfiguration: Not Using Input Validation Framework
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
555 |
J2EE Misconfiguration: Plaintext Password in Configuration File
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
556 |
ASP.NET Misconfiguration: Use of Identity Impersonation
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
557 |
Concurrency Issues
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
558 |
Use of getlogin() in Multithreaded Application
|
| HasMember |
Deprecated |
559 |
DEPRECATED: Often Misused: Arguments and Parameters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
560 |
Use of umask() with chmod-style Argument
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
561 |
Dead Code
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
562 |
Return of Stack Variable Address
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
563 |
Assignment to Variable without Use
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
564 |
SQL Injection: Hibernate
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
565 |
Reliance on Cookies without Validation and Integrity Checking
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
566 |
Authorization Bypass Through User-Controlled SQL Primary Key
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
567 |
Unsynchronized Access to Shared Data in a Multithreaded Context
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
568 |
finalize() Method Without super.finalize()
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
569 |
Expression Issues
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
570 |
Expression is Always False
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
571 |
Expression is Always True
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
572 |
Call to Thread run() instead of start()
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
573 |
Improper Following of Specification by Caller
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
574 |
EJB Bad Practices: Use of Synchronization Primitives
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
575 |
EJB Bad Practices: Use of AWT Swing
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
576 |
EJB Bad Practices: Use of Java I/O
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
577 |
EJB Bad Practices: Use of Sockets
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
578 |
EJB Bad Practices: Use of Class Loader
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
579 |
J2EE Bad Practices: Non-serializable Object Stored in Session
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
580 |
clone() Method Without super.clone()
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
581 |
Object Model Violation: Just One of Equals and Hashcode Defined
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
582 |
Array Declared Public, Final, and Static
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
583 |
finalize() Method Declared Public
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
584 |
Return Inside Finally Block
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
585 |
Empty Synchronized Block
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
586 |
Explicit Call to Finalize()
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
587 |
Assignment of a Fixed Address to a Pointer
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
588 |
Attempt to Access Child of a Non-structure Pointer
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
589 |
Call to Non-ubiquitous API
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
590 |
Free of Memory not on the Heap
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
591 |
Sensitive Data Storage in Improperly Locked Memory
|
| HasMember |
Deprecated |
592 |
DEPRECATED: Authentication Bypass Issues
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
593 |
Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
594 |
J2EE Framework: Saving Unserializable Objects to Disk
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
595 |
Comparison of Object References Instead of Object Contents
|
| HasMember |
Deprecated |
596 |
DEPRECATED: Incorrect Semantic Object Comparison
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
597 |
Use of Wrong Operator in String Comparison
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
598 |
Use of GET Request Method With Sensitive Query Strings
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
599 |
Missing Validation of OpenSSL Certificate
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
600 |
Uncaught Exception in Servlet
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
601 |
URL Redirection to Untrusted Site ('Open Redirect')
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
602 |
Client-Side Enforcement of Server-Side Security
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
603 |
Use of Client-Side Authentication
|
| HasMember |
 View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
604 |
Deprecated Entries
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
605 |
Multiple Binds to the Same Port
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
606 |
Unchecked Input for Loop Condition
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
607 |
Public Static Final Field References Mutable Object
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
608 |
Struts: Non-private Field in ActionForm Class
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
609 |
Double-Checked Locking
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
610 |
Externally Controlled Reference to a Resource in Another Sphere
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
611 |
Improper Restriction of XML External Entity Reference
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
612 |
Improper Authorization of Index Containing Sensitive Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
613 |
Insufficient Session Expiration
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
614 |
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
615 |
Inclusion of Sensitive Information in Source Code Comments
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
616 |
Incomplete Identification of Uploaded File Variables (PHP)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
617 |
Reachable Assertion
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
618 |
Exposed Unsafe ActiveX Method
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
619 |
Dangling Database Cursor ('Cursor Injection')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
620 |
Unverified Password Change
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
621 |
Variable Extraction Error
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
622 |
Improper Validation of Function Hook Arguments
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
623 |
Unsafe ActiveX Control Marked Safe For Scripting
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
624 |
Executable Regular Expression Error
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
625 |
Permissive Regular Expression
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
626 |
Null Byte Interaction Error (Poison Null Byte)
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
627 |
Dynamic Variable Evaluation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
628 |
Function Call with Incorrectly Specified Arguments
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
629 |
Weaknesses in OWASP Top Ten (2007)
|
| HasMember |
Deprecated |
630 |
DEPRECATED: Weaknesses Examined by SAMATE
|
| HasMember |
Deprecated |
631 |
DEPRECATED: Resource-specific Weaknesses
|
| HasMember |
Deprecated |
632 |
DEPRECATED: Weaknesses that Affect Files or Directories
|
| HasMember |
Deprecated |
633 |
DEPRECATED: Weaknesses that Affect Memory
|
| HasMember |
Deprecated |
634 |
DEPRECATED: Weaknesses that Affect System Processes
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
635 |
Weaknesses Originally Used by NVD from 2008 to 2016
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
636 |
Not Failing Securely ('Failing Open')
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
637 |
Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
638 |
Not Using Complete Mediation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
639 |
Authorization Bypass Through User-Controlled Key
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
640 |
Weak Password Recovery Mechanism for Forgotten Password
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
641 |
Improper Restriction of Names for Files and Other Resources
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
642 |
External Control of Critical State Data
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
643 |
Improper Neutralization of Data within XPath Expressions ('XPath Injection')
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
644 |
Improper Neutralization of HTTP Headers for Scripting Syntax
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
645 |
Overly Restrictive Account Lockout Mechanism
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
646 |
Reliance on File Name or Extension of Externally-Supplied File
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
647 |
Use of Non-Canonical URL Paths for Authorization Decisions
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
648 |
Incorrect Use of Privileged APIs
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
649 |
Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
650 |
Trusting HTTP Permission Methods on the Server Side
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
651 |
Exposure of WSDL File Containing Sensitive Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
652 |
Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
653 |
Improper Isolation or Compartmentalization
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
654 |
Reliance on a Single Factor in a Security Decision
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
655 |
Insufficient Psychological Acceptability
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
656 |
Reliance on Security Through Obscurity
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
657 |
Violation of Secure Design Principles
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
658 |
Weaknesses in Software Written in C
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
659 |
Weaknesses in Software Written in C++
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
660 |
Weaknesses in Software Written in Java
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
661 |
Weaknesses in Software Written in PHP
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
662 |
Improper Synchronization
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
663 |
Use of a Non-reentrant Function in a Concurrent Context
|
| HasMember |
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. |
664 |
Improper Control of a Resource Through its Lifetime
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
665 |
Improper Initialization
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
666 |
Operation on Resource in Wrong Phase of Lifetime
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
667 |
Improper Locking
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
668 |
Exposure of Resource to Wrong Sphere
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
669 |
Incorrect Resource Transfer Between Spheres
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
670 |
Always-Incorrect Control Flow Implementation
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
671 |
Lack of Administrator Control over Security
