CWE - Differences between Version 1.0 and Version 2.0

Home > CWE List > Reports > Differences between Version 1.0 and Version 2.0

Differences between Version 1.0 and Version 2.0

Summary | Field Change Summary | Important Changes | Detailed Difference Report

Summary

Total (Version 2.0)	870
Total (Version 1.0)	734
Total new	136
Total deprecated	5
Total shared	734
Total important changes	545
Total major changes	684
Total minor changes	96
Total minor changes (no major)
Total unchanged	50

Summary of Entry Types

Type	Version 1.0	Version 2.0
Category	86	141
Chain	3	3
Composite	9	6
Deprecated	7	12
View	20	26
Weakness	609	682

Field Change Summary

Any change with respect to whitespace is ignored. "Minor" changes are text changes that only affect capitalization and punctuation. Most other changes are marked as "Major." Simple schema changes are treated as Minor, such as the change from AffectedResource to Affected_Resource in Draft 8, or the relationship name change from "IsRequiredBy" to "RequiredBy" in Version 1.0. For each mutual relationship between nodes A and B (such as ParentOf and ChildOf), a relationship change is noted for both A and B.

Field	Major	Minor
Name	236	4
Description	371	2
Applicable_Platforms	70	17
Time_of_Introduction	22	0
Demonstrative_Examples	231	2
Detection_Factors	42	0
Likelihood_of_Exploit	32	0
Common_Consequences	619	0
Relationships	385	0
References	70	1
Potential_Mitigations	229	70
Observed_Examples	110	1
Terminology_Notes	11	0
Alternate_Terms	22	1
Related_Attack_Patterns	108	0
Relationship_Notes	58	0
Taxonomy_Mappings	230	0
Maintenance_Notes	41	0
Modes_of_Introduction	15	0
Affected_Resources	2	0
Functional_Areas	4	2
Research_Gaps	22	0
Background_Details	22	0
Theoretical_Notes	18	0
Weakness_Ordinalities	19	0
White_Box_Definitions	14	0
Enabling_Factors_for_Exploitation	8	0
Other_Notes	233	2
Relevant_Properties	2	0
View_Type	0	0
View_Structure	1	0
View_Filter	3	0
View_Audience	0	0
Common_Methods_of_Exploitation	0	0
Type	16	0
Causal_Nature	2	0
Source_Taxonomy	0	0
Context_Notes	0	0
Black_Box_Definitions	0	0

Form and Abstraction Changes

From	To	Total
Unchanged		718
Composite	Weakness/Base	3
Weakness/Base	Deprecated	4
Weakness/Base	Weakness/Class	3
Weakness/Base	Weakness/Variant	1
Weakness/Class	Category	1
Weakness/Variant	Deprecated	1
Weakness/Variant	Weakness/Base	3

Status Changes

From	To	Total
Unchanged		718
Draft	Deprecated	1
Draft	Usable	4
Incomplete	Deprecated	4
Incomplete	Draft	7

Relationship Changes

The "Version 2.0 Total" lists the total number of relationships in Version 2.0. The "Shared" value is the total number of relationships in entries that were in both Version 2.0 and Version 1.0. The "New" value is the total number of relationships involving entries that did not exist in Version 1.0. Thus, the total number of relationships in Version 2.0 would combine stats from Shared entries and New entries.

Relationship	Version 2.0 Total	Version 1.0 Total	Version 2.0 Shared	Unchanged	Added to Version 2.0	Removed from Version 1.0	Version 2.0 New
ALL	5487	3994	4021	3651	370	343	1466
ChildOf	2367	1694	1712	1559	153	135	655
ParentOf	2367	1694	1712	1559	153	135	655
MemberOf	140	96	88	88		8	52
HasMember	140	96	88	88		8	52
CanPrecede	113	65	89	60	29	5	24
CanFollow	113	65	89	60	29	5	24
StartsWith	3	3	3	3
Requires	19	27	19	19		8
RequiredBy	19	27	19	19		8
CanAlsoBe	34	39	34	34		5
PeerOf	172	188	168	162	6	26	4

Nodes Removed from Version 1.0

CWE-ID	CWE Name
None.

Nodes Added to Version 2.0

CWE-ID	CWE Name
733	Compiler Optimization Removal or Modification of Security-critical Code
734	Weaknesses Addressed by the CERT C Secure Coding Standard
735	CERT C Secure Coding Section 01 - Preprocessor (PRE)
736	CERT C Secure Coding Section 02 - Declarations and Initialization (DCL)
737	CERT C Secure Coding Section 03 - Expressions (EXP)
738	CERT C Secure Coding Section 04 - Integers (INT)
739	CERT C Secure Coding Section 05 - Floating Point (FLP)
740	CERT C Secure Coding Section 06 - Arrays (ARR)
741	CERT C Secure Coding Section 07 - Characters and Strings (STR)
742	CERT C Secure Coding Section 08 - Memory Management (MEM)
743	CERT C Secure Coding Section 09 - Input Output (FIO)
744	CERT C Secure Coding Section 10 - Environment (ENV)
745	CERT C Secure Coding Section 11 - Signals (SIG)
746	CERT C Secure Coding Section 12 - Error Handling (ERR)
747	CERT C Secure Coding Section 49 - Miscellaneous (MSC)
748	CERT C Secure Coding Section 50 - POSIX (POS)
749	Exposed Dangerous Method or Function
750	Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors
751	2009 Top 25 - Insecure Interaction Between Components
752	2009 Top 25 - Risky Resource Management
753	2009 Top 25 - Porous Defenses
754	Improper Check for Unusual or Exceptional Conditions
755	Improper Handling of Exceptional Conditions
756	Missing Custom Error Page
757	Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
758	Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
759	Use of a One-Way Hash without a Salt
760	Use of a One-Way Hash with a Predictable Salt
761	Free of Pointer not at Start of Buffer
762	Mismatched Memory Management Routines
763	Release of Invalid Pointer or Reference
764	Multiple Locks of a Critical Resource
765	Multiple Unlocks of a Critical Resource
766	Critical Variable Declared Public
767	Access to Critical Private Variable via Public Method
768	Incorrect Short Circuit Evaluation
769	File Descriptor Exhaustion
770	Allocation of Resources Without Limits or Throttling
771	Missing Reference to Active Allocated Resource
772	Missing Release of Resource after Effective Lifetime
773	Missing Reference to Active File Descriptor or Handle
774	Allocation of File Descriptors or Handles Without Limits or Throttling
775	Missing Release of File Descriptor or Handle after Effective Lifetime
776	Unrestricted Recursive Entity References in DTDs ('XML Bomb')
777	Regular Expression without Anchors
778	Insufficient Logging
779	Logging of Excessive Data
780	Use of RSA Algorithm without OAEP
781	Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code
782	Exposed IOCTL with Insufficient Access Control
783	Operator Precedence Logic Error
784	Reliance on Cookies without Validation and Integrity Checking in a Security Decision
785	Use of Path Manipulation Function without Maximum-sized Buffer
786	Access of Memory Location Before Start of Buffer
787	Out-of-bounds Write
788	Access of Memory Location After End of Buffer
789	Uncontrolled Memory Allocation
790	Improper Filtering of Special Elements
791	Incomplete Filtering of Special Elements
792	Incomplete Filtering of One or More Instances of Special Elements
793	Only Filtering One Instance of a Special Element
794	Incomplete Filtering of Multiple Instances of Special Elements
795	Only Filtering Special Elements at a Specified Location
796	Only Filtering Special Elements Relative to a Marker
797	Only Filtering Special Elements at an Absolute Position
798	Use of Hard-coded Credentials
799	Improper Control of Interaction Frequency
800	Weaknesses in the 2010 CWE/SANS Top 25 Most Dangerous Programming Errors
801	2010 Top 25 - Insecure Interaction Between Components
802	2010 Top 25 - Risky Resource Management
803	2010 Top 25 - Porous Defenses
804	Guessable CAPTCHA
805	Buffer Access with Incorrect Length Value
806	Buffer Access Using Size of Source Buffer
807	Reliance on Untrusted Inputs in a Security Decision
808	2010 Top 25 - Weaknesses On the Cusp
809	Weaknesses in OWASP Top Ten (2010)
810	OWASP Top Ten 2010 Category A1 - Injection
811	OWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS)
812	OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management
813	OWASP Top Ten 2010 Category A4 - Insecure Direct Object References
814	OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF)
815	OWASP Top Ten 2010 Category A6 - Security Misconfiguration
816	OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage
817	OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access
818	OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection
819	OWASP Top Ten 2010 Category A10 - Unvalidated Redirects and Forwards
820	Missing Synchronization
821	Incorrect Synchronization
822	Untrusted Pointer Dereference
823	Use of Out-of-range Pointer Offset
824	Access of Uninitialized Pointer
825	Expired Pointer Dereference
826	Premature Release of Resource During Expected Lifetime
827	Improper Control of Document Type Definition
828	Signal Handler with Functionality that is not Asynchronous-Safe
829	Inclusion of Functionality from Untrusted Control Sphere
830	Inclusion of Web Functionality from an Untrusted Source
831	Signal Handler Function Associated with Multiple Signals
832	Unlock of a Resource that is not Locked
833	Deadlock
834	Excessive Iteration
835	Loop with Unreachable Exit Condition ('Infinite Loop')
836	Use of Password Hash Instead of Password for Authentication
837	Improper Enforcement of a Single, Unique Action
838	Inappropriate Encoding for Output Context
839	Numeric Range Comparison Without Minimum Check
840	Business Logic Errors
841	Improper Enforcement of Behavioral Workflow
842	Placement of User into Incorrect Group
843	Access of Resource Using Incompatible Type ('Type Confusion')
844	Weaknesses Addressed by the CERT Java Secure Coding Standard
845	CERT Java Secure Coding Section 00 - Input Validation and Data Sanitization (IDS)
846	CERT Java Secure Coding Section 01 - Declarations and Initialization (DCL)
847	CERT Java Secure Coding Section 02 - Expressions (EXP)
848	CERT Java Secure Coding Section 03 - Numeric Types and Operations (NUM)
849	CERT Java Secure Coding Section 04 - Object Orientation (OBJ)
850	CERT Java Secure Coding Section 05 - Methods (MET)
851	CERT Java Secure Coding Section 06 - Exceptional Behavior (ERR)
852	CERT Java Secure Coding Section 07 - Visibility and Atomicity (VNA)
853	CERT Java Secure Coding Section 08 - Locking (LCK)
854	CERT Java Secure Coding Section 09 - Thread APIs (THI)
855	CERT Java Secure Coding Section 10 - Thread Pools (TPS)
856	CERT Java Secure Coding Section 11 - Thread-Safety Miscellaneous (TSM)
857	CERT Java Secure Coding Section 12 - Input Output (FIO)
858	CERT Java Secure Coding Section 13 - Serialization (SER)
859	CERT Java Secure Coding Section 14 - Platform Security (SEC)
860	CERT Java Secure Coding Section 15 - Runtime Environment (ENV)
861	CERT Java Secure Coding Section 49 - Miscellaneous (MSC)
862	Missing Authorization
863	Incorrect Authorization
864	2011 Top 25 - Insecure Interaction Between Components
865	2011 Top 25 - Risky Resource Management
866	2011 Top 25 - Porous Defenses
867	2011 Top 25 - Weaknesses On the Cusp
900	Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors

Nodes Deprecated in Version 2.0

CWE-ID	CWE Name
92	DEPRECATED: Improper Sanitization of Custom Special Characters
217	DEPRECATED: Failure to Protect Stored Data from Modification
249	DEPRECATED: Often Misused: Path Manipulation
373	DEPRECATED: State Synchronization Error
423	DEPRECATED (Duplicate): Proxied Trusted Channel

Important Changes

A node change is labeled "important" if it is a major field change and the field is critical to the meaning of the node. The critical fields are description, name, and relationships.

