CWE

Common Weakness Enumeration

A community-developed list of SW & HW weaknesses that can become vulnerabilities
New to CWE? click here!
CWE Most Important Hardware Weaknesses
CWE Top 25 Most Dangerous Weaknesses
Home > CWE Top 25 > 2023 On the Cusp  
ID

2023 “On the Cusp” – Other Dangerous Software Weaknesses


NOTICE: This is a previous version of the Top 25. For the most recent version go here.


Top 25 Home
Share via:
View in table format
On the Cusp Insights

2023 CWE Top 25 - On the Cusp
×
Rank ID NameScore CVEs in KEV Rank Change vs. 2022
26 CWE-617 Reachable Assertion 2.99 0 +18
27 CWE-427 Uncontrolled Search Path Element 2.84 0 0
28 CWE-611 Improper Restriction of XML External Entity Reference 2.79 0 -4
29 CWE-770 Allocation of Resources Without Limits or Throttling 2.77 0 +13
30 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor 2.69 2 +3
31 CWE-732 Incorrect Permission Assignment for Critical Resource 2.42 2 -1
32 CWE-601 URL Redirection to Untrusted Site ('Open Redirect') 2.34 0 +3
33 CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') 2.34 0 +1
34 CWE-295 Improper Certificate Validation 2.33 1 -8
35 CWE-522 Insufficiently Protected Credentials 2.23 0 +3
36 CWE-401 Missing Release of Memory after Effective Lifetime 2.18 0 0
37 CWE-400 Uncontrolled Resource Consumption 2.02 1 -14
38 CWE-639 Authorization Bypass Through User-Controlled Key 2.00 0 +16
39 CWE-59 Improper Link Resolution Before File Access ('Link Following') 2.00 5 -2
40 CWE-668 Exposure of Resource to Wrong Sphere 1.95 0 -8
  1. Reachable Assertion
    CWE-617 CVEs in KEV: 0 Rank Last Year: 44 (up 18) upward trend
  2. Uncontrolled Search Path Element
    CWE-427 CVEs in KEV: 0 Rank Last Year: 27
  3. Improper Restriction of XML External Entity Reference
    CWE-611 CVEs in KEV: 0 Rank Last Year: 24 (down 4) downward trend
  4. Allocation of Resources Without Limits or Throttling
    CWE-770 CVEs in KEV: 0 Rank Last Year: 42 (up 13) upward trend
  5. Exposure of Sensitive Information to an Unauthorized Actor
    CWE-200 CVEs in KEV: 2 Rank Last Year: 33 (up 3) upward trend
  6. Incorrect Permission Assignment for Critical Resource
    CWE-732 CVEs in KEV: 2 Rank Last Year: 30 (down 1) downward trend
  7. URL Redirection to Untrusted Site ('Open Redirect')
    CWE-601 CVEs in KEV: 0 Rank Last Year: 35 (up 3) upward trend
  8. Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
    CWE-1321 CVEs in KEV: 0 Rank Last Year: 34 (up 1) upward trend
  9. Improper Certificate Validation
    CWE-295 CVEs in KEV: 1 Rank Last Year: 26 (down 8) downward trend
  10. Insufficiently Protected Credentials
    CWE-522 CVEs in KEV: 0 Rank Last Year: 38 (up 3) upward trend
  11. Missing Release of Memory after Effective Lifetime
    CWE-401 CVEs in KEV: 0 Rank Last Year: 36
  12. Uncontrolled Resource Consumption
    CWE-400 CVEs in KEV: 1 Rank Last Year: 23 (down 14) downward trend
  13. Authorization Bypass Through User-Controlled Key
    CWE-639 CVEs in KEV: 0 Rank Last Year: 54 (up 16) upward trend
  14. Improper Link Resolution Before File Access ('Link Following')
    CWE-59 CVEs in KEV: 5 Rank Last Year: 37 (down 2) downward trend
  15. Exposure of Resource to Wrong Sphere
    CWE-668 CVEs in KEV: 0 Rank Last Year: 32 (down 8) downward trend
Back to top
Page Last Updated: November 11, 2024
 

Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2024, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.