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
672 |
Operation on a Resource after Expiration or Release
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
673 |
External Influence of Sphere Definition
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
674 |
Uncontrolled Recursion
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
675 |
Multiple Operations on Resource in Single-Operation Context
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
676 |
Use of Potentially Dangerous Function
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
677 |
Weakness Base Elements
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
678 |
Composites
|
| HasMember |
Deprecated |
679 |
DEPRECATED: Chain Elements
|
| HasMember |
 Chain - a Compound Element that is a sequence of two or more separate weaknesses that can be closely linked together within software. One weakness, X, can directly create the conditions that are necessary to cause another weakness, Y, to enter a vulnerable condition. When this happens, CWE refers to X as "primary" to Y, and Y is "resultant" from X. Chains can involve more than two weaknesses, and in some cases, they might have a tree-like structure. |
680 |
Integer Overflow to Buffer Overflow
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
681 |
Incorrect Conversion between Numeric Types
|
| HasMember |
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. |
682 |
Incorrect Calculation
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
683 |
Function Call With Incorrect Order of Arguments
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
684 |
Incorrect Provision of Specified Functionality
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
685 |
Function Call With Incorrect Number of Arguments
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
686 |
Function Call With Incorrect Argument Type
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
687 |
Function Call With Incorrectly Specified Argument Value
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
688 |
Function Call With Incorrect Variable or Reference as Argument
|
| HasMember |
Composite - a Compound Element that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk. One weakness, X, can be "broken down" into component weaknesses Y and Z. There can be cases in which one weakness might not be essential to a composite, but changes the nature of the composite when it becomes a vulnerability. |
689 |
Permission Race Condition During Resource Copy
|
| HasMember |
Chain - a Compound Element that is a sequence of two or more separate weaknesses that can be closely linked together within software. One weakness, X, can directly create the conditions that are necessary to cause another weakness, Y, to enter a vulnerable condition. When this happens, CWE refers to X as "primary" to Y, and Y is "resultant" from X. Chains can involve more than two weaknesses, and in some cases, they might have a tree-like structure. |
690 |
Unchecked Return Value to NULL Pointer Dereference
|
| HasMember |
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. |
691 |
Insufficient Control Flow Management
|
| HasMember |
Chain - a Compound Element that is a sequence of two or more separate weaknesses that can be closely linked together within software. One weakness, X, can directly create the conditions that are necessary to cause another weakness, Y, to enter a vulnerable condition. When this happens, CWE refers to X as "primary" to Y, and Y is "resultant" from X. Chains can involve more than two weaknesses, and in some cases, they might have a tree-like structure. |
692 |
Incomplete Denylist to Cross-Site Scripting
|
| HasMember |
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. |
693 |
Protection Mechanism Failure
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
694 |
Use of Multiple Resources with Duplicate Identifier
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
695 |
Use of Low-Level Functionality
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
696 |
Incorrect Behavior Order
|
| HasMember |
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. |
697 |
Incorrect Comparison
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
698 |
Execution After Redirect (EAR)
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
699 |
Software Development
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
700 |
Seven Pernicious Kingdoms
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
701 |
Weaknesses Introduced During Design
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
702 |
Weaknesses Introduced During Implementation
|
| HasMember |
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. |
703 |
Improper Check or Handling of Exceptional Conditions
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
704 |
Incorrect Type Conversion or Cast
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
705 |
Incorrect Control Flow Scoping
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
706 |
Use of Incorrectly-Resolved Name or Reference
|
| HasMember |
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. |
707 |
Improper Neutralization
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
708 |
Incorrect Ownership Assignment
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
709 |
Named Chains
|
| HasMember |
Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. |
710 |
Improper Adherence to Coding Standards
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
711 |
Weaknesses in OWASP Top Ten (2004)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
712 |
OWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
713 |
OWASP Top Ten 2007 Category A2 - Injection Flaws
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
714 |
OWASP Top Ten 2007 Category A3 - Malicious File Execution
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
715 |
OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
716 |
OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
717 |
OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
718 |
OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
719 |
OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
720 |
OWASP Top Ten 2007 Category A9 - Insecure Communications
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
721 |
OWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
722 |
OWASP Top Ten 2004 Category A1 - Unvalidated Input
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
723 |
OWASP Top Ten 2004 Category A2 - Broken Access Control
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
724 |
OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
725 |
OWASP Top Ten 2004 Category A4 - Cross-Site Scripting (XSS) Flaws
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
726 |
OWASP Top Ten 2004 Category A5 - Buffer Overflows
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
727 |
OWASP Top Ten 2004 Category A6 - Injection Flaws
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
728 |
OWASP Top Ten 2004 Category A7 - Improper Error Handling
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
729 |
OWASP Top Ten 2004 Category A8 - Insecure Storage
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
730 |
OWASP Top Ten 2004 Category A9 - Denial of Service
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
731 |
OWASP Top Ten 2004 Category A10 - Insecure Configuration Management
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
732 |
Incorrect Permission Assignment for Critical Resource
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
733 |
Compiler Optimization Removal or Modification of Security-critical Code
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
734 |
Weaknesses Addressed by the CERT C Secure Coding Standard (2008)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
735 |
CERT C Secure Coding Standard (2008) Chapter 2 - Preprocessor (PRE)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
736 |
CERT C Secure Coding Standard (2008) Chapter 3 - Declarations and Initialization (DCL)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
737 |
CERT C Secure Coding Standard (2008) Chapter 4 - Expressions (EXP)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
738 |
CERT C Secure Coding Standard (2008) Chapter 5 - Integers (INT)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
739 |
CERT C Secure Coding Standard (2008) Chapter 6 - Floating Point (FLP)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
740 |
CERT C Secure Coding Standard (2008) Chapter 7 - Arrays (ARR)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
741 |
CERT C Secure Coding Standard (2008) Chapter 8 - Characters and Strings (STR)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
742 |
CERT C Secure Coding Standard (2008) Chapter 9 - Memory Management (MEM)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
743 |
CERT C Secure Coding Standard (2008) Chapter 10 - Input Output (FIO)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
744 |
CERT C Secure Coding Standard (2008) Chapter 11 - Environment (ENV)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
745 |
CERT C Secure Coding Standard (2008) Chapter 12 - Signals (SIG)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
746 |
CERT C Secure Coding Standard (2008) Chapter 13 - Error Handling (ERR)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
747 |
CERT C Secure Coding Standard (2008) Chapter 14 - Miscellaneous (MSC)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
748 |
CERT C Secure Coding Standard (2008) Appendix - POSIX (POS)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
749 |
Exposed Dangerous Method or Function
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
750 |
Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
751 |
2009 Top 25 - Insecure Interaction Between Components
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
752 |
2009 Top 25 - Risky Resource Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
753 |
2009 Top 25 - Porous Defenses
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
754 |
Improper Check for Unusual or Exceptional Conditions
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
755 |
Improper Handling of Exceptional Conditions
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
756 |
Missing Custom Error Page
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
757 |
Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
758 |
Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
759 |
Use of a One-Way Hash without a Salt
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
760 |
Use of a One-Way Hash with a Predictable Salt
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
761 |
Free of Pointer not at Start of Buffer
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
762 |
Mismatched Memory Management Routines
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
763 |
Release of Invalid Pointer or Reference
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
764 |
Multiple Locks of a Critical Resource
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
765 |
Multiple Unlocks of a Critical Resource
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
766 |
Critical Data Element Declared Public
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
767 |
Access to Critical Private Variable via Public Method
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
768 |
Incorrect Short Circuit Evaluation
|
| HasMember |
Deprecated |
769 |
DEPRECATED: Uncontrolled File Descriptor Consumption
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
770 |
Allocation of Resources Without Limits or Throttling