Key
D	Description
N	Name
R	Relationships

D			6	J2EE Misconfiguration: Insufficient Session-ID Length
D	N	R	7	J2EE Misconfiguration: Missing Custom Error Page
		R	9	J2EE Misconfiguration: Weak Access Permissions for EJB Methods
D			11	ASP.NET Misconfiguration: Creating Debug Binary
	N	R	12	ASP.NET Misconfiguration: Missing Custom Error Page
D		R	14	Compiler Removal of Code to Clear Buffers
D		R	15	External Control of System or Configuration Setting
D	N	R	20	Improper Input Validation
D			21	Pathname Traversal and Equivalence Errors
D	N	R	22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
D			23	Relative Path Traversal
D			24	Path Traversal: '../filedir'
D			25	Path Traversal: '/../filedir'
D			26	Path Traversal: '/dir/../filename'
D			27	Path Traversal: 'dir/../../filename'
D	N		28	Path Traversal: '..\filedir'
D			29	Path Traversal: '\..\filename'
D			30	Path Traversal: '\dir\..\filename'
D			31	Path Traversal: 'dir\..\..\filename'
D			32	Path Traversal: '...' (Triple Dot)
D			33	Path Traversal: '....' (Multiple Dot)
D		R	34	Path Traversal: '....//'
D		R	35	Path Traversal: '.../...//'
D		R	36	Absolute Path Traversal
		R	37	Path Traversal: '/absolute/pathname/here'
		R	38	Path Traversal: '\absolute\pathname\here'
		R	39	Path Traversal: 'C:dirname'
D	N	R	41	Improper Resolution of Path Equivalence
		R	45	Path Equivalence: 'file...name' (Multiple Internal Dot)
D	N		57	Path Equivalence: 'fakedir/../realdir/filename'
D			58	Path Equivalence: Windows 8.3 Filename
D	N	R	59	Improper Link Resolution Before File Access ('Link Following')
D			61	UNIX Symbolic Link (Symlink) Following
D		R	62	UNIX Hard Link
D		R	64	Windows Shortcut Following (.LNK)
D		R	65	Windows Hard Link
D	N		66	Improper Handling of File Names that Identify Virtual Resources
D	N	R	67	Improper Handling of Windows Device Names
D	N		69	Improper Handling of Windows ::DATA Alternate Data Stream
D	N		72	Improper Handling of Apple HFS+ Alternate Data Stream Path
D		R	73	External Control of File Name or Path
D	N	R	74	Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
D			75	Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
D	N		76	Improper Neutralization of Equivalent Special Elements
D	N	R	77	Improper Neutralization of Special Elements used in a Command ('Command Injection')
D	N	R	78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
D	N	R	79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
D	N		80	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
D	N		81	Improper Neutralization of Script in an Error Message Web Page
D	N	R	82	Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
D	N	R	83	Improper Neutralization of Script in Attributes in a Web Page
D	N		84	Improper Neutralization of Encoded URI Schemes in a Web Page
D			85	Doubled Character XSS Manipulations
D	N		86	Improper Neutralization of Invalid Characters in Identifiers in Web Pages
D	N		87	Improper Neutralization of Alternate XSS Syntax
		R	88	Argument Injection or Modification
D	N	R	89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
D	N	R	90	Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
D		R	91	XML Injection (aka Blind XPath Injection)
D	N	R	92	DEPRECATED: Improper Sanitization of Custom Special Characters
D	N		93	Improper Neutralization of CRLF Sequences ('CRLF Injection')
D	N	R	94	Improper Control of Generation of Code ('Code Injection')
D	N		95	Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
D	N		96	Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
D	N		97	Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
D	N	R	98	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP File Inclusion')
D	N		99	Improper Control of Resource Identifiers ('Resource Injection')
		R	100	Technology-Specific Input Validation Problems
D		R	102	Struts: Duplicate Validation Forms
D		R	103	Struts: Incomplete validate() Method Definition
		R	104	Struts: Form Bean Does Not Extend Validation Class
		R	106	Struts: Plug-in Framework not in Use
D			108	Struts: Unvalidated Action Form
		R	109	Struts: Validator Turned Off
D			110	Struts: Validator Without Form Field
D		R	111	Direct Use of Unsafe JNI
D			112	Missing XML Validation
D	N		113	Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
D			114	Process Control
		R	115	Misinterpretation of Input
D	N	R	116	Improper Encoding or Escaping of Output
D	N	R	117	Improper Output Neutralization for Logs
D	N	R	118	Improper Access of Indexable Resource ('Range Error')
D	N	R	119	Improper Restriction of Operations within the Bounds of a Memory Buffer
D	N	R	120	Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
		R	121	Stack-based Buffer Overflow
		R	122	Heap-based Buffer Overflow
		R	123	Write-what-where Condition
D	N	R	124	Buffer Underwrite ('Buffer Underflow')
D		R	125	Out-of-bounds Read
D		R	126	Buffer Over-read
D		R	127	Buffer Under-read
		R	128	Wrap-around Error
D	N	R	129	Improper Validation of Array Index
D	N	R	130	Improper Handling of Length Parameter Inconsistency
		R	131	Incorrect Calculation of Buffer Size
		R	132	DEPRECATED (Duplicate): Miscalculated Null Termination
		R	134	Uncontrolled Format String
D		R	135	Incorrect Calculation of Multi-Byte String Length
D	N	R	138	Improper Neutralization of Special Elements
D		R	139	DEPRECATED: General Special Element Problems
D	N		140	Improper Neutralization of Delimiters
D	N		141	Improper Neutralization of Parameter/Argument Delimiters
D	N		142	Improper Neutralization of Value Delimiters
D	N		143	Improper Neutralization of Record Delimiters
D	N	R	144	Improper Neutralization of Line Delimiters
D	N		145	Improper Neutralization of Section Delimiters
D	N		146	Improper Neutralization of Expression/Command Delimiters
D	N		147	Improper Neutralization of Input Terminators
	N		148	Improper Neutralization of Input Leaders
	N		149	Improper Neutralization of Quoting Syntax
D	N	R	150	Improper Neutralization of Escape, Meta, or Control Sequences
D	N		151	Improper Neutralization of Comment Delimiters
D	N		152	Improper Neutralization of Macro Symbols
D	N		153	Improper Neutralization of Substitution Characters
D	N		154	Improper Neutralization of Variable Name Delimiters
D	N		155	Improper Neutralization of Wildcards or Matching Symbols
D	N		156	Improper Neutralization of Whitespace
D	N		158	Improper Neutralization of Null Byte or NUL Character
D			159	Failure to Sanitize Special Element
D	N		160	Improper Neutralization of Leading Special Elements
D	N		161	Improper Neutralization of Multiple Leading Special Elements
D	N		162	Improper Neutralization of Trailing Special Elements
D	N	R	163	Improper Neutralization of Multiple Trailing Special Elements
D	N		164	Improper Neutralization of Internal Special Elements
D	N	R	165	Improper Neutralization of Multiple Internal Special Elements
D	N	R	166	Improper Handling of Missing Special Element
D	N	R	167	Improper Handling of Additional Special Element
D	N	R	168	Improper Handling of Inconsistent Special Elements
D		R	170	Improper Null Termination
D		R	171	Cleansing, Canonicalization, and Comparison Errors
D			172	Encoding Error
	N		173	Improper Handling of Alternate Encoding
	N		175	Improper Handling of Mixed Encoding
	N	R	176	Improper Handling of Unicode Encoding
	N		177	Improper Handling of URL Encoding (Hex Encoding)
D	N		178	Improper Handling of Case Sensitivity
D		R	179	Incorrect Behavior Order: Early Validation
D		R	180	Incorrect Behavior Order: Validate Before Canonicalize
D			181	Incorrect Behavior Order: Validate Before Filter
D		R	182	Collapse of Data into Unsafe Value
		R	183	Permissive Whitelist
D		R	184	Incomplete Blacklist
D			185	Incorrect Regular Expression
		R	187	Partial Comparison
		R	188	Reliance on Data/Memory Layout
		R	189	Numeric Errors
D	N	R	190	Integer Overflow or Wraparound
D			191	Integer Underflow (Wrap or Wraparound)
D		R	192	Integer Coercion Error
		R	193	Off-by-one Error
D	N	R	194	Unexpected Sign Extension
D		R	195	Signed to Unsigned Conversion Error
D		R	197	Numeric Truncation Error
D		R	198	Use of Incorrect Byte Ordering
		R	199	Information Management Errors
D	N	R	200	Information Exposure
D	N		201	Information Exposure Through Sent Data
	N		202	Exposure of Sensitive Data Through Data Queries
D	N		203	Information Exposure Through Discrepancy
D	N		204	Response Discrepancy Information Exposure
D	N		205	Information Exposure Through Behavioral Discrepancy
	N		206	Information Exposure of Internal State Through Behavioral Inconsistency
D	N		207	Information Exposure Through an External Behavioral Inconsistency
D	N	R	208	Information Exposure Through Timing Discrepancy
D	N	R	209	Information Exposure Through an Error Message
	N	R	210	Information Exposure Through Generated Error Message
D	N		211	Information Exposure Through External Error Message
D	N	R	212	Improper Cross-boundary Removal of Sensitive Data
	N		213	Intentional Information Exposure
D	N		214	Information Exposure Through Process Environment
D	N	R	215	Information Exposure Through Debug Information
		R	216	Containment Errors (Container Errors)
D	N	R	217	DEPRECATED: Failure to Protect Stored Data from Modification
		R	218	DEPRECATED (Duplicate): Failure to provide confidentiality for stored data
		R	219	Sensitive Data Under Web Root
		R	223	Omission of Security-relevant Information
		R	225	DEPRECATED (Duplicate): General Information Management Problems
D		R	226	Sensitive Information Uncleared Before Release
D	N	R	227	Improper Fulfillment of API Contract ('API Abuse')
D	N		228	Improper Handling of Syntactically Invalid Structure
D			229	Improper Handling of Values
D	N	R	230	Improper Handling of Missing Values
D	N		231	Improper Handling of Extra Values
D	N	R	232	Improper Handling of Undefined Values
D	N		235	Improper Handling of Extra Parameters
D	N		236	Improper Handling of Undefined Parameters
D	N		237	Improper Handling of Structural Elements
D	N		238	Improper Handling of Incomplete Structural Elements
D			239	Failure to Handle Incomplete Element
D	N		240	Improper Handling of Inconsistent Structural Elements
D	N	R	241	Improper Handling of Unexpected Data Type
D		R	242	Use of Inherently Dangerous Function
D	N		243	Creation of chroot Jail Without Changing Working Directory
D	N	R	244	Improper Clearing of Heap Memory Before Release ('Heap Inspection')
		R	247	Reliance on DNS Lookups in a Security Decision
D		R	248	Uncaught Exception
D	N	R	249	DEPRECATED: Often Misused: Path Manipulation
D	N	R	250	Execution with Unnecessary Privileges
D		R	252	Unchecked Return Value
D	N	R	253	Incorrect Check of Function Return Value
		R	254	Security Features
		R	255	Credentials Management
		R	256	Plaintext Storage of a Password
D		R	257	Storing Passwords in a Recoverable Format
D	N	R	259	Use of Hard-coded Password
D			260	Password in Configuration File
		R	261	Weak Cryptography for Passwords
		R	262	Not Using Password Aging
D		R	263	Password Aging with Long Expiration
		R	264	Permissions, Privileges, and Access Controls
D		R	265	Privilege / Sandbox Issues
		R	266	Incorrect Privilege Assignment
		R	267	Privilege Defined With Unsafe Actions
		R	268	Privilege Chaining
D	N	R	269	Improper Privilege Management
D		R	271	Privilege Dropping / Lowering Errors
		R	272	Least Privilege Violation
D	N	R	273	Improper Check for Dropped Privileges
D	N		274	Improper Handling of Insufficient Privileges
		R	275	Permission Issues
D	N	R	276	Incorrect Default Permissions
D	N	R	279	Incorrect Execution-Assigned Permissions
D	N		280	Improper Handling of Insufficient Permissions or Privileges
D	N		281	Improper Preservation of Permissions
		R	282	Improper Ownership Management
		R	283	Unverified Ownership
D	N	R	284	Improper Access Control
D	N	R	285	Improper Authorization
		R	286	Incorrect User Management
D	N	R	287	Improper Authentication
		R	288	Authentication Bypass Using an Alternate Path or Channel
		R	289	Authentication Bypass by Alternate Name
D			291	Trusting Self-reported IP Address
D			294	Authentication Bypass by Capture-replay
D			295	Certificate Issues
D	N	R	296	Improper Following of Chain of Trust for Certificate Validation
D	N	R	297	Improper Validation of Host-specific Certificate Data
D	N	R	298	Improper Validation of Certificate Expiration
D	N	R	299	Improper Check for Certificate Revocation
D	N	R	300	Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
D		R	302	Authentication Bypass by Assumed-Immutable Data
D	N		303	Incorrect Implementation of Authentication Algorithm
D		R	304	Missing Critical Step in Authentication
	N	R	306	Missing Authentication for Critical Function
	N	R	307	Improper Restriction of Excessive Authentication Attempts
D			308	Use of Single-factor Authentication
		R	310	Cryptographic Issues
D	N	R	311	Missing Encryption of Sensitive Data
D	N	R	312	Cleartext Storage of Sensitive Information
D	N	R	319	Cleartext Transmission of Sensitive Information
		R	321	Use of Hard-coded Cryptographic Key
D		R	322	Key Exchange without Entity Authentication
D	N	R	326	Inadequate Encryption Strength
D		R	327	Use of a Broken or Risky Cryptographic Algorithm
D		R	328	Reversible One-Way Hash
D		R	330	Use of Insufficiently Random Values
		R	332	Insufficient Entropy in PRNG
D	N	R	333	Improper Handling of Insufficient Entropy in TRNG
		R	336	Same Seed in PRNG
		R	337	Predictable Seed in PRNG
D			343	Predictable Value Range from Previous Values
		R	344	Use of Invariant Value in Dynamically Changing Context
D	N	R	347	Improper Verification of Cryptographic Signature
		R	349	Acceptance of Extraneous Untrusted Data With Trusted Data
		R	350	Improperly Trusted Reverse DNS
		R	351	Insufficient Type Distinction
D		R	352	Cross-Site Request Forgery (CSRF)
D	N		353	Missing Support for Integrity Check
D	N	R	354	Improper Validation of Integrity Check Value
D			356	Product UI does not Warn User of Unsafe Actions