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
771 |
Missing Reference to Active Allocated Resource
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
772 |
Missing Release of Resource after Effective Lifetime
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
773 |
Missing Reference to Active File Descriptor or Handle
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
774 |
Allocation of File Descriptors or Handles Without Limits or Throttling
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
775 |
Missing Release of File Descriptor or Handle after Effective Lifetime
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
776 |
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
777 |
Regular Expression without Anchors
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
778 |
Insufficient Logging
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
779 |
Logging of Excessive Data
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
780 |
Use of RSA Algorithm without OAEP
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
781 |
Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
782 |
Exposed IOCTL with Insufficient Access Control
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
783 |
Operator Precedence Logic Error
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
784 |
Reliance on Cookies without Validation and Integrity Checking in a Security Decision
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
785 |
Use of Path Manipulation Function without Maximum-sized Buffer
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
786 |
Access of Memory Location Before Start of Buffer
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
787 |
Out-of-bounds Write
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
788 |
Access of Memory Location After End of Buffer
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
789 |
Memory Allocation with Excessive Size Value
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
790 |
Improper Filtering of Special Elements
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
791 |
Incomplete Filtering of Special Elements
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
792 |
Incomplete Filtering of One or More Instances of Special Elements
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
793 |
Only Filtering One Instance of a Special Element
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
794 |
Incomplete Filtering of Multiple Instances of Special Elements
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
795 |
Only Filtering Special Elements at a Specified Location
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
796 |
Only Filtering Special Elements Relative to a Marker
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
797 |
Only Filtering Special Elements at an Absolute Position
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
798 |
Use of Hard-coded Credentials
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
799 |
Improper Control of Interaction Frequency
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
800 |
Weaknesses in the 2010 CWE/SANS Top 25 Most Dangerous Programming Errors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
801 |
2010 Top 25 - Insecure Interaction Between Components
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
802 |
2010 Top 25 - Risky Resource Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
803 |
2010 Top 25 - Porous Defenses
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
804 |
Guessable CAPTCHA
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
805 |
Buffer Access with Incorrect Length Value
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
806 |
Buffer Access Using Size of Source Buffer
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
807 |
Reliance on Untrusted Inputs in a Security Decision
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
808 |
2010 Top 25 - Weaknesses On the Cusp
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
809 |
Weaknesses in OWASP Top Ten (2010)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
810 |
OWASP Top Ten 2010 Category A1 - Injection
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
811 |
OWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
812 |
OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
813 |
OWASP Top Ten 2010 Category A4 - Insecure Direct Object References
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
814 |
OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
815 |
OWASP Top Ten 2010 Category A6 - Security Misconfiguration
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
816 |
OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
817 |
OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
818 |
OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
819 |
OWASP Top Ten 2010 Category A10 - Unvalidated Redirects and Forwards
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
820 |
Missing Synchronization
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
821 |
Incorrect Synchronization
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
822 |
Untrusted Pointer Dereference
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
823 |
Use of Out-of-range Pointer Offset
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
824 |
Access of Uninitialized Pointer
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
825 |
Expired Pointer Dereference
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
826 |
Premature Release of Resource During Expected Lifetime
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
827 |
Improper Control of Document Type Definition
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
828 |
Signal Handler with Functionality that is not Asynchronous-Safe
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
829 |
Inclusion of Functionality from Untrusted Control Sphere
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
830 |
Inclusion of Web Functionality from an Untrusted Source
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
831 |
Signal Handler Function Associated with Multiple Signals
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
832 |
Unlock of a Resource that is not Locked
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
833 |
Deadlock
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
834 |
Excessive Iteration
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
835 |
Loop with Unreachable Exit Condition ('Infinite Loop')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
836 |
Use of Password Hash Instead of Password for Authentication
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
837 |
Improper Enforcement of a Single, Unique Action
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
838 |
Inappropriate Encoding for Output Context
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
839 |
Numeric Range Comparison Without Minimum Check
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
840 |
Business Logic Errors
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
841 |
Improper Enforcement of Behavioral Workflow
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
842 |
Placement of User into Incorrect Group
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
843 |
Access of Resource Using Incompatible Type ('Type Confusion')
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
844 |
Weaknesses Addressed by The CERT Oracle Secure Coding Standard for Java (2011)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
845 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 2 - Input Validation and Data Sanitization (IDS)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
846 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 3 - Declarations and Initialization (DCL)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
847 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 4 - Expressions (EXP)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
848 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 5 - Numeric Types and Operations (NUM)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
849 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 6 - Object Orientation (OBJ)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
850 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 7 - Methods (MET)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
851 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
852 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 9 - Visibility and Atomicity (VNA)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
853 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 10 - Locking (LCK)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
854 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 11 - Thread APIs (THI)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
855 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 12 - Thread Pools (TPS)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
856 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 13 - Thread-Safety Miscellaneous (TSM)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
857 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 14 - Input Output (FIO)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
858 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 15 - Serialization (SER)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
859 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 16 - Platform Security (SEC)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
860 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 17 - Runtime Environment (ENV)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
861 |
The CERT Oracle Secure Coding Standard for Java (2011) Chapter 18 - Miscellaneous (MSC)
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
862 |
Missing Authorization
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
863 |
Incorrect Authorization
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
864 |
2011 Top 25 - Insecure Interaction Between Components
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
865 |
2011 Top 25 - Risky Resource Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
866 |
2011 Top 25 - Porous Defenses
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
867 |
2011 Top 25 - Weaknesses On the Cusp
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
868 |
Weaknesses Addressed by the SEI CERT C++ Coding Standard (2016 Version)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
869 |
CERT C++ Secure Coding Section 01 - Preprocessor (PRE)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
870 |
CERT C++ Secure Coding Section 02 - Declarations and Initialization (DCL)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
871 |
CERT C++ Secure Coding Section 03 - Expressions (EXP)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
872 |
CERT C++ Secure Coding Section 04 - Integers (INT)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
873 |
CERT C++ Secure Coding Section 05 - Floating Point Arithmetic (FLP)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
874 |
CERT C++ Secure Coding Section 06 - Arrays and the STL (ARR)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
875 |
CERT C++ Secure Coding Section 07 - Characters and Strings (STR)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
876 |
CERT C++ Secure Coding Section 08 - Memory Management (MEM)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
877 |
CERT C++ Secure Coding Section 09 - Input Output (FIO)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
878 |
CERT C++ Secure Coding Section 10 - Environment (ENV)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
879 |
CERT C++ Secure Coding Section 11 - Signals (SIG)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
880 |
CERT C++ Secure Coding Section 12 - Exceptions and Error Handling (ERR)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
881 |
CERT C++ Secure Coding Section 13 - Object Oriented Programming (OOP)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
882 |
CERT C++ Secure Coding Section 14 - Concurrency (CON)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
883 |
CERT C++ Secure Coding Section 49 - Miscellaneous (MSC)
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
884 |
CWE Cross-section
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
885 |
SFP Primary Cluster: Risky Values
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
886 |
SFP Primary Cluster: Unused entities
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
887 |
SFP Primary Cluster: API
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
888 |
Software Fault Pattern (SFP) Clusters
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
889 |
SFP Primary Cluster: Exception Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
890 |
SFP Primary Cluster: Memory Access
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
891 |
SFP Primary Cluster: Memory Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
892 |
SFP Primary Cluster: Resource Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
893 |
SFP Primary Cluster: Path Resolution
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
894 |
SFP Primary Cluster: Synchronization
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
895 |
SFP Primary Cluster: Information Leak
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
896 |
SFP Primary Cluster: Tainted Input
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
897 |
SFP Primary Cluster: Entry Points
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
898 |
SFP Primary Cluster: Authentication
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
899 |
SFP Primary Cluster: Access Control
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
900 |
Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
901 |
SFP Primary Cluster: Privilege
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
902 |
SFP Primary Cluster: Channel
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
903 |
SFP Primary Cluster: Cryptography
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
904 |
SFP Primary Cluster: Malware
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
905 |
SFP Primary Cluster: Predictability
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
906 |
SFP Primary Cluster: UI
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
907 |
SFP Primary Cluster: Other
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
908 |
Use of Uninitialized Resource
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
909 |
Missing Initialization of Resource
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
910 |
Use of Expired File Descriptor
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
911 |
Improper Update of Reference Count
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
912 |
Hidden Functionality
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
913 |
Improper Control of Dynamically-Managed Code Resources
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
914 |
Improper Control of Dynamically-Identified Variables
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
915 |
Improperly Controlled Modification of Dynamically-Determined Object Attributes
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
916 |
Use of Password Hash With Insufficient Computational Effort
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
917 |
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
918 |
Server-Side Request Forgery (SSRF)
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
919 |
Weaknesses in Mobile Applications
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
920 |
Improper Restriction of Power Consumption
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
921 |
Storage of Sensitive Data in a Mechanism without Access Control
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
922 |
Insecure Storage of Sensitive Information
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
923 |
Improper Restriction of Communication Channel to Intended Endpoints
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
924 |
Improper Enforcement of Message Integrity During Transmission in a Communication Channel
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
925 |
Improper Verification of Intent by Broadcast Receiver
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
926 |
Improper Export of Android Application Components
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
927 |
Use of Implicit Intent for Sensitive Communication
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
928 |
Weaknesses in OWASP Top Ten (2013)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
929 |
OWASP Top Ten 2013 Category A1 - Injection
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
930 |
OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
931 |
OWASP Top Ten 2013 Category A3 - Cross-Site Scripting (XSS)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
932 |
OWASP Top Ten 2013 Category A4 - Insecure Direct Object References
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
933 |
OWASP Top Ten 2013 Category A5 - Security Misconfiguration
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
934 |
OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
935 |
OWASP Top Ten 2013 Category A7 - Missing Function Level Access Control
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
936 |
OWASP Top Ten 2013 Category A8 - Cross-Site Request Forgery (CSRF)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
937 |
OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
938 |
OWASP Top Ten 2013 Category A10 - Unvalidated Redirects and Forwards
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
939 |
Improper Authorization in Handler for Custom URL Scheme
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
940 |
Improper Verification of Source of a Communication Channel
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
941 |
Incorrectly Specified Destination in a Communication Channel
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
942 |
Permissive Cross-domain Policy with Untrusted Domains
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
943 |
Improper Neutralization of Special Elements in Data Query Logic
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
944 |
SFP Secondary Cluster: Access Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
945 |
SFP Secondary Cluster: Insecure Resource Access
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
946 |
SFP Secondary Cluster: Insecure Resource Permissions
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
947 |
SFP Secondary Cluster: Authentication Bypass
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
948 |
SFP Secondary Cluster: Digital Certificate
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
949 |
SFP Secondary Cluster: Faulty Endpoint Authentication
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
950 |
SFP Secondary Cluster: Hardcoded Sensitive Data
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
951 |
SFP Secondary Cluster: Insecure Authentication Policy
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
952 |
SFP Secondary Cluster: Missing Authentication
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
953 |
SFP Secondary Cluster: Missing Endpoint Authentication
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
954 |
SFP Secondary Cluster: Multiple Binds to the Same Port
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
955 |
SFP Secondary Cluster: Unrestricted Authentication
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
956 |
SFP Secondary Cluster: Channel Attack
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
957 |
SFP Secondary Cluster: Protocol Error
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
958 |
SFP Secondary Cluster: Broken Cryptography
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
959 |
SFP Secondary Cluster: Weak Cryptography
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
960 |
SFP Secondary Cluster: Ambiguous Exception Type
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
961 |
SFP Secondary Cluster: Incorrect Exception Behavior
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
962 |
SFP Secondary Cluster: Unchecked Status Condition
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
963 |
SFP Secondary Cluster: Exposed Data
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
964 |
SFP Secondary Cluster: Exposure Temporary File
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
965 |
SFP Secondary Cluster: Insecure Session Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
966 |
SFP Secondary Cluster: Other Exposures
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
967 |
SFP Secondary Cluster: State Disclosure
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
968 |
SFP Secondary Cluster: Covert Channel
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
969 |
SFP Secondary Cluster: Faulty Memory Release
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
970 |
SFP Secondary Cluster: Faulty Buffer Access
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
971 |
SFP Secondary Cluster: Faulty Pointer Use
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
972 |
SFP Secondary Cluster: Faulty String Expansion
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
973 |
SFP Secondary Cluster: Improper NULL Termination
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
974 |
SFP Secondary Cluster: Incorrect Buffer Length Computation
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
975 |
SFP Secondary Cluster: Architecture
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
976 |
SFP Secondary Cluster: Compiler
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
977 |
SFP Secondary Cluster: Design
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
978 |
SFP Secondary Cluster: Implementation
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
979 |
SFP Secondary Cluster: Failed Chroot Jail
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
980 |
SFP Secondary Cluster: Link in Resource Name Resolution
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
981 |
SFP Secondary Cluster: Path Traversal
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
982 |
SFP Secondary Cluster: Failure to Release Resource
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
983 |
SFP Secondary Cluster: Faulty Resource Use
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
984 |
SFP Secondary Cluster: Life Cycle
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
985 |
SFP Secondary Cluster: Unrestricted Consumption
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
986 |
SFP Secondary Cluster: Missing Lock
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
987 |
SFP Secondary Cluster: Multiple Locks/Unlocks
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
988 |
SFP Secondary Cluster: Race Condition Window
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
989 |
SFP Secondary Cluster: Unrestricted Lock
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
990 |
SFP Secondary Cluster: Tainted Input to Command
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
991 |
SFP Secondary Cluster: Tainted Input to Environment
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