D			357	Insufficient UI Warning of Dangerous Operations
D		R	358	Improperly Implemented Security Check for Standard
		R	359	Privacy Violation
D			360	Trust of System Event Data
D		R	361	Time and State
D	N	R	362	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
D		R	363	Race Condition Enabling Link Following
D		R	364	Signal Handler Race Condition
		R	365	Race Condition in Switch
		R	366	Race Condition within a Thread
D	N	R	367	Time-of-check Time-of-use (TOCTOU) Race Condition
D			368	Context Switching Race Condition
		R	369	Divide By Zero
D	N	R	370	Missing Check for Certificate Revocation after Initial Check
		R	371	State Issues
D	N	R	373	DEPRECATED: State Synchronization Error
	N	R	374	Passing Mutable Objects to an Untrusted Method
	N	R	375	Returning a Mutable Object to an Untrusted Caller
		R	377	Insecure Temporary File
D	N	R	379	Creation of Temporary File in Directory with Incorrect Permissions
		R	381	J2EE Time and State Issues
		R	382	J2EE Bad Practices: Use of System.exit()
D		R	383	J2EE Bad Practices: Direct Use of Threads
D			385	Covert Timing Channel
D		R	388	Error Handling
D			389	Error Conditions, Return Values, Status Codes
D		R	390	Detection of Error Condition Without Action
		R	391	Unchecked Error Condition
D	N	R	392	Missing Report of Error Condition
D		R	393	Return of Wrong Status Code
		R	394	Unexpected Status Code or Return Value
		R	395	Use of NullPointerException Catch to Detect NULL Pointer Dereference
D		R	396	Declaration of Catch for Generic Exception
D		R	397	Declaration of Throws for Generic Exception
		R	398	Indicator of Poor Code Quality
		R	399	Resource Management Errors
D	N	R	400	Uncontrolled Resource Consumption ('Resource Exhaustion')
D	N	R	401	Improper Release of Memory Before Removing Last Reference ('Memory Leak')
	N		402	Transmission of Private Resources into a New Sphere ('Resource Leak')
	N	R	403	Exposure of File Descriptor to Unintended Control Sphere
D		R	404	Improper Resource Shutdown or Release
D		R	405	Asymmetric Resource Consumption (Amplification)
D	N		406	Insufficient Control of Network Message Volume (Network Amplification)
D		R	408	Incorrect Behavior Order: Early Amplification
D	N	R	409	Improper Handling of Highly Compressed Data (Data Amplification)
D		R	410	Insufficient Resource Pool
D	N	R	412	Unrestricted Externally Accessible Lock
D	N	R	413	Improper Resource Locking
		R	415	Double Free
D		R	416	Use After Free
		R	418	Channel Errors
D			421	Race Condition During Access to Alternate Channel
D	N	R	423	DEPRECATED (Duplicate): Proxied Trusted Channel
	N		424	Improper Protection of Alternate Path
D		R	425	Direct Request ('Forced Browsing')
D		R	426	Untrusted Search Path
D		R	427	Uncontrolled Search Path Element
D		R	428	Unquoted Search Path or Element
D			430	Deployment of Wrong Handler
D			431	Missing Handler
D	N	R	432	Dangerous Signal Handler not Disabled During Sensitive Operations
D			433	Unparsed Raw Web Content Delivery
	N	R	434	Unrestricted Upload of File with Dangerous Type
D		R	435	Interaction Error
D		R	436	Interpretation Conflict
D			437	Incomplete Model of Endpoint Features
		R	438	Behavioral Problems
		R	441	Unintended Proxy/Intermediary
		R	442	Web Problems
		R	443	DEPRECATED (Duplicate): HTTP response splitting
	N		444	Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
D			446	UI Discrepancy for Security Feature
D	N	R	454	External Initialization of Trusted Variables or Data Stores
		R	456	Missing Initialization
		R	458	DEPRECATED: Incorrect Initialization
		R	459	Incomplete Cleanup
D		R	460	Improper Cleanup on Thrown Exception
D		R	462	Duplicate Key in Associative List (Alist)
D			463	Deletion of Data Structure Sentinel
D		R	464	Addition of Data Structure Sentinel
		R	465	Pointer Issues
		R	466	Return of Pointer Value Outside of Expected Range
		R	467	Use of sizeof() on a Pointer Type
		R	468	Incorrect Pointer Scaling
		R	469	Use of Pointer Subtraction to Determine Size
D	N	R	470	Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
D		R	472	External Control of Assumed-Immutable Web Parameter
		R	473	PHP External Variable Modification
D		R	476	NULL Pointer Dereference
D	N		478	Missing Default Case in Switch Statement
D	N	R	479	Signal Handler Use of a Non-reentrant Function
		R	480	Use of Incorrect Operator
D			481	Assigning instead of Comparing
		R	482	Comparing instead of Assigning
D			483	Incorrect Block Delimitation
D	N	R	484	Omitted Break Statement in Switch
		R	485	Insufficient Encapsulation
		R	486	Comparison of Classes by Name
		R	487	Reliance on Package-level Scope
D	N	R	488	Exposure of Data Element to Wrong Session
	N	R	491	Public cloneable() Method Without Final ('Object Hijack')
		R	492	Use of Inner Class Containing Sensitive Data
D		R	493	Critical Public Variable Without Final Modifier
D	N	R	494	Download of Code Without Integrity Check
D	N	R	497	Exposure of System Data to an Unauthorized Control Sphere
D	N	R	498	Cloneable Class Containing Sensitive Information
		R	499	Serializable Class Containing Sensitive Data
D	N	R	500	Public Static Field Not Marked Final
D		R	502	Deserialization of Untrusted Data
D			506	Embedded Malicious Code
D			507	Trojan Horse
D			511	Logic/Time Bomb
D			512	Spyware
		R	513	Intentionally Introduced Nonmalicious Weakness
D		R	514	Covert Channel
D			515	Covert Storage Channel
		R	516	DEPRECATED (Duplicate): Covert Timing Channel
D		R	518	Inadvertently Introduced Weakness
		R	521	Weak Password Requirements
		R	522	Insufficiently Protected Credentials
	N	R	524	Information Exposure Through Caching
	N		525	Information Exposure Through Browser Caching
	N	R	526	Information Exposure Through Environmental Variables
D	N	R	527	Exposure of CVS Repository to an Unauthorized Control Sphere
D	N	R	528	Exposure of Core Dump File to an Unauthorized Control Sphere
D	N	R	529	Exposure of Access Control List Files to an Unauthorized Control Sphere
D	N	R	530	Exposure of Backup File to an Unauthorized Control Sphere
	N	R	531	Information Exposure Through Test Code
D	N	R	532	Information Exposure Through Log Files
	N	R	533	Information Exposure Through Server Log Files
	N	R	534	Information Exposure Through Debug Log Files
	N		535	Information Exposure Through Shell Error Message
	N		536	Information Exposure Through Servlet Runtime Error Message
	N		537	Information Exposure Through Java Runtime Error Message
D	N	R	538	File and Directory Information Exposure
D	N	R	539	Information Exposure Through Persistent Cookies
D	N	R	540	Information Exposure Through Source Code
	N	R	541	Information Exposure Through Include Source Code
D	N	R	542	Information Exposure Through Cleanup Log Files
D	N	R	543	Use of Singleton Pattern Without Synchronization in a Multithreaded Context
D	N	R	544	Missing Standardized Error Handling Mechanism
D		R	547	Use of Hard-coded, Security-relevant Constants
D	N		548	Information Exposure Through Directory Listing
D		R	549	Missing Password Field Masking
D	N	R	550	Information Exposure Through Server Error Message
D		R	551	Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
		R	552	Files or Directories Accessible to External Parties
D			554	ASP.NET Misconfiguration: Not Using Input Validation Framework
D			555	J2EE Misconfiguration: Plaintext Password in Configuration File
D		R	556	ASP.NET Misconfiguration: Use of Identity Impersonation
		R	561	Dead Code
		R	562	Return of Stack Variable Address
		R	563	Unused Variable
D	N	R	565	Reliance on Cookies without Validation and Integrity Checking
D	N		566	Authorization Bypass Through User-Controlled SQL Primary Key
D	N	R	567	Unsynchronized Access to Shared Data in a Multithreaded Context
D		R	568	finalize() Method Without super.finalize()
		R	569	Expression Issues
		R	570	Expression is Always False
		R	571	Expression is Always True
D		R	572	Call to Thread run() instead of start()
D	N	R	573	Improper Following of Specification by Caller
D		R	574	EJB Bad Practices: Use of Synchronization Primitives
D			575	EJB Bad Practices: Use of AWT Swing
D			576	EJB Bad Practices: Use of Java I/O
D			577	EJB Bad Practices: Use of Sockets
D			578	EJB Bad Practices: Use of Class Loader
D			580	clone() Method Without super.clone()
D		R	581	Object Model Violation: Just One of Equals and Hashcode Defined
D		R	582	Array Declared Public, Final, and Static
D		R	583	finalize() Method Declared Public
		R	584	Return Inside Finally Block
D			585	Empty Synchronized Block
D		R	586	Explicit Call to Finalize()
D		R	587	Assignment of a Fixed Address to a Pointer
		R	588	Attempt to Access Child of a Non-structure Pointer
D		R	589	Call to Non-ubiquitous API
D	N	R	590	Free of Memory not on the Heap
D		R	591	Sensitive Data Storage in Improperly Locked Memory
D			593	Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
	N	R	595	Comparison of Object References Instead of Object Contents
		R	596	Incorrect Semantic Object Comparison
D		R	597	Use of Wrong Operator in String Comparison
	N	R	598	Information Exposure Through Query Strings in GET Request
D			599	Trust of OpenSSL Certificate Without Validation
D	N	R	600	Uncaught Exception in Servlet
	N	R	601	URL Redirection to Untrusted Site ('Open Redirect')
D	N	R	602	Client-Side Enforcement of Server-Side Security
	N	R	604	Deprecated Entries
		R	606	Unchecked Input for Loop Condition
		R	607	Public Static Final Field References Mutable Object
		R	609	Double-Checked Locking
	N		611	Information Exposure Through XML External Entity Reference
	N		612	Information Exposure Through Indexing of Private Data
		R	613	Insufficient Session Expiration
D	N		615	Information Exposure Through Comments
D			616	Incomplete Identification of Uploaded File Variables (PHP)
D		R	618	Exposed Unsafe ActiveX Method
D	N	R	619	Dangling Database Cursor ('Cursor Injection')
D			621	Variable Extraction Error
		R	622	Unvalidated Function Hook Arguments
D			624	Executable Regular Expression Error
D		R	625	Permissive Regular Expression
D			627	Dynamic Variable Evaluation
D		R	628	Function Call with Incorrectly Specified Arguments
		R	632	Weaknesses that Affect Files or Directories
		R	633	Weaknesses that Affect Memory
D	N	R	636	Not Failing Securely ('Failing Open')
D	N		637	Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
D	N	R	638	Not Using Complete Mediation
D	N	R	639	Authorization Bypass Through User-Controlled Key
		R	640	Weak Password Recovery Mechanism for Forgotten Password
D	N		641	Improper Restriction of Names for Files and Other Resources
D	N	R	642	External Control of Critical State Data
D	N		643	Improper Neutralization of Data within XPath Expressions ('XPath Injection')
D	N	R	644	Improper Neutralization of HTTP Headers for Scripting Syntax
D			645	Overly Restrictive Account Lockout Mechanism
D	N	R	646	Reliance on File Name or Extension of Externally-Supplied File
D	N	R	647	Use of Non-Canonical URL Paths for Authorization Decisions
D	N		648	Incorrect Use of Privileged APIs
D			649	Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
D			650	Trusting HTTP Permission Methods on the Server Side
D	N		651	Information Exposure Through WSDL File
D	N		652	Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
	N		653	Insufficient Compartmentalization
D	N	R	654	Reliance on a Single Factor in a Security Decision
D	N		655	Insufficient Psychological Acceptability
D	N		656	Reliance on Security Through Obscurity
D	N	R	662	Improper Synchronization
D	N	R	663	Use of a Non-reentrant Function in a Concurrent Context
D	N	R	664	Improper Control of a Resource Through its Lifetime
D	N	R	665	Improper Initialization
		R	666	Operation on Resource in Wrong Phase of Lifetime
D	N	R	667	Improper Locking
D		R	668	Exposure of Resource to Wrong Sphere
		R	669	Incorrect Resource Transfer Between Spheres
		R	670	Always-Incorrect Control Flow Implementation
D	N	R	671	Lack of Administrator Control over Security
D	N	R	672	Operation on a Resource after Expiration or Release
		R	674	Uncontrolled Recursion
		R	675	Duplicate Operations on Resource
		R	676	Use of Potentially Dangerous Function
D		R	681	Incorrect Conversion between Numeric Types
D		R	682	Incorrect Calculation
D	N	R	684	Incorrect Provision of Specified Functionality
D			685	Function Call With Incorrect Number of Arguments
D		R	686	Function Call With Incorrect Argument Type
D		R	687	Function Call With Incorrectly Specified Argument Value
D			688	Function Call With Incorrect Variable or Reference as Argument
		R	689	Permission Race Condition During Resource Copy
		R	690	Unchecked Return Value to NULL Pointer Dereference
		R	691	Insufficient Control Flow Management
D		R	693	Protection Mechanism Failure
D		R	696	Incorrect Behavior Order
D		R	697	Insufficient Comparison
	N	R	703	Improper Check or Handling of Exceptional Conditions
D		R	704	Incorrect Type Conversion or Cast
		R	705	Incorrect Control Flow Scoping
		R	706	Use of Incorrectly-Resolved Name or Reference
D	N	R	707	Improper Enforcement of Message or Data Structure
D		R	708	Incorrect Ownership Assignment
		R	710	Coding Standards Violation
		R	715	OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference
		R	722	OWASP Top Ten 2004 Category A1 - Unvalidated Input
		R	723	OWASP Top Ten 2004 Category A2 - Broken Access Control
		R	724	OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management
		R	725	OWASP Top Ten 2004 Category A4 - Cross-Site Scripting (XSS) Flaws
		R	726	OWASP Top Ten 2004 Category A5 - Buffer Overflows
		R	727	OWASP Top Ten 2004 Category A6 - Injection Flaws
		R	728	OWASP Top Ten 2004 Category A7 - Improper Error Handling
		R	729	OWASP Top Ten 2004 Category A8 - Insecure Storage
		R	731	OWASP Top Ten 2004 Category A10 - Insecure Configuration Management
D	N	R	732	Incorrect Permission Assignment for Critical Resource
		R	1000	Research Concepts