992 |
SFP Secondary Cluster: Faulty Input Transformation
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
993 |
SFP Secondary Cluster: Incorrect Input Handling
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
994 |
SFP Secondary Cluster: Tainted Input to Variable
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
995 |
SFP Secondary Cluster: Feature
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
996 |
SFP Secondary Cluster: Security
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
997 |
SFP Secondary Cluster: Information Loss
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
998 |
SFP Secondary Cluster: Glitch in Computation
|
| HasMember |
Deprecated |
999 |
DEPRECATED: Weaknesses without Software Fault Patterns
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1000 |
Research Concepts
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1001 |
SFP Secondary Cluster: Use of an Improper API
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1002 |
SFP Secondary Cluster: Unexpected Entry Points
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1003 |
Weaknesses for Simplified Mapping of Published Vulnerabilities
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1004 |
Sensitive Cookie Without 'HttpOnly' Flag
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1005 |
7PK - Input Validation and Representation
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1006 |
Bad Coding Practices
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1007 |
Insufficient Visual Distinction of Homoglyphs Presented to User
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1008 |
Architectural Concepts
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1009 |
Audit
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1010 |
Authenticate Actors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1011 |
Authorize Actors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1012 |
Cross Cutting
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1013 |
Encrypt Data
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1014 |
Identify Actors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1015 |
Limit Access
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1016 |
Limit Exposure
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1017 |
Lock Computer
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1018 |
Manage User Sessions
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1019 |
Validate Inputs
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1020 |
Verify Message Integrity
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1021 |
Improper Restriction of Rendered UI Layers or Frames
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1022 |
Use of Web Link to Untrusted Target with window.opener Access
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1023 |
Incomplete Comparison with Missing Factors
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1024 |
Comparison of Incompatible Types
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1025 |
Comparison Using Wrong Factors
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1026 |
Weaknesses in OWASP Top Ten (2017)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1027 |
OWASP Top Ten 2017 Category A1 - Injection
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1028 |
OWASP Top Ten 2017 Category A2 - Broken Authentication
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1029 |
OWASP Top Ten 2017 Category A3 - Sensitive Data Exposure
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1030 |
OWASP Top Ten 2017 Category A4 - XML External Entities (XXE)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1031 |
OWASP Top Ten 2017 Category A5 - Broken Access Control
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1032 |
OWASP Top Ten 2017 Category A6 - Security Misconfiguration
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1033 |
OWASP Top Ten 2017 Category A7 - Cross-Site Scripting (XSS)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1034 |
OWASP Top Ten 2017 Category A8 - Insecure Deserialization
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1035 |
OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1036 |
OWASP Top Ten 2017 Category A10 - Insufficient Logging & Monitoring
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1037 |
Processor Optimization Removal or Modification of Security-critical Code
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1038 |
Insecure Automated Optimizations
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1039 |
Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1040 |
Quality Weaknesses with Indirect Security Impacts
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1041 |
Use of Redundant Code
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1042 |
Static Member Data Element outside of a Singleton Class Element
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1043 |
Data Element Aggregating an Excessively Large Number of Non-Primitive Elements
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1044 |
Architecture with Number of Horizontal Layers Outside of Expected Range
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1045 |
Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1046 |
Creation of Immutable Text Using String Concatenation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1047 |
Modules with Circular Dependencies
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1048 |
Invokable Control Element with Large Number of Outward Calls
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1049 |
Excessive Data Query Operations in a Large Data Table
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1050 |
Excessive Platform Resource Consumption within a Loop
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1051 |
Initialization with Hard-Coded Network Resource Configuration Data
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1052 |
Excessive Use of Hard-Coded Literals in Initialization
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1053 |
Missing Documentation for Design
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1054 |
Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1055 |
Multiple Inheritance from Concrete Classes
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1056 |
Invokable Control Element with Variadic Parameters
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1057 |
Data Access Operations Outside of Expected Data Manager Component
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1058 |
Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1059 |
Insufficient Technical Documentation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1060 |
Excessive Number of Inefficient Server-Side Data Accesses
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1061 |
Insufficient Encapsulation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1062 |
Parent Class with References to Child Class
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1063 |
Creation of Class Instance within a Static Code Block
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1064 |
Invokable Control Element with Signature Containing an Excessive Number of Parameters
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1065 |
Runtime Resource Management Control Element in a Component Built to Run on Application Servers
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1066 |
Missing Serialization Control Element
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1067 |
Excessive Execution of Sequential Searches of Data Resource
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1068 |
Inconsistency Between Implementation and Documented Design
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1069 |
Empty Exception Block
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1070 |
Serializable Data Element Containing non-Serializable Item Elements
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1071 |
Empty Code Block
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1072 |
Data Resource Access without Use of Connection Pooling
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1073 |
Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1074 |
Class with Excessively Deep Inheritance
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1075 |
Unconditional Control Flow Transfer outside of Switch Block
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1076 |
Insufficient Adherence to Expected Conventions
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1077 |
Floating Point Comparison with Incorrect Operator
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1078 |
Inappropriate Source Code Style or Formatting
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1079 |
Parent Class without Virtual Destructor Method
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1080 |
Source Code File with Excessive Number of Lines of Code
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1081 |
Entries with Maintenance Notes
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1082 |
Class Instance Self Destruction Control Element
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1083 |
Data Access from Outside Expected Data Manager Component
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1084 |
Invokable Control Element with Excessive File or Data Access Operations
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1085 |
Invokable Control Element with Excessive Volume of Commented-out Code
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1086 |
Class with Excessive Number of Child Classes
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1087 |
Class with Virtual Method without a Virtual Destructor
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1088 |
Synchronous Access of Remote Resource without Timeout
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1089 |
Large Data Table with Excessive Number of Indices
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1090 |
Method Containing Access of a Member Element from Another Class
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1091 |
Use of Object without Invoking Destructor Method
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1092 |
Use of Same Invokable Control Element in Multiple Architectural Layers
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1093 |
Excessively Complex Data Representation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1094 |
Excessive Index Range Scan for a Data Resource
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1095 |
Loop Condition Value Update within the Loop
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1096 |
Singleton Class Instance Creation without Proper Locking or Synchronization
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1097 |
Persistent Storable Data Element without Associated Comparison Control Element
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1098 |
Data Element containing Pointer Item without Proper Copy Control Element
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1099 |
Inconsistent Naming Conventions for Identifiers
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1100 |
Insufficient Isolation of System-Dependent Functions
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1101 |
Reliance on Runtime Component in Generated Code
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1102 |
Reliance on Machine-Dependent Data Representation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1103 |
Use of Platform-Dependent Third Party Components
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1104 |
Use of Unmaintained Third Party Components
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1105 |
Insufficient Encapsulation of Machine-Dependent Functionality
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1106 |
Insufficient Use of Symbolic Constants
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1107 |
Insufficient Isolation of Symbolic Constant Definitions
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1108 |
Excessive Reliance on Global Variables
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1109 |
Use of Same Variable for Multiple Purposes
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1110 |
Incomplete Design Documentation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1111 |
Incomplete I/O Documentation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1112 |
Incomplete Documentation of Program Execution
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1113 |
Inappropriate Comment Style
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1114 |
Inappropriate Whitespace Style
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1115 |
Source Code Element without Standard Prologue
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1116 |
Inaccurate Comments
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1117 |
Callable with Insufficient Behavioral Summary
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1118 |
Insufficient Documentation of Error Handling Techniques
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1119 |
Excessive Use of Unconditional Branching
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1120 |
Excessive Code Complexity
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1121 |
Excessive McCabe Cyclomatic Complexity
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1122 |
Excessive Halstead Complexity
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1123 |
Excessive Use of Self-Modifying Code
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1124 |
Excessively Deep Nesting
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1125 |
Excessive Attack Surface
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1126 |
Declaration of Variable with Unnecessarily Wide Scope
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1127 |
Compilation with Insufficient Warnings or Errors
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1128 |
CISQ Quality Measures (2016)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1129 |
CISQ Quality Measures (2016) - Reliability
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1130 |
CISQ Quality Measures (2016) - Maintainability
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1131 |
CISQ Quality Measures (2016) - Security
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1132 |
CISQ Quality Measures (2016) - Performance Efficiency
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1133 |
Weaknesses Addressed by the SEI CERT Oracle Coding Standard for Java
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1134 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and Data Sanitization (IDS)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1135 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 01. Declarations and Initialization (DCL)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1136 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 02. Expressions (EXP)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1137 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 03. Numeric Types and Operations (NUM)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1138 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 04. Characters and Strings (STR)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1139 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1140 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1141 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 07. Exceptional Behavior (ERR)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1142 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 08. Visibility and Atomicity (VNA)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1143 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 09. Locking (LCK)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1144 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 10. Thread APIs (THI)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1145 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1146 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 12. Thread-Safety Miscellaneous (TSM)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1147 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 13. Input Output (FIO)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1148 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 14. Serialization (SER)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1149 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1150 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 16. Runtime Environment (ENV)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1151 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 17. Java Native Interface (JNI)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1152 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 49. Miscellaneous (MSC)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1153 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 50. Android (DRD)
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1154 |
Weaknesses Addressed by the SEI CERT C Coding Standard
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1155 |
SEI CERT C Coding Standard - Guidelines 01. Preprocessor (PRE)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1156 |
SEI CERT C Coding Standard - Guidelines 02. Declarations and Initialization (DCL)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1157 |
SEI CERT C Coding Standard - Guidelines 03. Expressions (EXP)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1158 |
SEI CERT C Coding Standard - Guidelines 04. Integers (INT)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1159 |
SEI CERT C Coding Standard - Guidelines 05. Floating Point (FLP)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1160 |
SEI CERT C Coding Standard - Guidelines 06. Arrays (ARR)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1161 |
SEI CERT C Coding Standard - Guidelines 07. Characters and Strings (STR)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1162 |
SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1163 |
SEI CERT C Coding Standard - Guidelines 09. Input Output (FIO)
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1164 |
Irrelevant Code
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1165 |
SEI CERT C Coding Standard - Guidelines 10. Environment (ENV)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1166 |
SEI CERT C Coding Standard - Guidelines 11. Signals (SIG)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1167 |
SEI CERT C Coding Standard - Guidelines 12. Error Handling (ERR)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1168 |
SEI CERT C Coding Standard - Guidelines 13. Application Programming Interfaces (API)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1169 |
SEI CERT C Coding Standard - Guidelines 14. Concurrency (CON)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1170 |
SEI CERT C Coding Standard - Guidelines 48. Miscellaneous (MSC)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1171 |
SEI CERT C Coding Standard - Guidelines 50. POSIX (POS)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1172 |
SEI CERT C Coding Standard - Guidelines 51. Microsoft Windows (WIN)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1173 |
Improper Use of Validation Framework
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1174 |
ASP.NET Misconfiguration: Improper Model Validation
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1175 |
SEI CERT Oracle Secure Coding Standard for Java - Guidelines 18. Concurrency (CON)
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1176 |
Inefficient CPU Computation
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1177 |
Use of Prohibited Code
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1178 |
Weaknesses Addressed by the SEI CERT Perl Coding Standard
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1179 |
SEI CERT Perl Coding Standard - Guidelines 01. Input Validation and Data Sanitization (IDS)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1180 |
SEI CERT Perl Coding Standard - Guidelines 02. Declarations and Initialization (DCL)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1181 |
SEI CERT Perl Coding Standard - Guidelines 03. Expressions (EXP)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1182 |
SEI CERT Perl Coding Standard - Guidelines 04. Integers (INT)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1183 |
SEI CERT Perl Coding Standard - Guidelines 05. Strings (STR)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1184 |
SEI CERT Perl Coding Standard - Guidelines 06. Object-Oriented Programming (OOP)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1185 |
SEI CERT Perl Coding Standard - Guidelines 07. File Input and Output (FIO)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1186 |
SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC)
|
| HasMember |
Deprecated |
1187 |
DEPRECATED: Use of Uninitialized Resource
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1188 |
Initialization of a Resource with an Insecure Default
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1189 |
Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1190 |
DMA Device Enabled Too Early in Boot Phase
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1191 |
On-Chip Debug and Test Interface With Improper Access Control
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1192 |
Improper Identifier for IP Block used in System-On-Chip (SOC)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1193 |
Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1194 |
Hardware Design
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1195 |
Manufacturing and Life Cycle Management Concerns
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1196 |
Security Flow Issues
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1197 |
Integration Issues
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1198 |
Privilege Separation and Access Control Issues
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1199 |
General Circuit and Logic Design Concerns
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1200 |
Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1201 |
Core and Compute Issues
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1202 |
Memory and Storage Issues
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1203 |
Peripherals, On-chip Fabric, and Interface/IO Problems
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1204 |
Generation of Weak Initialization Vector (IV)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1205 |
Security Primitives and Cryptography Issues
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1206 |
Power, Clock, Thermal, and Reset Concerns
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1207 |
Debug and Test Problems
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1208 |
Cross-Cutting Problems
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1209 |
Failure to Disable Reserved Bits
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1210 |
Audit / Logging Errors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1211 |