Detailed Difference Report

5	J2EE Misconfiguration: Data Transmission Without Encryption
	Major	Common_Consequences, Other_Notes
	Minor	None
6	J2EE Misconfiguration: Insufficient Session-ID Length
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Enabling_Factors_for_Exploitation, Other_Notes, Potential_Mitigations, References
	Minor	None
7	J2EE Misconfiguration: Missing Custom Error Page
	Major	Common_Consequences, Description, Name, Relationships
	Minor	None
8	J2EE Misconfiguration: Entity Bean Declared Remote
	Major	Common_Consequences, Demonstrative_Examples
	Minor	None
9	J2EE Misconfiguration: Weak Access Permissions for EJB Methods
	Major	Common_Consequences, Demonstrative_Examples, Relationships
	Minor	None
11	ASP.NET Misconfiguration: Creating Debug Binary
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Other_Notes
	Minor	None
12	ASP.NET Misconfiguration: Missing Custom Error Page
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Name, Other_Notes, Potential_Mitigations, Relationships
	Minor	None
13	ASP.NET Misconfiguration: Password in Configuration File
	Major	Common_Consequences, Demonstrative_Examples
	Minor	Potential_Mitigations
14	Compiler Removal of Code to Clear Buffers
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Other_Notes, Potential_Mitigations, References, Relationships, Taxonomy_Mappings, Time_of_Introduction
	Minor	None
15	External Control of System or Configuration Setting
	Major	Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction, Other_Notes, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
16	Configuration
	Major	Taxonomy_Mappings
	Minor	None
20	Improper Input Validation
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Maintenance_Notes, Modes_of_Introduction, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationship_Notes, Relationships, Research_Gaps, Taxonomy_Mappings, Terminology_Notes
	Minor	None
21	Pathname Traversal and Equivalence Errors
	Major	Description
	Minor	None
22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationship_Notes, Relationships, Research_Gaps, Taxonomy_Mappings, Terminology_Notes, Time_of_Introduction, Weakness_Ordinalities
	Minor	None
23	Relative Path Traversal
	Major	Common_Consequences, Demonstrative_Examples, Description, Potential_Mitigations
	Minor	None
24	Path Traversal: '../filedir'
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
25	Path Traversal: '/../filedir'
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
26	Path Traversal: '/dir/../filename'
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	Applicable_Platforms
27	Path Traversal: 'dir/../../filename'
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
28	Path Traversal: '..\filedir'
	Major	Applicable_Platforms, Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations
	Minor	None
29	Path Traversal: '\..\filename'
	Major	Applicable_Platforms, Common_Consequences, Description, Observed_Examples, Potential_Mitigations
	Minor	None
30	Path Traversal: '\dir\..\filename'
	Major	Applicable_Platforms, Common_Consequences, Description, Observed_Examples, Potential_Mitigations
	Minor	None
31	Path Traversal: 'dir\..\..\filename'
	Major	Applicable_Platforms, Common_Consequences, Description, Potential_Mitigations
	Minor	Name
32	Path Traversal: '...' (Triple Dot)
	Major	Common_Consequences, Description, Maintenance_Notes, Observed_Examples, Potential_Mitigations
	Minor	None
33	Path Traversal: '....' (Multiple Dot)
	Major	Common_Consequences, Description, Maintenance_Notes, Potential_Mitigations
	Minor	None
34	Path Traversal: '....//'
	Major	Common_Consequences, Description, Potential_Mitigations, Relationships
	Minor	None
35	Path Traversal: '.../...//'
	Major	Common_Consequences, Description, Observed_Examples, Potential_Mitigations, Relationships
	Minor	None
36	Absolute Path Traversal
	Major	Common_Consequences, Demonstrative_Examples, Description, Relationships, Taxonomy_Mappings
	Minor	None
37	Path Traversal: '/absolute/pathname/here'
	Major	Common_Consequences, Observed_Examples, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
38	Path Traversal: '\absolute\pathname\here'
	Major	Common_Consequences, Observed_Examples, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
39	Path Traversal: 'C:dirname'
	Major	Common_Consequences, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
40	Path Traversal: '\\UNC\share\name\' (Windows UNC Share)
	Major	Common_Consequences, Potential_Mitigations
	Minor	None
41	Improper Resolution of Path Equivalence
	Major	Common_Consequences, Description, Name, Other_Notes, Potential_Mitigations, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
42	Path Equivalence: 'filename.' (Trailing Dot)
	Major	Common_Consequences
	Minor	None
43	Path Equivalence: 'filename....' (Multiple Trailing Dot)
	Major	Common_Consequences
	Minor	None
44	Path Equivalence: 'file.name' (Internal Dot)
	Major	Common_Consequences
	Minor	None
45	Path Equivalence: 'file...name' (Multiple Internal Dot)
	Major	Common_Consequences, Relationships
	Minor	None
46	Path Equivalence: 'filename ' (Trailing Space)
	Major	Common_Consequences
	Minor	None
47	Path Equivalence: ' filename' (Leading Space)
	Major	Common_Consequences
	Minor	Name
48	Path Equivalence: 'file name' (Internal Whitespace)
	Major	Common_Consequences
	Minor	None
49	Path Equivalence: 'filename/' (Trailing Slash)
	Major	Common_Consequences, Observed_Examples
	Minor	None
50	Path Equivalence: '//multiple/leading/slash'
	Major	Common_Consequences
	Minor	None
51	Path Equivalence: '/multiple//internal/slash'
	Major	Common_Consequences
	Minor	None
52	Path Equivalence: '/multiple/trailing/slash//'
	Major	Common_Consequences
	Minor	None
53	Path Equivalence: '\multiple\\internal\backslash'
	Major	Common_Consequences
	Minor	None
54	Path Equivalence: 'filedir\' (Trailing Backslash)
	Major	Common_Consequences
	Minor	None
55	Path Equivalence: '/./' (Single Dot Directory)
	Major	Common_Consequences
	Minor	None
56	*Path Equivalence: 'filedir' (Wildcard)**
	Major	Common_Consequences
	Minor	None
57	Path Equivalence: 'fakedir/../realdir/filename'
	Major	Common_Consequences, Description, Name, Observed_Examples, Other_Notes, Theoretical_Notes
	Minor	None
58	Path Equivalence: Windows 8.3 Filename
	Major	Common_Consequences, Description
	Minor	None
59	Improper Link Resolution Before File Access ('Link Following')
	Major	Background_Details, Common_Consequences, Description, Name, Other_Notes, Potential_Mitigations, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	Applicable_Platforms
61	UNIX Symbolic Link (Symlink) Following
	Major	Common_Consequences, Description, Observed_Examples
	Minor	None
62	UNIX Hard Link
	Major	Common_Consequences, Description, Relationships, Taxonomy_Mappings
	Minor	None
64	Windows Shortcut Following (.LNK)
	Major	Common_Consequences, Description, Relationships, Taxonomy_Mappings
	Minor	None
65	Windows Hard Link
	Major	Common_Consequences, Description, Relationships, Taxonomy_Mappings
	Minor	None
66	Improper Handling of File Names that Identify Virtual Resources
	Major	Common_Consequences, Description, Name
	Minor	None
67	Improper Handling of Windows Device Names
	Major	Background_Details, Common_Consequences, Description, Name, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
69	Improper Handling of Windows ::DATA Alternate Data Stream
	Major	Common_Consequences, Description, Name, Other_Notes, Related_Attack_Patterns, Theoretical_Notes
	Minor	None
71	Apple '.DS_Store'
	Major	Common_Consequences, Maintenance_Notes, Related_Attack_Patterns
	Minor	Description
72	Improper Handling of Apple HFS+ Alternate Data Stream Path
	Major	Applicable_Platforms, Background_Details, Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, References, Theoretical_Notes
	Minor	None
73	External Control of File Name or Path
	Major	Applicable_Platforms, Causal_Nature, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Observed_Examples, Other_Notes, Potential_Mitigations, References, Relationship_Notes, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
	Minor	None
74	Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
	Major	Common_Consequences, Description, Name, Other_Notes, Related_Attack_Patterns, Relationship_Notes, Relationships
	Minor	Potential_Mitigations
75	Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
	Major	Common_Consequences, Description
	Minor	Potential_Mitigations
76	Improper Neutralization of Equivalent Special Elements
	Major	Common_Consequences, Description, Name, Other_Notes
	Minor	Potential_Mitigations
77	Improper Neutralization of Special Elements used in a Command ('Command Injection')
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Potential_Mitigations, Relationships
	Minor	None
78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
	Major	Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Research_Gaps, Taxonomy_Mappings, Terminology_Notes, White_Box_Definitions
	Minor	Alternate_Terms
79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
	Major	Alternate_Terms, Applicable_Platforms, Background_Details, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Enabling_Factors_for_Exploitation, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
80	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Potential_Mitigations, White_Box_Definitions
	Minor	None
81	Improper Neutralization of Script in an Error Message Web Page
	Major	Common_Consequences, Description, Name, Potential_Mitigations, Related_Attack_Patterns
	Minor	None
82	Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
	Major	Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations, Relationships
	Minor	None
83	Improper Neutralization of Script in Attributes in a Web Page
	Major	Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations, Related_Attack_Patterns, Relationships
	Minor	None
84	Improper Neutralization of Encoded URI Schemes in a Web Page
	Major	Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations, Related_Attack_Patterns
	Minor	None
85	Doubled Character XSS Manipulations
	Major	Common_Consequences, Description, Observed_Examples, Potential_Mitigations, Related_Attack_Patterns
	Minor	None
86	Improper Neutralization of Invalid Characters in Identifiers in Web Pages
	Major	Common_Consequences, Description, Name, Other_Notes, Potential_Mitigations, Related_Attack_Patterns
	Minor	None
87	Improper Neutralization of Alternate XSS Syntax
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Potential_Mitigations, Related_Attack_Patterns
	Minor	None
88	Argument Injection or Modification
	Major	Common_Consequences, Observed_Examples, Other_Notes, Potential_Mitigations, Related_Attack_Patterns, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
	Major	Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Enabling_Factors_for_Exploitation, Modes_of_Introduction, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, White_Box_Definitions
	Minor	None
90	Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Potential_Mitigations, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
91	XML Injection (aka Blind XPath Injection)
	Major	Common_Consequences, Description, Maintenance_Notes, Other_Notes, Relationships, Taxonomy_Mappings, Theoretical_Notes
	Minor	None
92	DEPRECATED: Improper Sanitization of Custom Special Characters
	Major	Applicable_Platforms, Causal_Nature, Description, Maintenance_Notes, Name, Observed_Examples, Potential_Mitigations, Related_Attack_Patterns, Relationship_Notes, Relationships, Research_Gaps, Taxonomy_Mappings, Time_of_Introduction, Type, Weakness_Ordinalities
	Minor	None
93	Improper Neutralization of CRLF Sequences ('CRLF Injection')
	Major	Common_Consequences, Description, Likelihood_of_Exploit, Name, Other_Notes, References, Taxonomy_Mappings
	Minor	None
94	Improper Control of Generation of Code ('Code Injection')
	Major	Common_Consequences, Demonstrative_Examples, Description, Likelihood_of_Exploit, Name, Potential_Mitigations, Relationships
	Minor	Applicable_Platforms
95	Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Research_Gaps
	Minor	None
96	Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
	Major	Common_Consequences, Description, Name, Potential_Mitigations
	Minor	None
97	Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
	Major	Common_Consequences, Description, Name, Other_Notes, Relationship_Notes, Taxonomy_Mappings, Type
	Minor	Potential_Mitigations
98	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP File Inclusion')
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Name, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type
	Minor	None
99	Improper Control of Resource Identifiers ('Resource Injection')
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, White_Box_Definitions
	Minor	None
100	Technology-Specific Input Validation Problems
	Major	Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Type
	Minor	None
102	Struts: Duplicate Validation Forms
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations, Relationships
	Minor	None
103	Struts: Incomplete validate() Method Definition
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Maintenance_Notes, Other_Notes, Relationship_Notes, Relationships
	Minor	None
104	Struts: Form Bean Does Not Extend Validation Class
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Other_Notes, Relationships
	Minor	None
105	Struts: Form Field Without Validator
	Major	Common_Consequences, Demonstrative_Examples
	Minor	None
106	Struts: Plug-in Framework not in Use
	Major	Common_Consequences, Demonstrative_Examples, Other_Notes, Relationships
	Minor	None
107	Struts: Unused Validation Form
	Major	Common_Consequences, Demonstrative_Examples
	Minor	None
108	Struts: Unvalidated Action Form
	Major	Common_Consequences, Description, Other_Notes
	Minor	None
109	Struts: Validator Turned Off
	Major	Common_Consequences, Demonstrative_Examples, Other_Notes, Relationships
	Minor	None
110	Struts: Validator Without Form Field
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes
	Minor	None
111	Direct Use of Unsafe JNI
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
112	Missing XML Validation
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes
	Minor	None
113	Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Potential_Mitigations, Taxonomy_Mappings, Theoretical_Notes
	Minor	None
114	Process Control
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Related_Attack_Patterns
	Minor	None
115	Misinterpretation of Input
	Major	Common_Consequences, Relationships
	Minor	None
116	Improper Encoding or Escaping of Output
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Name, Observed_Examples, Potential_Mitigations, References, Related_Attack_Patterns, Relationship_Notes, Relationships, Research_Gaps, Taxonomy_Mappings, Terminology_Notes, Theoretical_Notes
	Minor	None
117	Improper Output Neutralization for Logs
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationships
	Minor	None
118	Improper Access of Indexable Resource ('Range Error')
	Major	Common_Consequences, Description, Name, Relationships
	Minor	None
119	Improper Restriction of Operations within the Bounds of a Memory Buffer
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Name, Observed_Examples, Potential_Mitigations, References, Relationships, Taxonomy_Mappings, Time_of_Introduction
	Minor	None
120	Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationship_Notes, Relationships, Taxonomy_Mappings, Terminology_Notes, Time_of_Introduction, Type
	Minor	None
121	Stack-based Buffer Overflow
	Major	Common_Consequences, Potential_Mitigations, References, Relationships, White_Box_Definitions
	Minor	None
122	Heap-based Buffer Overflow
	Major	Common_Consequences, Other_Notes, References, Relationship_Notes, Relationships
	Minor	Potential_Mitigations
123	Write-what-where Condition
	Major	Common_Consequences, Other_Notes, Relationships
	Minor	Potential_Mitigations
124	Buffer Underwrite ('Buffer Underflow')
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Relationships
	Minor	Potential_Mitigations
125	Out-of-bounds Read
	Major	Common_Consequences, Description, Relationships
	Minor	None
126	Buffer Over-read
	Major	Common_Consequences, Demonstrative_Examples, Description, Relationship_Notes, Relationships
	Minor	None
127	Buffer Under-read
	Major	Common_Consequences, Description, Relationships
	Minor	None
128	Wrap-around Error
	Major	Background_Details, Common_Consequences, Relationships, Taxonomy_Mappings
	Minor	Applicable_Platforms, Potential_Mitigations
129	Improper Validation of Array Index
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationship_Notes, Relationships, Taxonomy_Mappings, Theoretical_Notes, Weakness_Ordinalities
	Minor	None
130	Improper Handling of Length Parameter Inconsistency
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Potential_Mitigations, Relationships
	Minor	Applicable_Platforms
131	Incorrect Calculation of Buffer Size
	Major	Common_Consequences, Demonstrative_Examples, Detection_Factors, Likelihood_of_Exploit, Maintenance_Notes, Observed_Examples, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
132	DEPRECATED (Duplicate): Miscalculated Null Termination
	Major	Relationships
	Minor	None
134	Uncontrolled Format String
	Major	Common_Consequences, Demonstrative_Examples, Detection_Factors, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings, White_Box_Definitions
	Minor	Applicable_Platforms, Other_Notes, Potential_Mitigations
135	Incorrect Calculation of Multi-Byte String Length
	Major	Common_Consequences, Demonstrative_Examples, Description, References, Relationships, Taxonomy_Mappings
	Minor	None
138	Improper Neutralization of Special Elements
	Major	Applicable_Platforms, Common_Consequences, Description, Name, Observed_Examples, Other_Notes, Potential_Mitigations, Relationship_Notes, Relationships, Research_Gaps, Taxonomy_Mappings, Weakness_Ordinalities
	Minor	None
139	DEPRECATED: General Special Element Problems
	Major	Description, Relationships
	Minor	None
140	Improper Neutralization of Delimiters
	Major	Common_Consequences, Description, Name, Potential_Mitigations
	Minor	None
141	Improper Neutralization of Parameter/Argument Delimiters
	Major	Common_Consequences, Description, Name, Potential_Mitigations
	Minor	None
142	Improper Neutralization of Value Delimiters
	Major	Common_Consequences, Description, Name, Potential_Mitigations
	Minor	None
143	Improper Neutralization of Record Delimiters
	Major	Common_Consequences, Description, Name, Potential_Mitigations
	Minor	None
144	Improper Neutralization of Line Delimiters
	Major	Common_Consequences, Description, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
145	Improper Neutralization of Section Delimiters
	Major	Common_Consequences, Description, Name, Potential_Mitigations
	Minor	None
146	Improper Neutralization of Expression/Command Delimiters
	Major	Applicable_Platforms, Common_Consequences, Description, Name, Other_Notes, Potential_Mitigations, Relationship_Notes
	Minor	None
147	Improper Neutralization of Input Terminators
	Major	Common_Consequences, Description, Name, Potential_Mitigations
	Minor	None
148	Improper Neutralization of Input Leaders
	Major	Common_Consequences, Name, Potential_Mitigations
	Minor	None
149	Improper Neutralization of Quoting Syntax
	Major	Common_Consequences, Name, Potential_Mitigations
	Minor	None
150	Improper Neutralization of Escape, Meta, or Control Sequences
	Major	Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
151	Improper Neutralization of Comment Delimiters
	Major	Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations
	Minor	None
152	Improper Neutralization of Macro Symbols
	Major	Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations
	Minor	None
153	Improper Neutralization of Substitution Characters
	Major	Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations
	Minor	None
154	Improper Neutralization of Variable Name Delimiters
	Major	Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations
	Minor	None
155	Improper Neutralization of Wildcards or Matching Symbols
	Major	Common_Consequences, Description, Name, Potential_Mitigations
	Minor	None
156	Improper Neutralization of Whitespace
	Major	Common_Consequences, Description, Name, Potential_Mitigations
	Minor	None
157	Failure to Sanitize Paired Delimiters
	Major	Common_Consequences, Demonstrative_Examples, Observed_Examples, Potential_Mitigations
	Minor	None
158	Improper Neutralization of Null Byte or NUL Character
	Major	Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations, Taxonomy_Mappings
	Minor	None
159	Failure to Sanitize Special Element
	Major	Common_Consequences, Description, Maintenance_Notes, Other_Notes, Potential_Mitigations, Terminology_Notes
	Minor	None
160	Improper Neutralization of Leading Special Elements
	Major	Common_Consequences, Description, Name, Potential_Mitigations
	Minor	None
161	Improper Neutralization of Multiple Leading Special Elements
	Major	Common_Consequences, Description, Name, Potential_Mitigations
	Minor	None
162	Improper Neutralization of Trailing Special Elements
	Major	Common_Consequences, Description, Name, Potential_Mitigations
	Minor	None
163	Improper Neutralization of Multiple Trailing Special Elements
	Major	Common_Consequences, Description, Name, Potential_Mitigations, Relationships
	Minor	None
164	Improper Neutralization of Internal Special Elements
	Major	Common_Consequences, Description, Name, Potential_Mitigations
	Minor	None
165	Improper Neutralization of Multiple Internal Special Elements
	Major	Common_Consequences, Description, Name, Potential_Mitigations, Relationships
	Minor	None
166	Improper Handling of Missing Special Element
	Major	Common_Consequences, Description, Name, Other_Notes, Potential_Mitigations, Relationships
	Minor	None
167	Improper Handling of Additional Special Element
	Major	Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations, Relationships
	Minor	None
168	Improper Handling of Inconsistent Special Elements
	Major	Common_Consequences, Description, Name, Potential_Mitigations, Relationships
	Minor	None
169	Technology-Specific Special Elements
	Major	Other_Notes
	Minor	None
170	Improper Null Termination
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings, White_Box_Definitions
	Minor	None
171	Cleansing, Canonicalization, and Comparison Errors
	Major	Applicable_Platforms, Description, Relationships, Taxonomy_Mappings
	Minor	None
172	Encoding Error
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
173	Improper Handling of Alternate Encoding
	Major	Common_Consequences, Name, Potential_Mitigations
	Minor	None
174	Double Decoding of the Same Data
	Major	Common_Consequences, Observed_Examples, Potential_Mitigations
	Minor	None
175	Improper Handling of Mixed Encoding
	Major	Common_Consequences, Name, Potential_Mitigations
	Minor	None
176	Improper Handling of Unicode Encoding
	Major	Common_Consequences, Demonstrative_Examples, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
177	Improper Handling of URL Encoding (Hex Encoding)
	Major	Common_Consequences, Name, Potential_Mitigations
	Minor	None
178	Improper Handling of Case Sensitivity
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Potential_Mitigations
	Minor	None
179	Incorrect Behavior Order: Early Validation
	Major	Common_Consequences, Description, Potential_Mitigations, Relationships, Research_Gaps
	Minor	None
180	Incorrect Behavior Order: Validate Before Canonicalize
	Major	Common_Consequences, Demonstrative_Examples, Description, Observed_Examples, Other_Notes, Potential_Mitigations, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
181	Incorrect Behavior Order: Validate Before Filter
	Major	Common_Consequences, Demonstrative_Examples, Description, Observed_Examples
	Minor	Potential_Mitigations
182	Collapse of Data into Unsafe Value
	Major	Common_Consequences, Description, Observed_Examples, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	Name
183	Permissive Whitelist
	Major	Common_Consequences, Potential_Mitigations, Relationships
	Minor	None
184	Incomplete Blacklist
	Major	Common_Consequences, Demonstrative_Examples, Description, Observed_Examples, Other_Notes, Related_Attack_Patterns, Relationship_Notes, Relationships, Time_of_Introduction
	Minor	None
185	Incorrect Regular Expression
	Major	Common_Consequences, Description, Observed_Examples, Other_Notes, References
	Minor	None
186	Overly Restrictive Regular Expression
	Major	Common_Consequences
	Minor	Potential_Mitigations
187	Partial Comparison
	Major	Common_Consequences, Demonstrative_Examples, Observed_Examples, Other_Notes, Relationship_Notes, Relationships
	Minor	None
188	Reliance on Data/Memory Layout
	Major	Common_Consequences, Demonstrative_Examples, Relationships
	Minor	Potential_Mitigations
189	Numeric Errors
	Major	Relationships
	Minor	None
190	Integer Overflow or Wraparound
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Functional_Areas, Name, Observed_Examples, Potential_Mitigations, References, Relationships, Taxonomy_Mappings, Terminology_Notes
	Minor	None
191	Integer Underflow (Wrap or Wraparound)
	Major	Common_Consequences, Demonstrative_Examples, Description
	Minor	None
192	Integer Coercion Error
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
193	Off-by-one Error
	Major	Common_Consequences, Demonstrative_Examples, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
194	Unexpected Sign Extension
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Maintenance_Notes, Name, Observed_Examples, Potential_Mitigations, References, Relationship_Notes, Relationships
	Minor	None
195	Signed to Unsigned Conversion Error
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Relationships
	Minor	None
196	Unsigned to Signed Conversion Error
	Major	Common_Consequences, Demonstrative_Examples, Other_Notes
	Minor	Potential_Mitigations
197	Numeric Truncation Error
	Major	Common_Consequences, Demonstrative_Examples, Description, Observed_Examples, Other_Notes, Relationships, Research_Gaps, Taxonomy_Mappings
	Minor	Potential_Mitigations
198	Use of Incorrect Byte Ordering
	Major	Common_Consequences, Description, Relationships, Taxonomy_Mappings
	Minor	None
199	Information Management Errors
	Major	Relationships
	Minor	None
200	Information Exposure
	Major	Alternate_Terms, Common_Consequences, Description, Name, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
201	Information Exposure Through Sent Data
	Major	Common_Consequences, Description, Name, Other_Notes, Potential_Mitigations
	Minor	None
202	Exposure of Sensitive Data Through Data Queries
	Major	Common_Consequences, Name
	Minor	None
203	Information Exposure Through Discrepancy
	Major	Common_Consequences, Description, Name
	Minor	None
204	Response Discrepancy Information Exposure
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Potential_Mitigations
	Minor	None
205	Information Exposure Through Behavioral Discrepancy
	Major	Common_Consequences, Description, Name, Taxonomy_Mappings
	Minor	None
206	Information Exposure of Internal State Through Behavioral Inconsistency
	Major	Common_Consequences, Name
	Minor	None
207	Information Exposure Through an External Behavioral Inconsistency
	Major	Common_Consequences, Description, Name
	Minor	None
208	Information Exposure Through Timing Discrepancy
	Major	Common_Consequences, Description, Name, Relationships
	Minor	None
209	Information Exposure Through an Error Message
	Major	Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Time_of_Introduction
	Minor	Applicable_Platforms
210	Information Exposure Through Generated Error Message
	Major	Common_Consequences, Demonstrative_Examples, Name, Potential_Mitigations, Relationships
	Minor	None
211	Information Exposure Through External Error Message
	Major	Common_Consequences, Description, Enabling_Factors_for_Exploitation, Functional_Areas, Name, Observed_Examples, Other_Notes, Potential_Mitigations, Relationship_Notes, Weakness_Ordinalities
	Minor	Applicable_Platforms
212	Improper Cross-boundary Removal of Sensitive Data
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Other_Notes, Potential_Mitigations, Related_Attack_Patterns, Relationship_Notes, Relationships, Terminology_Notes
	Minor	None
213	Intentional Information Exposure
	Major	Common_Consequences, Demonstrative_Examples, Name
	Minor	None
214	Information Exposure Through Process Environment
	Major	Common_Consequences, Description, Name
	Minor	None
215	Information Exposure Through Debug Information
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
216	Containment Errors (Container Errors)
	Major	Common_Consequences, Relationships
	Minor	None
217	DEPRECATED: Failure to Protect Stored Data from Modification
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Likelihood_of_Exploit, Name, Other_Notes, Potential_Mitigations, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type
	Minor	None
218	DEPRECATED (Duplicate): Failure to provide confidentiality for stored data
	Major	Relationships
	Minor	None
219	Sensitive Data Under Web Root
	Major	Common_Consequences, Relationships
	Minor	None
220	Sensitive Data Under FTP Root
	Major	Common_Consequences
	Minor	None
221	Information Loss or Omission
	Major	Common_Consequences
	Minor	None
222	Truncation of Security-relevant Information
	Major	Common_Consequences
	Minor	None
223	Omission of Security-relevant Information
	Major	Common_Consequences, Demonstrative_Examples, Relationships
	Minor	None
224	Obscured Security-relevant Information by Alternate Name
	Major	Common_Consequences, Demonstrative_Examples
	Minor	None
225	DEPRECATED (Duplicate): General Information Management Problems
	Major	Relationships
	Minor	None
226	Sensitive Information Uncleared Before Release
	Major	Applicable_Platforms, Common_Consequences, Description, Maintenance_Notes, Other_Notes, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
227	Improper Fulfillment of API Contract ('API Abuse')
	Major	Common_Consequences, Description, Name, Relationships, Taxonomy_Mappings
	Minor	None
228	Improper Handling of Syntactically Invalid Structure
	Major	Common_Consequences, Description, Name
	Minor	None
229	Improper Handling of Values
	Major	Common_Consequences, Description
	Minor	None
230	Improper Handling of Missing Values
	Major	Common_Consequences, Description, Name, Other_Notes, Relationships, Research_Gaps, Taxonomy_Mappings
	Minor	None
231	Improper Handling of Extra Values
	Major	Common_Consequences, Description, Name
	Minor	None
232	Improper Handling of Undefined Values
	Major	Common_Consequences, Description, Name, Relationships, Taxonomy_Mappings
	Minor	None
233	Parameter Problems
	Major	Common_Consequences
	Minor	None
234	Failure to Handle Missing Parameter
	Major	Common_Consequences, Demonstrative_Examples, Maintenance_Notes, Observed_Examples, Other_Notes, Potential_Mitigations
	Minor	None
235	Improper Handling of Extra Parameters
	Major	Common_Consequences, Description, Name
	Minor	None
236	Improper Handling of Undefined Parameters
	Major	Common_Consequences, Description, Name
	Minor	None
237	Improper Handling of Structural Elements
	Major	Common_Consequences, Description, Name
	Minor	None
238	Improper Handling of Incomplete Structural Elements
	Major	Common_Consequences, Description, Name
	Minor	None
239	Failure to Handle Incomplete Element
	Major	Common_Consequences, Description
	Minor	None
240	Improper Handling of Inconsistent Structural Elements
	Major	Common_Consequences, Description, Name
	Minor	None
241	Improper Handling of Unexpected Data Type
	Major	Common_Consequences, Description, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
242	Use of Inherently Dangerous Function
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, References, Relationships, Taxonomy_Mappings
	Minor	None
243	Creation of chroot Jail Without Changing Working Directory
	Major	Common_Consequences, Demonstrative_Examples, Description, Name
	Minor	None
244	Improper Clearing of Heap Memory Before Release ('Heap Inspection')
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
245	J2EE Bad Practices: Direct Management of Connections
	Major	Common_Consequences, Demonstrative_Examples
	Minor	None
246	J2EE Bad Practices: Direct Use of Sockets
	Major	Common_Consequences
	Minor	None
247	Reliance on DNS Lookups in a Security Decision
	Major	Common_Consequences, Demonstrative_Examples, Potential_Mitigations, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
248	Uncaught Exception
	Major	Applicable_Platforms, Common_Consequences, Description, Relationships, Taxonomy_Mappings
	Minor	None
249	DEPRECATED: Often Misused: Path Manipulation
	Major	Affected_Resources, Applicable_Platforms, Demonstrative_Examples, Description, Maintenance_Notes, Name, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type, White_Box_Definitions
	Minor	None
250	Execution with Unnecessary Privileges
	Major	Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Maintenance_Notes, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Time_of_Introduction
	Minor	None
252	Unchecked Return Value
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Observed_Examples, Other_Notes, Potential_Mitigations, References, Relationships, Taxonomy_Mappings
	Minor	None
253	Incorrect Check of Function Return Value
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Relationships
	Minor	Potential_Mitigations
254	Security Features
	Major	Relationships
	Minor	None
255	Credentials Management
	Major	Relationships
	Minor	None
256	Plaintext Storage of a Password
	Major	Common_Consequences, Demonstrative_Examples, Relationships, Taxonomy_Mappings
	Minor	None
257	Storing Passwords in a Recoverable Format
	Major	Common_Consequences, Demonstrative_Examples, Description, Maintenance_Notes, Potential_Mitigations, Relationships
	Minor	None
258	Empty Password in Configuration File
	Major	Common_Consequences, Demonstrative_Examples, Other_Notes, Potential_Mitigations
	Minor	None
259	Use of Hard-coded Password
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Maintenance_Notes, Name, Other_Notes, Potential_Mitigations, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, White_Box_Definitions
	Minor	None
260	Password in Configuration File
	Major	Common_Consequences, Description
	Minor	None
261	Weak Cryptography for Passwords
	Major	Common_Consequences, Demonstrative_Examples, Relationships
	Minor	None
262	Not Using Password Aging
	Major	Common_Consequences, Relationships
	Minor	Potential_Mitigations
263	Password Aging with Long Expiration
	Major	Common_Consequences, Description, Other_Notes, Relationships
	Minor	Potential_Mitigations
264	Permissions, Privileges, and Access Controls
	Major	References, Relationships
	Minor	None
265	Privilege / Sandbox Issues
	Major	Description, Potential_Mitigations, Relationships, Research_Gaps, Theoretical_Notes
	Minor	None
266	Incorrect Privilege Assignment
	Major	Common_Consequences, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	Demonstrative_Examples
267	Privilege Defined With Unsafe Actions
	Major	Common_Consequences, Potential_Mitigations, Relationships
	Minor	None
268	Privilege Chaining
	Major	Common_Consequences, Other_Notes, Potential_Mitigations, Relationships, Research_Gaps
	Minor	None
269	Improper Privilege Management
	Major	Common_Consequences, Description, Name, Potential_Mitigations, Relationships
	Minor	None
270	Privilege Context Switching Error
	Major	Common_Consequences, Potential_Mitigations, References
	Minor	None
271	Privilege Dropping / Lowering Errors
	Major	Common_Consequences, Description, Maintenance_Notes, Potential_Mitigations, Relationships
	Minor	None
272	Least Privilege Violation
	Major	Common_Consequences, Demonstrative_Examples, Maintenance_Notes, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
273	Improper Check for Dropped Privileges
	Major	Common_Consequences, Description, Name, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
274	Improper Handling of Insufficient Privileges
	Major	Common_Consequences, Description, Maintenance_Notes, Name, Theoretical_Notes
	Minor	None
275	Permission Issues
	Major	Relationships
	Minor	None
276	Incorrect Default Permissions
	Major	Common_Consequences, Description, Name, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
277	Insecure Inherited Permissions
	Major	Common_Consequences
	Minor	Potential_Mitigations
278	Insecure Preserved Inherited Permissions
	Major	Common_Consequences
	Minor	Potential_Mitigations
279	Incorrect Execution-Assigned Permissions
	Major	Common_Consequences, Description, Name, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
280	Improper Handling of Insufficient Permissions or Privileges
	Major	Common_Consequences, Description, Name, Taxonomy_Mappings, Theoretical_Notes
	Minor	Potential_Mitigations
281	Improper Preservation of Permissions
	Major	Common_Consequences, Description, Name