Authentication Errors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1212 |
Authorization Errors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1213 |
Random Number Issues
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1214 |
Data Integrity Issues
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1215 |
Data Validation Issues
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1216 |
Lockout Mechanism Errors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1217 |
User Session Errors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1218 |
Memory Buffer Errors
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1219 |
File Handling Issues
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1220 |
Insufficient Granularity of Access Control
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1221 |
Incorrect Register Defaults or Module Parameters
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1222 |
Insufficient Granularity of Address Regions Protected by Register Locks
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1223 |
Race Condition for Write-Once Attributes
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1224 |
Improper Restriction of Write-Once Bit Fields
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1225 |
Documentation Issues
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1226 |
Complexity Issues
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1227 |
Encapsulation Issues
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1228 |
API / Function Errors
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1229 |
Creation of Emergent Resource
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1230 |
Exposure of Sensitive Information Through Metadata
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1231 |
Improper Prevention of Lock Bit Modification
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1232 |
Improper Lock Behavior After Power State Transition
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1233 |
Security-Sensitive Hardware Controls with Missing Lock Bit Protection
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1234 |
Hardware Internal or Debug Modes Allow Override of Locks
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1235 |
Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1236 |
Improper Neutralization of Formula Elements in a CSV File
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1237 |
SFP Primary Cluster: Faulty Resource Release
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1238 |
SFP Primary Cluster: Failure to Release Memory
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1239 |
Improper Zeroization of Hardware Register
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1240 |
Use of a Cryptographic Primitive with a Risky Implementation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1241 |
Use of Predictable Algorithm in Random Number Generator
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1242 |
Inclusion of Undocumented Features or Chicken Bits
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1243 |
Sensitive Non-Volatile Information Not Protected During Debug
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1244 |
Internal Asset Exposed to Unsafe Debug Access Level or State
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1245 |
Improper Finite State Machines (FSMs) in Hardware Logic
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1246 |
Improper Write Handling in Limited-write Non-Volatile Memories
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1247 |
Improper Protection Against Voltage and Clock Glitches
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1248 |
Semiconductor Defects in Hardware Logic with Security-Sensitive Implications
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1249 |
Application-Level Admin Tool with Inconsistent View of Underlying Operating System
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1250 |
Improper Preservation of Consistency Between Independent Representations of Shared State
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1251 |
Mirrored Regions with Different Values
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1252 |
CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1253 |
Incorrect Selection of Fuse Values
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1254 |
Incorrect Comparison Logic Granularity
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1255 |
Comparison Logic is Vulnerable to Power Side-Channel Attacks
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1256 |
Improper Restriction of Software Interfaces to Hardware Features
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1257 |
Improper Access Control Applied to Mirrored or Aliased Memory Regions
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1258 |
Exposure of Sensitive System Information Due to Uncleared Debug Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1259 |
Improper Restriction of Security Token Assignment
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1260 |
Improper Handling of Overlap Between Protected Memory Ranges
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1261 |
Improper Handling of Single Event Upsets
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1262 |
Improper Access Control for Register Interface
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1263 |
Improper Physical Access Control
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1264 |
Hardware Logic with Insecure De-Synchronization between Control and Data Channels
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1265 |
Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1266 |
Improper Scrubbing of Sensitive Data from Decommissioned Device
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1267 |
Policy Uses Obsolete Encoding
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1268 |
Policy Privileges are not Assigned Consistently Between Control and Data Agents
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1269 |
Product Released in Non-Release Configuration
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1270 |
Generation of Incorrect Security Tokens
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1271 |
Uninitialized Value on Reset for Registers Holding Security Settings
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1272 |
Sensitive Information Uncleared Before Debug/Power State Transition
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1273 |
Device Unlock Credential Sharing
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1274 |
Improper Access Control for Volatile Memory Containing Boot Code
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1275 |
Sensitive Cookie with Improper SameSite Attribute
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1276 |
Hardware Child Block Incorrectly Connected to Parent System
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1277 |
Firmware Not Updateable
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1278 |
Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1279 |
Cryptographic Operations are run Before Supporting Units are Ready
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1280 |
Access Control Check Implemented After Asset is Accessed
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1281 |
Sequence of Processor Instructions Leads to Unexpected Behavior
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1282 |
Assumed-Immutable Data is Stored in Writable Memory
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1283 |
Mutable Attestation or Measurement Reporting Data
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1284 |
Improper Validation of Specified Quantity in Input
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1285 |
Improper Validation of Specified Index, Position, or Offset in Input
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1286 |
Improper Validation of Syntactic Correctness of Input
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1287 |
Improper Validation of Specified Type of Input
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1288 |
Improper Validation of Consistency within Input
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1289 |
Improper Validation of Unsafe Equivalence in Input
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1290 |
Incorrect Decoding of Security Identifiers
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1291 |
Public Key Re-Use for Signing both Debug and Production Code
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1292 |
Incorrect Conversion of Security Identifiers
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1293 |
Missing Source Correlation of Multiple Independent Data
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1294 |
Insecure Security Identifier Mechanism
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1295 |
Debug Messages Revealing Unnecessary Information
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1296 |
Incorrect Chaining or Granularity of Debug Components
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1297 |
Unprotected Confidential Information on Device is Accessible by OSAT Vendors
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1298 |
Hardware Logic Contains Race Conditions
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1299 |
Missing Protection Mechanism for Alternate Hardware Interface
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1300 |
Improper Protection of Physical Side Channels
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1301 |
Insufficient or Incomplete Data Removal within Hardware Component
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1302 |
Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1303 |
Non-Transparent Sharing of Microarchitectural Resources
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1304 |
Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1305 |
CISQ Quality Measures (2020)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1306 |
CISQ Quality Measures - Reliability
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1307 |
CISQ Quality Measures - Maintainability
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1308 |
CISQ Quality Measures - Security
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1309 |
CISQ Quality Measures - Efficiency
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1310 |
Missing Ability to Patch ROM Code
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1311 |
Improper Translation of Security Attributes by Fabric Bridge
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1312 |
Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1313 |
Hardware Allows Activation of Test or Debug Logic at Runtime
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1314 |
Missing Write Protection for Parametric Data Values
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1315 |
Improper Setting of Bus Controlling Capability in Fabric End-point
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1316 |
Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1317 |
Improper Access Control in Fabric Bridge
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1318 |
Missing Support for Security Features in On-chip Fabrics or Buses
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1319 |
Improper Protection against Electromagnetic Fault Injection (EM-FI)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1320 |
Improper Protection for Outbound Error Messages and Alert Signals
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1321 |