	Minor	None
282	Improper Ownership Management
	Major	Common_Consequences, Potential_Mitigations, Relationships
	Minor	None
283	Unverified Ownership
	Major	Common_Consequences, Potential_Mitigations, Relationships
	Minor	None
284	Improper Access Control
	Major	Alternate_Terms, Background_Details, Common_Consequences, Description, Maintenance_Notes, Name, Potential_Mitigations, References, Relationships, Taxonomy_Mappings
	Minor	None
285	Improper Authorization
	Major	Alternate_Terms, Applicable_Platforms, Background_Details, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Modes_of_Introduction, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Type
	Minor	None
286	Incorrect User Management
	Major	Applicable_Platforms, Common_Consequences, Maintenance_Notes, Relationships
	Minor	None
287	Improper Authentication
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Name, Observed_Examples, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
288	Authentication Bypass Using an Alternate Path or Channel
	Major	Common_Consequences, Observed_Examples, Relationships
	Minor	None
289	Authentication Bypass by Alternate Name
	Major	Common_Consequences, Observed_Examples, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings, Theoretical_Notes
	Minor	None
290	Authentication Bypass by Spoofing
	Major	Common_Consequences, Demonstrative_Examples, Relationship_Notes
	Minor	None
291	Trusting Self-reported IP Address
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes
	Minor	Potential_Mitigations
292	Trusting Self-reported DNS Name
	Major	Common_Consequences, Demonstrative_Examples, Observed_Examples, Potential_Mitigations
	Minor	None
293	Using Referer Field for Authentication
	Major	Common_Consequences, Demonstrative_Examples
	Minor	Potential_Mitigations
294	Authentication Bypass by Capture-replay
	Major	Common_Consequences, Demonstrative_Examples, Description, Observed_Examples, Other_Notes, Potential_Mitigations, Related_Attack_Patterns
	Minor	None
295	Certificate Issues
	Major	Background_Details, Description
	Minor	None
296	Improper Following of Chain of Trust for Certificate Validation
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Relationships
	Minor	Potential_Mitigations
297	Improper Validation of Host-specific Certificate Data
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Relationships
	Minor	Potential_Mitigations
298	Improper Validation of Certificate Expiration
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Relationships
	Minor	Potential_Mitigations
299	Improper Check for Certificate Revocation
	Major	Common_Consequences, Description, Name, Other_Notes, Relationships
	Minor	Potential_Mitigations
300	Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
	Major	Common_Consequences, Description, Name, Relationships, Taxonomy_Mappings
	Minor	None
301	Reflection Attack in an Authentication Protocol
	Major	Common_Consequences, Demonstrative_Examples
	Minor	Potential_Mitigations
302	Authentication Bypass by Assumed-Immutable Data
	Major	Common_Consequences, Demonstrative_Examples, Description, Potential_Mitigations, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
303	Incorrect Implementation of Authentication Algorithm
	Major	Common_Consequences, Description, Name
	Minor	None
304	Missing Critical Step in Authentication
	Major	Common_Consequences, Description, Relationships
	Minor	None
305	Authentication Bypass by Primary Weakness
	Major	Common_Consequences, Observed_Examples
	Minor	None
306	Missing Authentication for Critical Function
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Detection_Factors, Likelihood_of_Exploit, Name, Observed_Examples, Potential_Mitigations, References, Related_Attack_Patterns, Relationships
	Minor	None
307	Improper Restriction of Excessive Authentication Attempts
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Name, Observed_Examples, Potential_Mitigations, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
308	Use of Single-factor Authentication
	Major	Common_Consequences, Description, Other_Notes
	Minor	Potential_Mitigations
309	Use of Password System for Primary Authentication
	Major	Common_Consequences
	Minor	Potential_Mitigations
310	Cryptographic Issues
	Major	Maintenance_Notes, References, Relationship_Notes, Relationships
	Minor	None
311	Missing Encryption of Sensitive Data
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Time_of_Introduction
	Minor	None
312	Cleartext Storage of Sensitive Information
	Major	Common_Consequences, Description, Name, References, Relationships
	Minor	None
313	Plaintext Storage in a File or on Disk
	Major	Common_Consequences, Demonstrative_Examples
	Minor	None
314	Plaintext Storage in the Registry
	Major	Common_Consequences
	Minor	None
315	Plaintext Storage in a Cookie
	Major	Common_Consequences
	Minor	None
316	Plaintext Storage in Memory
	Major	Common_Consequences
	Minor	None
317	Plaintext Storage in GUI
	Major	Common_Consequences
	Minor	Applicable_Platforms
318	Plaintext Storage in Executable
	Major	Common_Consequences
	Minor	None
319	Cleartext Transmission of Sensitive Information
	Major	Applicable_Platforms, Common_Consequences, Description, Detection_Factors, Likelihood_of_Exploit, Name, Observed_Examples, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Time_of_Introduction
	Minor	None
320	Key Management Errors
	Major	Observed_Examples
	Minor	None
321	Use of Hard-coded Cryptographic Key
	Major	Common_Consequences, Demonstrative_Examples, Relationships
	Minor	Potential_Mitigations
322	Key Exchange without Entity Authentication
	Major	Common_Consequences, Description, Other_Notes, Relationships
	Minor	Potential_Mitigations
323	Reusing a Nonce, Key Pair in Encryption
	Major	Common_Consequences, Demonstrative_Examples
	Minor	Potential_Mitigations
324	Use of a Key Past its Expiration Date
	Major	Common_Consequences, Demonstrative_Examples
	Minor	Potential_Mitigations
325	Missing Required Cryptographic Step
	Major	Common_Consequences
	Minor	None
326	Inadequate Encryption Strength
	Major	Common_Consequences, Description, Maintenance_Notes, Name, References, Related_Attack_Patterns, Relationships
	Minor	Potential_Mitigations
327	Use of a Broken or Risky Cryptographic Algorithm
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Maintenance_Notes, Observed_Examples, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
328	Reversible One-Way Hash
	Major	Common_Consequences, Description, References, Relationships
	Minor	None
329	Not Using a Random IV with CBC Mode
	Major	Common_Consequences, Demonstrative_Examples
	Minor	None
330	Use of Insufficiently Random Values
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Time_of_Introduction
	Minor	Functional_Areas
331	Insufficient Entropy
	Major	Common_Consequences, Taxonomy_Mappings
	Minor	None
332	Insufficient Entropy in PRNG
	Major	Common_Consequences, Demonstrative_Examples, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
333	Improper Handling of Insufficient Entropy in TRNG
	Major	Common_Consequences, Description, Name, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
334	Small Space of Random Values
	Major	Common_Consequences, Potential_Mitigations
	Minor	None
335	PRNG Seed Error
	Major	Common_Consequences
	Minor	None
336	Same Seed in PRNG
	Major	Common_Consequences, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
337	Predictable Seed in PRNG
	Major	Common_Consequences, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
338	Use of Cryptographically Weak PRNG
	Major	Common_Consequences
	Minor	None
339	Small Seed Space in PRNG
	Major	Common_Consequences, Observed_Examples, Potential_Mitigations
	Minor	None
340	Predictability Problems
	Major	Common_Consequences, Taxonomy_Mappings
	Minor	None
341	Predictable from Observable State
	Major	Common_Consequences, Potential_Mitigations
	Minor	None
342	Predictable Exact Value from Previous Values
	Major	Common_Consequences, Potential_Mitigations
	Minor	None
343	Predictable Value Range from Previous Values
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
344	Use of Invariant Value in Dynamically Changing Context
	Major	Common_Consequences, Potential_Mitigations, Relationships
	Minor	None
345	Insufficient Verification of Data Authenticity
	Major	Common_Consequences, Related_Attack_Patterns, Taxonomy_Mappings
	Minor	None
346	Origin Validation Error
	Major	Common_Consequences, Related_Attack_Patterns
	Minor	None
347	Improper Verification of Cryptographic Signature
	Major	Common_Consequences, Description, Name, Relationships, Taxonomy_Mappings
	Minor	None
348	Use of Less Trusted Source
	Major	Common_Consequences
	Minor	None
349	Acceptance of Extraneous Untrusted Data With Trusted Data
	Major	Common_Consequences, Relationships, Taxonomy_Mappings
	Minor	None
350	Improperly Trusted Reverse DNS
	Major	Common_Consequences, Demonstrative_Examples, Potential_Mitigations, Relationships
	Minor	None
351	Insufficient Type Distinction
	Major	Common_Consequences, Relationships
	Minor	None
352	Cross-Site Request Forgery (CSRF)
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationship_Notes, Relationships, Research_Gaps, Taxonomy_Mappings, Theoretical_Notes, Time_of_Introduction
	Minor	None
353	Missing Support for Integrity Check
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes
	Minor	Potential_Mitigations
354	Improper Validation of Integrity Check Value
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Relationships
	Minor	Potential_Mitigations
356	Product UI does not Warn User of Unsafe Actions
	Major	Common_Consequences, Description
	Minor	None
357	Insufficient UI Warning of Dangerous Operations
	Major	Common_Consequences, Description, Related_Attack_Patterns
	Minor	None
358	Improperly Implemented Security Check for Standard
	Major	Common_Consequences, Description, Modes_of_Introduction, Observed_Examples, Other_Notes, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
359	Privacy Violation
	Major	Common_Consequences, Demonstrative_Examples, Other_Notes, References, Relationships, Taxonomy_Mappings
	Minor	None
360	Trust of System Event Data
	Major	Common_Consequences, Description, Other_Notes
	Minor	None
361	Time and State
	Major	Description, Relationships
	Minor	None
362	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Maintenance_Notes, Name, Observed_Examples, Potential_Mitigations, References, Relationships, Research_Gaps, Taxonomy_Mappings
	Minor	None
363	Race Condition Enabling Link Following
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
364	Signal Handler Race Condition
	Major	Common_Consequences, Demonstrative_Examples, Description, Observed_Examples, Other_Notes, Potential_Mitigations, References, Relationships
	Minor	Applicable_Platforms
365	Race Condition in Switch
	Major	Common_Consequences, Demonstrative_Examples, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
366	Race Condition within a Thread
	Major	Common_Consequences, Demonstrative_Examples, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
367	Time-of-check Time-of-use (TOCTOU) Race Condition
	Major	Alternate_Terms, Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Other_Notes, References, Relationship_Notes, Relationships, Research_Gaps, Taxonomy_Mappings, White_Box_Definitions
	Minor	Potential_Mitigations
368	Context Switching Race Condition
	Major	Common_Consequences, Description, Observed_Examples, Other_Notes, Relationship_Notes, Weakness_Ordinalities
	Minor	None
369	Divide By Zero
	Major	Common_Consequences, Demonstrative_Examples, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
370	Missing Check for Certificate Revocation after Initial Check
	Major	Common_Consequences, Description, Name, Other_Notes, Potential_Mitigations, Relationships
	Minor	None
371	State Issues
	Major	Relationships
	Minor	None
372	Incomplete Internal State Distinction
	Major	Common_Consequences, Maintenance_Notes
	Minor	None
373	DEPRECATED: State Synchronization Error
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Likelihood_of_Exploit, Name, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type
	Minor	None
374	Passing Mutable Objects to an Untrusted Method
	Major	Common_Consequences, Demonstrative_Examples, Name, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
375	Returning a Mutable Object to an Untrusted Caller
	Major	Common_Consequences, Name, Relationships, Taxonomy_Mappings
	Minor	Demonstrative_Examples, Potential_Mitigations
377	Insecure Temporary File
	Major	Common_Consequences, Demonstrative_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
378	Creation of Temporary File With Insecure Permissions
	Major	Common_Consequences, Other_Notes
	Minor	Potential_Mitigations
379	Creation of Temporary File in Directory with Incorrect Permissions
	Major	Common_Consequences, Description, Name, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
381	J2EE Time and State Issues
	Major	Relationships
	Minor	None
382	J2EE Bad Practices: Use of System.exit()
	Major	Common_Consequences, Relationships, Taxonomy_Mappings
	Minor	None
383	J2EE Bad Practices: Direct Use of Threads
	Major	Common_Consequences, Description, Other_Notes, Relationships
	Minor	None
384	Session Fixation
	Major	Common_Consequences, Demonstrative_Examples, Related_Attack_Patterns, Taxonomy_Mappings
	Minor	None
385	Covert Timing Channel
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations
	Minor	None
386	Symbolic Name not Mapping to Correct Object
	Major	Common_Consequences
	Minor	None
387	Signal Errors
	Major	Observed_Examples, Other_Notes
	Minor	None
388	Error Handling
	Major	Common_Consequences, Description, Related_Attack_Patterns, Relationships
	Minor	None
389	Error Conditions, Return Values, Status Codes
	Major	Description, Other_Notes, Weakness_Ordinalities
	Minor	None
390	Detection of Error Condition Without Action
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
391	Unchecked Error Condition
	Major	Common_Consequences, Demonstrative_Examples, Relationships, Taxonomy_Mappings, White_Box_Definitions
	Minor	Potential_Mitigations
392	Missing Report of Error Condition
	Major	Common_Consequences, Description, Name, Other_Notes, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
	Minor	None
393	Return of Wrong Status Code
	Major	Common_Consequences, Description, Other_Notes, Relationship_Notes, Relationships
	Minor	None
394	Unexpected Status Code or Return Value
	Major	Common_Consequences, Other_Notes, Relationship_Notes, Relationships
	Minor	None
395	Use of NullPointerException Catch to Detect NULL Pointer Dereference
	Major	Common_Consequences, Demonstrative_Examples, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
396	Declaration of Catch for Generic Exception
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Relationships
	Minor	None
397	Declaration of Throws for Generic Exception
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
398	Indicator of Poor Code Quality
	Major	Common_Consequences, Relationships
	Minor	None
399	Resource Management Errors
	Major	Relationships
	Minor	None
400	Uncontrolled Resource Consumption ('Resource Exhaustion')
	Major	Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
401	Improper Release of Memory Before Removing Last Reference ('Memory Leak')
	Major	Alternate_Terms, Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction, Name, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings, White_Box_Definitions
	Minor	None
402	Transmission of Private Resources into a New Sphere ('Resource Leak')
	Major	Alternate_Terms, Common_Consequences, Name
	Minor	None
403	Exposure of File Descriptor to Unintended Control Sphere
	Major	Affected_Resources, Common_Consequences, Name, Observed_Examples, Relationships, Taxonomy_Mappings
	Minor	None
404	Improper Resource Shutdown or Release
	Major	Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Other_Notes, Potential_Mitigations, Related_Attack_Patterns, Relationship_Notes, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
	Minor	None
405	Asymmetric Resource Consumption (Amplification)
	Major	Common_Consequences, Description, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
406	Insufficient Control of Network Message Volume (Network Amplification)
	Major	Common_Consequences, Demonstrative_Examples, Description, Enabling_Factors_for_Exploitation, Name, Other_Notes, Relationship_Notes, Theoretical_Notes
	Minor	None
407	Algorithmic Complexity
	Major	Applicable_Platforms, Common_Consequences, Functional_Areas, Likelihood_of_Exploit, Other_Notes
	Minor	None
408	Incorrect Behavior Order: Early Amplification
	Major	Common_Consequences, Demonstrative_Examples, Description, Observed_Examples, Other_Notes, Relationship_Notes, Relationships
	Minor	None
409	Improper Handling of Highly Compressed Data (Data Amplification)
	Major	Common_Consequences, Description, Name, Relationships, Taxonomy_Mappings
	Minor	None
410	Insufficient Resource Pool
	Major	Common_Consequences, Demonstrative_Examples, Description, References, Relationships, Taxonomy_Mappings
	Minor	Other_Notes
412	Unrestricted Externally Accessible Lock
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings, White_Box_Definitions
	Minor	None
413	Improper Resource Locking
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Relationships, Taxonomy_Mappings
	Minor	None
414	Missing Lock Check
	Major	Common_Consequences
	Minor	None
415	Double Free
	Major	Common_Consequences, Demonstrative_Examples, Observed_Examples, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
416	Use After Free
	Major	Alternate_Terms, Common_Consequences, Demonstrative_Examples, Description, Observed_Examples, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
417	Channel and Path Errors
	Major	Other_Notes, Relationship_Notes
	Minor	None
418	Channel Errors
	Major	Relationships
	Minor	None
419	Unprotected Primary Channel
	Major	Common_Consequences, Related_Attack_Patterns
	Minor	None
420	Unprotected Alternate Channel
	Major	Common_Consequences
	Minor	Potential_Mitigations
421	Race Condition During Access to Alternate Channel
	Major	Common_Consequences, Description, References
	Minor	None
422	Unprotected Windows Messaging Channel ('Shatter')
	Major	Common_Consequences, Other_Notes, Relationship_Notes, Research_Gaps
	Minor	None
423	DEPRECATED (Duplicate): Proxied Trusted Channel
	Major	Applicable_Platforms, Description, Name, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type
	Minor	None