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1322 |
Use of Blocking Code in Single-threaded, Non-blocking Context
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1323 |
Improper Management of Sensitive Trace Data
|
| HasMember |
Deprecated |
1324 |
DEPRECATED: Sensitive Information Accessible by Physical Probing of JTAG Interface
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1325 |
Improperly Controlled Sequential Memory Allocation
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1326 |
Missing Immutable Root of Trust in Hardware
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1327 |
Binding to an Unrestricted IP Address
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1328 |
Security Version Number Mutable to Older Versions
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1329 |
Reliance on Component That is Not Updateable
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1330 |
Remanent Data Readable after Memory Erase
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1331 |
Improper Isolation of Shared Resources in Network On Chip (NoC)
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1332 |
Improper Handling of Faults that Lead to Instruction Skips
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1333 |
Inefficient Regular Expression Complexity
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1334 |
Unauthorized Error Injection Can Degrade Hardware Redundancy
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1335 |
Incorrect Bitwise Shift of Integer
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1336 |
Improper Neutralization of Special Elements Used in a Template Engine
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1337 |
Weaknesses in the 2021 CWE Top 25 Most Dangerous Software Weaknesses
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1338 |
Improper Protections Against Hardware Overheating
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1339 |
Insufficient Precision or Accuracy of a Real Number
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1340 |
CISQ Data Protection Measures
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1341 |
Multiple Releases of Same Resource or Handle
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1342 |
Information Exposure through Microarchitectural State after Transient Execution
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1343 |
Weaknesses in the 2021 CWE Most Important Hardware Weaknesses List
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1344 |
Weaknesses in OWASP Top Ten (2021)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1345 |
OWASP Top Ten 2021 Category A01:2021 - Broken Access Control
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1346 |
OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1347 |
OWASP Top Ten 2021 Category A03:2021 - Injection
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1348 |
OWASP Top Ten 2021 Category A04:2021 - Insecure Design
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1349 |
OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1350 |
Weaknesses in the 2020 CWE Top 25 Most Dangerous Software Weaknesses
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1351 |
Improper Handling of Hardware Behavior in Exceptionally Cold Environments
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1352 |
OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1353 |
OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1354 |
OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1355 |
OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1356 |
OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF)
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1357 |
Reliance on Insufficiently Trustworthy Component
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1358 |
Weaknesses in SEI ETF Categories of Security Vulnerabilities in ICS
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1359 |
ICS Communications
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1360 |
ICS Dependencies (& Architecture)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1361 |
ICS Supply Chain
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1362 |
ICS Engineering (Constructions/Deployment)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1363 |
ICS Operations (& Maintenance)
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1364 |
ICS Communications: Zone Boundary Failures
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1365 |
ICS Communications: Unreliability
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1366 |
ICS Communications: Frail Security in Protocols
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1367 |
ICS Dependencies (& Architecture): External Physical Systems
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1368 |
ICS Dependencies (& Architecture): External Digital Systems
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1369 |
ICS Supply Chain: IT/OT Convergence/Expansion
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1370 |
ICS Supply Chain: Common Mode Frailties
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1371 |
ICS Supply Chain: Poorly Documented or Undocumented Features
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1372 |
ICS Supply Chain: OT Counterfeit and Malicious Corruption
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1373 |
ICS Engineering (Construction/Deployment): Trust Model Problems
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1374 |
ICS Engineering (Construction/Deployment): Maker Breaker Blindness
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1375 |
ICS Engineering (Construction/Deployment): Gaps in Details/Data
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1376 |
ICS Engineering (Construction/Deployment): Security Gaps in Commissioning
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1377 |
ICS Engineering (Construction/Deployment): Inherent Predictability in Design
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1378 |
ICS Operations (& Maintenance): Gaps in obligations and training
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1379 |
ICS Operations (& Maintenance): Human factors in ICS environments
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1380 |
ICS Operations (& Maintenance): Post-analysis changes
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1381 |
ICS Operations (& Maintenance): Exploitable Standard Operational Procedures
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1382 |
ICS Operations (& Maintenance): Emerging Energy Technologies
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1383 |
ICS Operations (& Maintenance): Compliance/Conformance with Regulatory Requirements
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1384 |
Improper Handling of Physical or Environmental Conditions
|
| HasMember |
Variant - a weakness that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. |
1385 |
Missing Origin Validation in WebSockets
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1386 |
Insecure Operation on Windows Junction / Mount Point
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1387 |
Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1388 |
Physical Access Issues and Concerns
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1389 |
Incorrect Parsing of Numbers with Different Radices
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1390 |
Weak Authentication
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1391 |
Use of Weak Credentials
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1392 |
Use of Default Credentials
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1393 |
Use of Default Password
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1394 |
Use of Default Cryptographic Key
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1395 |
Dependency on Vulnerable Third-Party Component
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1396 |
Comprehensive Categorization: Access Control
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1397 |
Comprehensive Categorization: Comparison
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1398 |
Comprehensive Categorization: Component Interaction
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1399 |
Comprehensive Categorization: Memory Safety
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1400 |
Comprehensive Categorization for Software Assurance Trends
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1401 |
Comprehensive Categorization: Concurrency
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1402 |
Comprehensive Categorization: Encryption
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1403 |
Comprehensive Categorization: Exposed Resource
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1404 |
Comprehensive Categorization: File Handling
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1405 |
Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1406 |
Comprehensive Categorization: Improper Input Validation
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1407 |
Comprehensive Categorization: Improper Neutralization
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1408 |
Comprehensive Categorization: Incorrect Calculation
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1409 |
Comprehensive Categorization: Injection
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1410 |
Comprehensive Categorization: Insufficient Control Flow Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1411 |
Comprehensive Categorization: Insufficient Verification of Data Authenticity
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1412 |
Comprehensive Categorization: Poor Coding Practices
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1413 |
Comprehensive Categorization: Protection Mechanism Failure
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1414 |
Comprehensive Categorization: Randomness
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1415 |
Comprehensive Categorization: Resource Control
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1416 |
Comprehensive Categorization: Resource Lifecycle Management
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1417 |
Comprehensive Categorization: Sensitive Information Exposure
|
| HasMember |
Category - a CWE entry that contains a set of other entries that share a common characteristic. |
1418 |
Comprehensive Categorization: Violation of Secure Design Principles
|
| HasMember |
Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. |
1419 |
Incorrect Initialization of Resource
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1420 |
Exposure of Sensitive Information during Transient Execution
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1421 |
Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1422 |
Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1423 |
Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1424 |
Weaknesses Addressed by ISA/IEC 62443 Requirements
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1425 |
Weaknesses in the 2023 CWE Top 25 Most Dangerous Software Weaknesses
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1426 |
Improper Validation of Generative AI Output
|
| HasMember |
Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. |
1427 |
Improper Neutralization of Input Used for LLM Prompting
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
1430 |
Weaknesses in the 2024 CWE Top 25 Most Dangerous Software Weaknesses
|
| HasMember |
View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). |
2000 |
Comprehensive CWE Dictionary
|
Objective