424	Improper Protection of Alternate Path
	Major	Common_Consequences, Name, Other_Notes
	Minor	None
425	Direct Request ('Forced Browsing')
	Major	Applicable_Platforms, Common_Consequences, Description, Relationships, Taxonomy_Mappings
	Minor	None
426	Untrusted Search Path
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Observed_Examples, Potential_Mitigations, References, Relationships, Taxonomy_Mappings, Time_of_Introduction
	Minor	Functional_Areas
427	Uncontrolled Search Path Element
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Description, Maintenance_Notes, Observed_Examples, Other_Notes, Potential_Mitigations, References, Relationship_Notes, Relationships
	Minor	None
428	Unquoted Search Path or Element
	Major	Applicable_Platforms, Common_Consequences, Description, Maintenance_Notes, Other_Notes, Potential_Mitigations, Relationships
	Minor	None
429	Handler Errors
	Major	Other_Notes
	Minor	None
430	Deployment of Wrong Handler
	Major	Common_Consequences, Description, Other_Notes, Weakness_Ordinalities
	Minor	Potential_Mitigations
431	Missing Handler
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes
	Minor	None
432	Dangerous Signal Handler not Disabled During Sensitive Operations
	Major	Applicable_Platforms, Common_Consequences, Description, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
433	Unparsed Raw Web Content Delivery
	Major	Common_Consequences, Description, Other_Notes, Potential_Mitigations, Relationship_Notes
	Minor	None
434	Unrestricted Upload of File with Dangerous Type
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Functional_Areas, Likelihood_of_Exploit, Name, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationship_Notes, Relationships, Time_of_Introduction, Type, Weakness_Ordinalities
	Minor	None
435	Interaction Error
	Major	Common_Consequences, Description, Relationships
	Minor	None
436	Interpretation Conflict
	Major	Common_Consequences, Description, Observed_Examples, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
437	Incomplete Model of Endpoint Features
	Major	Common_Consequences, Description, Other_Notes, Relationship_Notes
	Minor	None
438	Behavioral Problems
	Major	Relationships
	Minor	None
439	Behavioral Change in New Version or Environment
	Major	Common_Consequences, Observed_Examples
	Minor	None
440	Expected Behavior Violation
	Major	Common_Consequences, Other_Notes, Relevant_Properties, Theoretical_Notes
	Minor	None
441	Unintended Proxy/Intermediary
	Major	Common_Consequences, Maintenance_Notes, Other_Notes, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Time_of_Introduction
	Minor	None
442	Web Problems
	Major	Relationships
	Minor	None
443	DEPRECATED (Duplicate): HTTP response splitting
	Major	Relationships
	Minor	None
444	Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
	Major	Common_Consequences, Name, Related_Attack_Patterns, Taxonomy_Mappings
	Minor	None
446	UI Discrepancy for Security Feature
	Major	Common_Consequences, Description, Maintenance_Notes, Other_Notes, Relationship_Notes
	Minor	None
447	Unimplemented or Unsupported Feature in UI
	Major	Common_Consequences, Other_Notes, Potential_Mitigations, Research_Gaps
	Minor	None
448	Obsolete Feature in UI
	Major	Common_Consequences
	Minor	None
449	The UI Performs the Wrong Action
	Major	Common_Consequences
	Minor	None
450	Multiple Interpretations of UI Input
	Major	Common_Consequences, Potential_Mitigations
	Minor	None
451	UI Misrepresentation of Critical Information
	Major	Common_Consequences
	Minor	None
453	Insecure Default Variable Initialization
	Major	Common_Consequences, Maintenance_Notes, Other_Notes
	Minor	Applicable_Platforms
454	External Initialization of Trusted Variables or Data Stores
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
455	Non-exit on Failed Initialization
	Major	Common_Consequences
	Minor	None
456	Missing Initialization
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Other_Notes, Relationship_Notes, Relationships
	Minor	None
457	Use of Uninitialized Variable
	Major	Common_Consequences, Demonstrative_Examples, Potential_Mitigations
	Minor	Applicable_Platforms
458	DEPRECATED: Incorrect Initialization
	Major	Relationships
	Minor	None
459	Incomplete Cleanup
	Major	Common_Consequences, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
460	Improper Cleanup on Thrown Exception
	Major	Common_Consequences, Description, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
462	Duplicate Key in Associative List (Alist)
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
463	Deletion of Data Structure Sentinel
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations
	Minor	None
464	Addition of Data Structure Sentinel
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
465	Pointer Issues
	Major	Relationships
	Minor	None
466	Return of Pointer Value Outside of Expected Range
	Major	Common_Consequences, Maintenance_Notes, Relationships, Taxonomy_Mappings
	Minor	None
467	Use of sizeof() on a Pointer Type
	Major	Common_Consequences, Demonstrative_Examples, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
468	Incorrect Pointer Scaling
	Major	Common_Consequences, Demonstrative_Examples, Relationships, Taxonomy_Mappings, White_Box_Definitions
	Minor	Potential_Mitigations
469	Use of Pointer Subtraction to Determine Size
	Major	Common_Consequences, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
470	Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
471	Modification of Assumed-Immutable Data (MAID)
	Major	Common_Consequences, Other_Notes, Potential_Mitigations, Related_Attack_Patterns
	Minor	None
472	External Control of Assumed-Immutable Web Parameter
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations, Related_Attack_Patterns, Relationship_Notes, Relationships, Theoretical_Notes
	Minor	None
473	PHP External Variable Modification
	Major	Common_Consequences, Other_Notes, Relationship_Notes, Relationships
	Minor	None
474	Use of Function with Inconsistent Implementations
	Major	Common_Consequences, Other_Notes
	Minor	Applicable_Platforms
475	Undefined Behavior for Input to API
	Major	Common_Consequences
	Minor	None
476	NULL Pointer Dereference
	Major	Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Observed_Examples, Other_Notes, Potential_Mitigations, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
	Minor	None
477	Use of Obsolete Functions
	Major	Common_Consequences, Demonstrative_Examples, Other_Notes
	Minor	None
478	Missing Default Case in Switch Statement
	Major	Common_Consequences, Demonstrative_Examples, Description, Name
	Minor	Potential_Mitigations
479	Signal Handler Use of a Non-reentrant Function
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
480	Use of Incorrect Operator
	Major	Common_Consequences, Relationships, Taxonomy_Mappings
	Minor	Applicable_Platforms, Potential_Mitigations
481	Assigning instead of Comparing
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes
	Minor	Potential_Mitigations
482	Comparing instead of Assigning
	Major	Common_Consequences, Modes_of_Introduction, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
483	Incorrect Block Delimitation
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes
	Minor	Applicable_Platforms, Potential_Mitigations
484	Omitted Break Statement in Switch
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Name, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
	Minor	None
485	Insufficient Encapsulation
	Major	Common_Consequences, Relationships
	Minor	None
486	Comparison of Classes by Name
	Major	Common_Consequences, Demonstrative_Examples, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
487	Reliance on Package-level Scope
	Major	Common_Consequences, Relationships, Taxonomy_Mappings
	Minor	None
488	Exposure of Data Element to Wrong Session
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Potential_Mitigations, Relationships
	Minor	None
489	Leftover Debug Code
	Major	Common_Consequences, Demonstrative_Examples
	Minor	None
491	Public cloneable() Method Without Final ('Object Hijack')
	Major	Common_Consequences, Demonstrative_Examples, Name, Relationships, Taxonomy_Mappings
	Minor	None
492	Use of Inner Class Containing Sensitive Data
	Major	Common_Consequences, Demonstrative_Examples, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
493	Critical Public Variable Without Final Modifier
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
494	Download of Code Without Integrity Check
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Research_Gaps, Taxonomy_Mappings, Type
	Minor	None
495	Private Array-Typed Field Returned From A Public Method
	Major	Common_Consequences
	Minor	None
496	Public Data Assigned to Private Array-Typed Field
	Major	Common_Consequences
	Minor	None
497	Exposure of System Data to an Unauthorized Control Sphere
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
498	Cloneable Class Containing Sensitive Information
	Major	Common_Consequences, Description, Name, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
499	Serializable Class Containing Sensitive Data
	Major	Common_Consequences, Demonstrative_Examples, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
500	Public Static Field Not Marked Final
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
501	Trust Boundary Violation
	Major	Common_Consequences
	Minor	None
502	Deserialization of Untrusted Data
	Major	Common_Consequences, Description, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
506	Embedded Malicious Code
	Major	Common_Consequences, Description, Other_Notes, Terminology_Notes
	Minor	None
507	Trojan Horse
	Major	Common_Consequences, Description, References, Terminology_Notes
	Minor	None
508	Non-Replicating Malicious Code
	Major	Common_Consequences
	Minor	None
509	Replicating Malicious Code (Virus or Worm)
	Major	Common_Consequences
	Minor	None
510	Trapdoor
	Major	Common_Consequences
	Minor	None
511	Logic/Time Bomb
	Major	Common_Consequences, Description
	Minor	Potential_Mitigations
512	Spyware
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
513	Intentionally Introduced Nonmalicious Weakness
	Major	Relationships
	Minor	None
514	Covert Channel
	Major	Common_Consequences, Description, Other_Notes, Related_Attack_Patterns, Relationships, Theoretical_Notes
	Minor	None
515	Covert Storage Channel
	Major	Common_Consequences, Description, Other_Notes
	Minor	Potential_Mitigations
516	DEPRECATED (Duplicate): Covert Timing Channel
	Major	Relationships
	Minor	None
518	Inadvertently Introduced Weakness
	Major	Description, Relationships
	Minor	None
520	.NET Misconfiguration: Use of Impersonation
	Major	Common_Consequences
	Minor	None
521	Weak Password Requirements
	Major	Common_Consequences, Potential_Mitigations, Related_Attack_Patterns, Relationships
	Minor	None
522	Insufficiently Protected Credentials
	Major	Common_Consequences, Related_Attack_Patterns, Relationships
	Minor	None
523	Unprotected Transport of Credentials
	Major	Common_Consequences, Related_Attack_Patterns
	Minor	None
524	Information Exposure Through Caching
	Major	Common_Consequences, Name, Relationships, Taxonomy_Mappings
	Minor	None
525	Information Exposure Through Browser Caching
	Major	Common_Consequences, Name, Other_Notes, Potential_Mitigations
	Minor	None
526	Information Exposure Through Environmental Variables
	Major	Common_Consequences, Name, Relationships, Taxonomy_Mappings
	Minor	None
527	Exposure of CVS Repository to an Unauthorized Control Sphere
	Major	Common_Consequences, Description, Name, Relationships
	Minor	None
528	Exposure of Core Dump File to an Unauthorized Control Sphere
	Major	Common_Consequences, Description, Name, Relationships, Taxonomy_Mappings
	Minor	None
529	Exposure of Access Control List Files to an Unauthorized Control Sphere
	Major	Common_Consequences, Description, Name, Relationships
	Minor	None
530	Exposure of Backup File to an Unauthorized Control Sphere
	Major	Common_Consequences, Description, Name, Relationships
	Minor	None
531	Information Exposure Through Test Code
	Major	Common_Consequences, Name, Relationships
	Minor	None
532	Information Exposure Through Log Files
	Major	Common_Consequences, Description, Likelihood_of_Exploit, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
533	Information Exposure Through Server Log Files
	Major	Common_Consequences, Name, Relationships, Taxonomy_Mappings
	Minor	None
534	Information Exposure Through Debug Log Files
	Major	Common_Consequences, Name, Relationships, Taxonomy_Mappings
	Minor	None
535	Information Exposure Through Shell Error Message
	Major	Common_Consequences, Name
	Minor	None
536	Information Exposure Through Servlet Runtime Error Message
	Major	Common_Consequences, Demonstrative_Examples, Name, Other_Notes
	Minor	None
537	Information Exposure Through Java Runtime Error Message
	Major	Common_Consequences, Demonstrative_Examples, Name, Potential_Mitigations
	Minor	None
538	File and Directory Information Exposure
	Major	Common_Consequences, Description, Maintenance_Notes, Name, Relationships
	Minor	None
539	Information Exposure Through Persistent Cookies
	Major	Common_Consequences, Description, Name, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
540	Information Exposure Through Source Code
	Major	Common_Consequences, Description, Name, Relationships
	Minor	None
541	Information Exposure Through Include Source Code
	Major	Common_Consequences, Name, Relationships
	Minor	None
542	Information Exposure Through Cleanup Log Files
	Major	Common_Consequences, Description, Name, Relationships, Taxonomy_Mappings
	Minor	None
543	Use of Singleton Pattern Without Synchronization in a Multithreaded Context
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Name, Potential_Mitigations, References, Relationships, Taxonomy_Mappings
	Minor	None
544	Missing Standardized Error Handling Mechanism
	Major	Common_Consequences, Description, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings, Time_of_Introduction
	Minor	None
545	Use of Dynamic Class Loading
	Major	Common_Consequences
	Minor	None
546	Suspicious Comment
	Major	Common_Consequences, Demonstrative_Examples
	Minor	None
547	Use of Hard-coded, Security-relevant Constants
	Major	Common_Consequences, Description, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
548	Information Exposure Through Directory Listing
	Major	Common_Consequences, Description, Name, Other_Notes, Taxonomy_Mappings
	Minor	None
549	Missing Password Field Masking
	Major	Common_Consequences, Description, Relationships
	Minor	None
550	Information Exposure Through Server Error Message
	Major	Common_Consequences, Description, Name, Relationships
	Minor	None
551	Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
	Major	Common_Consequences, Demonstrative_Examples, Description, Relationships
	Minor	None
552	Files or Directories Accessible to External Parties
	Major	Common_Consequences, Relationships, Taxonomy_Mappings
	Minor	None
553	Command Shell in Externally Accessible Directory
	Major	Common_Consequences
	Minor	None
554	ASP.NET Misconfiguration: Not Using Input Validation Framework
	Major	Common_Consequences, Description, Other_Notes, Potential_Mitigations
	Minor	None
555	J2EE Misconfiguration: Plaintext Password in Configuration File
	Major	Common_Consequences, Description
	Minor	None
556	ASP.NET Misconfiguration: Use of Identity Impersonation
	Major	Common_Consequences, Description, Relationships
	Minor	None
558	Use of getlogin() in Multithreaded Application
	Major	Common_Consequences, Demonstrative_Examples, Taxonomy_Mappings
	Minor	None
559	Often Misused: Arguments and Parameters
	Major	Other_Notes, Related_Attack_Patterns, Relationship_Notes
	Minor	None
560	Use of umask() with chmod-style Argument
	Major	Common_Consequences
	Minor	None
561	Dead Code
	Major	Common_Consequences, Demonstrative_Examples, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
562	Return of Stack Variable Address
	Major	Common_Consequences, Demonstrative_Examples, Relationships, Taxonomy_Mappings
	Minor	None
563	Unused Variable
	Major	Common_Consequences, Demonstrative_Examples, Relationships, Taxonomy_Mappings
	Minor	None
564	SQL Injection: Hibernate
	Major	Common_Consequences, Potential_Mitigations, Related_Attack_Patterns
	Minor	None
565	Reliance on Cookies without Validation and Integrity Checking
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Potential_Mitigations, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
566	Authorization Bypass Through User-Controlled SQL Primary Key
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Potential_Mitigations, Taxonomy_Mappings
	Minor	None
567	Unsynchronized Access to Shared Data in a Multithreaded Context
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Name, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
568	finalize() Method Without super.finalize()
	Major	Common_Consequences, Description, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
569	Expression Issues
	Major	Relationships
	Minor	None
570	Expression is Always False
	Major	Common_Consequences, Demonstrative_Examples, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
571	Expression is Always True
	Major	Common_Consequences, Demonstrative_Examples, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
572	Call to Thread run() instead of start()
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
573	Improper Following of Specification by Caller
	Major	Common_Consequences, Description, Name, Relationships, Taxonomy_Mappings
	Minor	None
574	EJB Bad Practices: Use of Synchronization Primitives
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Relationships
	Minor	None
575	EJB Bad Practices: Use of AWT Swing
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations
	Minor	None
576	EJB Bad Practices: Use of Java I/O
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes
	Minor	None
577	EJB Bad Practices: Use of Sockets
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations
	Minor	None
578	EJB Bad Practices: Use of Class Loader
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations
	Minor	None
579	J2EE Bad Practices: Non-serializable Object Stored in Session
	Major	Common_Consequences, Demonstrative_Examples
	Minor	None
580	clone() Method Without super.clone()
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations
	Minor	None
581	Object Model Violation: Just One of Equals and Hashcode Defined
	Major	Common_Consequences, Description, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
582	Array Declared Public, Final, and Static
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
583	finalize() Method Declared Public
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
584	Return Inside Finally Block
	Major	Common_Consequences, Demonstrative_Examples, Relationships, Taxonomy_Mappings
	Minor	None
585	Empty Synchronized Block
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Potential_Mitigations, References
	Minor	None
586	Explicit Call to Finalize()
	Major	Common_Consequences, Demonstrative_Examples, Description, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
587	Assignment of a Fixed Address to a Pointer
	Major	Common_Consequences, Description, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
588	Attempt to Access Child of a Non-structure Pointer
	Major	Common_Consequences, Demonstrative_Examples, Other_Notes, Relationships
	Minor	Potential_Mitigations
589	Call to Non-ubiquitous API
	Major	Common_Consequences, Description, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
590	Free of Memory not on the Heap
	Major	Common_Consequences, Demonstrative_Examples, Description, Maintenance_Notes, Name, Other_Notes, Potential_Mitigations, References, Relationships, Taxonomy_Mappings
	Minor	None
591	Sensitive Data Storage in Improperly Locked Memory
	Major	Common_Consequences, Description, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	Potential_Mitigations
592	Authentication Bypass Issues
	Major	Common_Consequences, Related_Attack_Patterns
	Minor	None
593	Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
	Major	Common_Consequences, Description, Other_Notes, Potential_Mitigations
	Minor	None
594	J2EE Framework: Saving Unserializable Objects to Disk
	Major	Common_Consequences, Demonstrative_Examples
	Minor	None
595	Comparison of Object References Instead of Object Contents
	Major	Common_Consequences, Demonstrative_Examples, Name, Relationships, Taxonomy_Mappings
	Minor	None
596	Incorrect Semantic Object Comparison
	Major	Common_Consequences, Demonstrative_Examples, Detection_Factors, Relationships
	Minor	None
597	Use of Wrong Operator in String Comparison
	Major	Common_Consequences, Demonstrative_Examples, Description, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
598	Information Exposure Through Query Strings in GET Request
	Major	Common_Consequences, Name, Other_Notes, Relationships
	Minor	None
599	Trust of OpenSSL Certificate Without Validation
	Major	Common_Consequences, Description, Other_Notes
	Minor	Potential_Mitigations
600	Uncaught Exception in Servlet
	Major	Alternate_Terms, Common_Consequences, Demonstrative_Examples, Description, Maintenance_Notes, Name, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
601	URL Redirection to Untrusted Site ('Open Redirect')
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Detection_Factors, Likelihood_of_Exploit, Name, Observed_Examples, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
602	Client-Side Enforcement of Server-Side Security
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Likelihood_of_Exploit, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Research_Gaps, Time_of_Introduction
	Minor	None
603	Use of Client-Side Authentication
	Major	Common_Consequences, Maintenance_Notes, Other_Notes
	Minor	None
604	Deprecated Entries
	Major	Name, Relationships, View_Filter, View_Structure
	Minor	None
605	Multiple Binds to the Same Port
	Major	Common_Consequences, Demonstrative_Examples
	Minor	None
606	Unchecked Input for Loop Condition
	Major	Common_Consequences, Demonstrative_Examples, Relationships, Taxonomy_Mappings
	Minor	None
607	Public Static Final Field References Mutable Object
	Major	Common_Consequences, Relationships, Taxonomy_Mappings
	Minor	Description
608	Struts: Non-private Field in ActionForm Class
	Major	Common_Consequences, Demonstrative_Examples
	Minor	None
609	Double-Checked Locking
	Major	Common_Consequences, Demonstrative_Examples, Relationships, Taxonomy_Mappings
	Minor	References
610	Externally Controlled Reference to a Resource in Another Sphere
	Major	Common_Consequences, Other_Notes, Related_Attack_Patterns, Relationship_Notes
	Minor	None
611	Information Exposure Through XML External Entity Reference
	Major	Background_Details, Common_Consequences, Name, Other_Notes, Taxonomy_Mappings
	Minor	None
612	Information Exposure Through Indexing of Private Data
	Major	Common_Consequences, Name, Other_Notes, Research_Gaps, Taxonomy_Mappings
	Minor	None
613	Insufficient Session Expiration
	Major	Common_Consequences, Demonstrative_Examples, Relationships, Taxonomy_Mappings
	Minor	None
614	Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
	Major	Common_Consequences, Observed_Examples, Related_Attack_Patterns
	Minor	Name
615	Information Exposure Through Comments
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Taxonomy_Mappings
	Minor	None
616	Incomplete Identification of Uploaded File Variables (PHP)
	Major	Common_Consequences, Description, Other_Notes, Potential_Mitigations
	Minor	None
617	Reachable Assertion
	Major	Common_Consequences
	Minor	None
618	Exposed Unsafe ActiveX Method
	Major	Common_Consequences, Description, Other_Notes, Relationships, Type
	Minor	None
619	Dangling Database Cursor ('Cursor Injection')
	Major	Background_Details, Common_Consequences, Description, Modes_of_Introduction, Name, Other_Notes, Relationships, Weakness_Ordinalities
	Minor	None
620	Unverified Password Change
	Major	Common_Consequences, Demonstrative_Examples, Observed_Examples, Other_Notes, Weakness_Ordinalities
	Minor	None
621	Variable Extraction Error
	Major	Common_Consequences, Description
	Minor	None
622	Unvalidated Function Hook Arguments
	Major	Common_Consequences, Other_Notes, Relationships, Weakness_Ordinalities
	Minor	None
623	Unsafe ActiveX Control Marked Safe For Scripting
	Major	Common_Consequences, References
	Minor	None
624	Executable Regular Expression Error
	Major	Common_Consequences, Description
	Minor	None
625	Permissive Regular Expression
	Major	Common_Consequences, Demonstrative_Examples, Description, Relationships, Taxonomy_Mappings
	Minor	None
626	Null Byte Interaction Error (Poison Null Byte)
	Major	Common_Consequences, Other_Notes
	Minor	None
627	Dynamic Variable Evaluation
	Major	Background_Details, Common_Consequences, Description
	Minor	None
628	Function Call with Incorrectly Specified Arguments
	Major	Common_Consequences, Description, Detection_Factors, Other_Notes, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
	Minor	None
632	Weaknesses that Affect Files or Directories
	Major	Relationships
	Minor	None
633	Weaknesses that Affect Memory
	Major	Relationships
	Minor	None
636	Not Failing Securely ('Failing Open')
	Major	Common_Consequences, Description, Name, Relationships, Research_Gaps
	Minor	None
637	Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
	Major	Common_Consequences, Description, Name, Research_Gaps
	Minor	None
638	Not Using Complete Mediation
	Major	Common_Consequences, Description, Name, Related_Attack_Patterns, Relationships
	Minor	None
639	Authorization Bypass Through User-Controlled Key
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Description, Name, Potential_Mitigations, Relationships
	Minor	None
640	Weak Password Recovery Mechanism for Forgotten Password
	Major	Common_Consequences, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
641	Improper Restriction of Names for Files and Other Resources
	Major	Common_Consequences, Description, Name, Type
	Minor	None
642	External Control of Critical State Data
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Relevant_Properties, Type
	Minor	None
643	Improper Neutralization of Data within XPath Expressions ('XPath Injection')
	Major	Common_Consequences, Demonstrative_Examples, Description, Enabling_Factors_for_Exploitation, Name, References, Relationship_Notes, Taxonomy_Mappings
	Minor	None
644	Improper Neutralization of HTTP Headers for Scripting Syntax
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Relationships
	Minor	None
645	Overly Restrictive Account Lockout Mechanism
	Major	Common_Consequences, Description
	Minor	None
646	Reliance on File Name or Extension of Externally-Supplied File
	Major	Applicable_Platforms, Common_Consequences, Description, Name, Observed_Examples, Related_Attack_Patterns, Relationships
	Minor	None
647	Use of Non-Canonical URL Paths for Authorization Decisions
	Major	Applicable_Platforms, Common_Consequences, Description, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	Observed_Examples
648	Incorrect Use of Privileged APIs
	Major	Common_Consequences, Description, Name, Potential_Mitigations, Related_Attack_Patterns
	Minor	None
649	Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
	Major	Common_Consequences, Description, Enabling_Factors_for_Exploitation, Observed_Examples
	Minor	None
650	Trusting HTTP Permission Methods on the Server Side
	Major	Common_Consequences, Description, Enabling_Factors_for_Exploitation
	Minor	None
651	Information Exposure Through WSDL File
	Major	Common_Consequences, Description, Name
	Minor	Applicable_Platforms
652	Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
	Major	Common_Consequences, Description, Name, Relationship_Notes, Taxonomy_Mappings
	Minor	None
653	Insufficient Compartmentalization
	Major	Common_Consequences, Name, Other_Notes, Relationship_Notes, Terminology_Notes
	Minor	None
654	Reliance on a Single Factor in a Security Decision
	Major	Common_Consequences, Description, Maintenance_Notes, Name, Other_Notes, Related_Attack_Patterns, Relationships
	Minor	None
655	Insufficient Psychological Acceptability
	Major	Common_Consequences, Description, Name
	Minor	None
656	Reliance on Security Through Obscurity
	Major	Common_Consequences, Description, Name, Related_Attack_Patterns
	Minor	None
657	Violation of Secure Design Principles
	Major	Common_Consequences
	Minor	None
662	Improper Synchronization
	Major	Common_Consequences, Description, Name, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
663	Use of a Non-reentrant Function in a Concurrent Context
	Major	Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations, References, Related_Attack_Patterns, Relationships
	Minor	None
664	Improper Control of a Resource Through its Lifetime
	Major	Common_Consequences, Description, Name, Related_Attack_Patterns, Relationships
	Minor	None
665	Improper Initialization
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Modes_of_Introduction, Name, Observed_Examples, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
	Minor	None
666	Operation on Resource in Wrong Phase of Lifetime
	Major	Common_Consequences, Relationships
	Minor	None
667	Improper Locking
	Major	Common_Consequences, Description, Name, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
668	Exposure of Resource to Wrong Sphere
	Major	Common_Consequences, Description, Other_Notes, Relationships, Theoretical_Notes
	Minor	None
669	Incorrect Resource Transfer Between Spheres
	Major	Background_Details, Common_Consequences, Other_Notes, Relationships
	Minor	None
670	Always-Incorrect Control Flow Implementation
	Major	Common_Consequences, Maintenance_Notes, Modes_of_Introduction, Other_Notes, Relationships, Taxonomy_Mappings
	Minor	None
671	Lack of Administrator Control over Security
	Major	Common_Consequences, Description, Name, Relationships
	Minor	None
672	Operation on a Resource after Expiration or Release
	Major	Common_Consequences, Demonstrative_Examples, Description, Name, Observed_Examples, Relationships
	Minor	None
673	External Influence of Sphere Definition
	Major	Common_Consequences, Other_Notes, Theoretical_Notes
	Minor	None
674	Uncontrolled Recursion
	Major	Common_Consequences, Related_Attack_Patterns, Relationships
	Minor	None
675	Duplicate Operations on Resource
	Major	Common_Consequences, Other_Notes, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
676	Use of Potentially Dangerous Function
	Major	Common_Consequences, Demonstrative_Examples, Observed_Examples, Other_Notes, Potential_Mitigations, References, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
680	Integer Overflow to Buffer Overflow
	Major	Common_Consequences, Related_Attack_Patterns
	Minor	None
681	Incorrect Conversion between Numeric Types
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Likelihood_of_Exploit, Observed_Examples, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
682	Incorrect Calculation
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings, Type
	Minor	None
683	Function Call With Incorrect Order of Arguments
	Major	Common_Consequences, Demonstrative_Examples, Modes_of_Introduction, Other_Notes, Potential_Mitigations
	Minor	None
684	Incorrect Provision of Specified Functionality
	Major	Common_Consequences, Description, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
685	Function Call With Incorrect Number of Arguments
	Major	Common_Consequences, Description, Detection_Factors, Modes_of_Introduction, Other_Notes, Potential_Mitigations
	Minor	None
686	Function Call With Incorrect Argument Type
	Major	Common_Consequences, Description, Other_Notes, Potential_Mitigations, Relationships, Taxonomy_Mappings
	Minor	None
687	Function Call With Incorrectly Specified Argument Value
	Major	Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Other_Notes, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
688	Function Call With Incorrect Variable or Reference as Argument
	Major	Common_Consequences, Description, Detection_Factors, Modes_of_Introduction, Other_Notes, Potential_Mitigations
	Minor	None
689	Permission Race Condition During Resource Copy
	Major	Common_Consequences, Related_Attack_Patterns, Relationships
	Minor	None
690	Unchecked Return Value to NULL Pointer Dereference
	Major	Common_Consequences, Demonstrative_Examples, Observed_Examples, Relationships, Taxonomy_Mappings
	Minor	None
691	Insufficient Control Flow Management
	Major	Common_Consequences, Maintenance_Notes, Other_Notes, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
692	Incomplete Blacklist to Cross-Site Scripting
	Major	Applicable_Platforms, Common_Consequences, Observed_Examples, Related_Attack_Patterns
	Minor	None
693	Protection Mechanism Failure
	Major	Common_Consequences, Description, Maintenance_Notes, Other_Notes, Related_Attack_Patterns, Relationships
	Minor	None
694	Use of Multiple Resources with Duplicate Identifier
	Major	Common_Consequences
	Minor	None
695	Use of Low-Level Functionality
	Major	Common_Consequences, Related_Attack_Patterns
	Minor	None
696	Incorrect Behavior Order
	Major	Common_Consequences, Description, Relationships, Taxonomy_Mappings
	Minor	None
697	Insufficient Comparison
	Major	Common_Consequences, Description, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
698	Redirect Without Exit
	Major	Common_Consequences
	Minor	None
701	Weaknesses Introduced During Design
	Major	View_Filter
	Minor	None
702	Weaknesses Introduced During Implementation
	Major	View_Filter
	Minor	None
703	Improper Check or Handling of Exceptional Conditions
	Major	Common_Consequences, Name, Other_Notes, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
704	Incorrect Type Conversion or Cast
	Major	Common_Consequences, Description, Relationships, Taxonomy_Mappings
	Minor	Applicable_Platforms
705	Incorrect Control Flow Scoping
	Major	Common_Consequences, Relationships, Taxonomy_Mappings
	Minor	None
706	Use of Incorrectly-Resolved Name or Reference
	Major	Common_Consequences, Related_Attack_Patterns, Relationships
	Minor	None
707	Improper Enforcement of Message or Data Structure
	Major	Common_Consequences, Description, Name, Related_Attack_Patterns, Relationships
	Minor	None
708	Incorrect Ownership Assignment
	Major	Common_Consequences, Description, Maintenance_Notes, Other_Notes, Relationships
	Minor	None
710	Coding Standards Violation
	Major	Common_Consequences, Relationships
	Minor	None
712	OWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS)
	Major	Related_Attack_Patterns
	Minor	None
713	OWASP Top Ten 2007 Category A2 - Injection Flaws
	Major	Related_Attack_Patterns
	Minor	None
714	OWASP Top Ten 2007 Category A3 - Malicious File Execution
	Major	Related_Attack_Patterns
	Minor	None
715	OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference
	Major	Related_Attack_Patterns, Relationships
	Minor	None
716	OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF)
	Major	Related_Attack_Patterns
	Minor	None
717	OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling
	Major	Related_Attack_Patterns
	Minor	None
718	OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management
	Major	Related_Attack_Patterns
	Minor	None
719	OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage
	Major	Related_Attack_Patterns
	Minor	None
721	OWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access
	Major	Related_Attack_Patterns
	Minor	None
722	OWASP Top Ten 2004 Category A1 - Unvalidated Input
	Major	Relationships
	Minor	None
723	OWASP Top Ten 2004 Category A2 - Broken Access Control
	Major	Relationships
	Minor	None
724	OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management
	Major	Related_Attack_Patterns, Relationships
	Minor	None
725	OWASP Top Ten 2004 Category A4 - Cross-Site Scripting (XSS) Flaws
	Major	Relationships
	Minor	None
726	OWASP Top Ten 2004 Category A5 - Buffer Overflows
	Major	Relationships
	Minor	None
727	OWASP Top Ten 2004 Category A6 - Injection Flaws
	Major	Relationships
	Minor	None
728	OWASP Top Ten 2004 Category A7 - Improper Error Handling
	Major	Related_Attack_Patterns, Relationships
	Minor	None
729	OWASP Top Ten 2004 Category A8 - Insecure Storage
	Major	Relationships
	Minor	None
731	OWASP Top Ten 2004 Category A10 - Insecure Configuration Management
	Major	Relationships
	Minor	None
732	Incorrect Permission Assignment for Critical Resource
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Likelihood_of_Exploit, Modes_of_Introduction, Name, Observed_Examples, Potential_Mitigations, References, Related_Attack_Patterns, Relationships, Taxonomy_Mappings
	Minor	None
1000	Research Concepts
	Major	Relationships
	Minor	None

Page Last Updated: January 05, 2017


	Site Map \| Terms of Use \| Manage Cookies \| Cookie Notice \| Privacy Policy \| Contact Us \| Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2024, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.

Common Weakness Enumeration